Function at 0x100f299
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x284
cmp dword [0x103b4fc], 0
mov eax, dword [0x103b3bc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x104
mov dword [ebp - 4], eax
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x27c], edi
je 0x100f2d0
and dword [ebp + 0xc], 0
push 0xc
push edi
lea eax, [ebp - 0x270]
push eax
push esi
call fcn.0100ed4a
push 0x2e
lea eax, [ebp - 0x270]
push eax
call fcn.01007a61
test eax, eax
jne 0x100f304
push edi
push 0x1001d88
lea eax, [ebp - 0x270]
push eax
call fcn.0100e69c
lea eax, [ebp - 0x16c]
push eax
push edi
call dword [0x100123c]
push edi
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e984
push edi
push esi
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e69c
mov ebx, dword [0x100124c]
lea eax, [ebp - 0x16c]
push eax
call ebx
cmp eax, 0xffffffff
lea eax, [ebp - 0x16c]
push eax
jne 0x100f427
push esi
call fcn.0100f1be
test eax, eax
jne 0x100f420
lea eax, [ebp - 0x278]
push eax
push 0x20019
push 0
push 0x1001968
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100f3bf
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x280]
push eax
push 0
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x278]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100f3bf
mov esi, 0x168
jmp 0x100f3f1
push 1
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e9da
mov esi, 0x168
push esi
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e984
push esi
push 0x1001d90
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e69c
push esi
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e984
push esi
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e69c
lea eax, [ebp - 0x16c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x100f431
lea eax, [ebp - 0x16c]
push eax
call fcn.0100e7f6
jmp 0x100f566
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x100f43f
xor eax, eax
jmp 0x100f566
push dword [ebp - 0x274]
mov dword [0x103b4fc], 1
push 0xe
call fcn.01023837
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [fcn.0100134c]
mov eax, dword [0x103d574]
add esp, 0xc
cmp eax, esi
jne 0x100f481
mov eax, dword [0x103d498]
lea eax, [eax + eax*4]
shl eax, 4
mov eax, dword [eax + 0x103d5a0]
mov ecx, dword [0x103d504]
or ecx, 0x24
push ecx
push dword [0x103d324]
lea ecx, [ebp - 0x16c]
push ecx
push eax
call dword [0x1001458]
cmp eax, 6
je 0x100f4ab
xor eax, eax
jmp 0x100f560
mov eax, dword [0x103d498]
push esi
push dword [ebp - 0x274]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x103d5a0]
call fcn.0100c7bc
mov ebx, eax
cmp ebx, esi
je 0x100f55e
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x16c]
push eax
push edi
push esi
push ebx
push esi
call dword [0x1001228]
test eax, eax
jbe 0x100f55e
mov eax, dword [ebp - 0x274]
mov byte [eax - 1], 0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x278]
push eax
push esi
push 0xf003f
push esi
push str.Folder
push esi
push 0x1001968
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100f55e
lea eax, [ebp - 0x16c]
push eax
call dword [fcn.0100128c]
inc eax
push eax
lea eax, [ebp - 0x16c]
push eax
push 1
push esi
push dword [ebp - 0x274]
push dword [ebp - 0x278]
call dword [entry0]
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov dword [0x103b4fc], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01037c59
leave
ret 8