Function at 0x100b637
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x208]
sub esp, 0x288
mov eax, dword [0x10171b0]
push esi
push edi
push 0x2c
mov dword [ebp + 0x204], eax
call fcn.010127cb
test eax, eax
pop ecx
je 0x100b669
mov ecx, eax
call fcn.01006d5a
mov esi, eax
jmp 0x100b66b
xor esi, esi
test esi, esi
je 0x100b689
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push 0x100147c
push esi
call dword [eax]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
test edi, edi
je 0x100b690
xor eax, eax
jmp 0x100b8d6
mov eax, dword [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 0x210]
test ebx, ebx
lea edi, [ebp + 0x1f4]
je 0x100b8ed
and dword [ebp - 0x34], 0
and dword [ebp - 0x3c], 0
mov ebx, 0x100140c
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp eax, 0x80070002
jne 0x100b703
mov eax, dword [ebp - 0x44]
mov esi, ebx
lea edi, [ebp + 0x1f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
push 0
push 0x1001e24
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x3c], 1
test eax, eax
jne 0x100b820
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push 5
pop esi
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x100b817
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x80]
push edx
mov word [ebp - 0x80], 0x30
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x100b80e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], esi
lea edx, [ebp - 0x80]
xor esi, esi
push edx
mov word [ebp - 0x80], 0x30
mov dword [ebp - 0x64], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jl 0x100b805
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x100b7b3
mov eax, dword [ebp + 0x218]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
and eax, 0xffffffc0
add eax, 0x40
and ecx, 0xffffffbf
or eax, ecx
mov ecx, dword [ebp - 0x38]
or eax, 0x2000
push eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x70]
cmp dword [ebp - 0x3c], esi
je 0x100b7dd
push 0x111
push 0x10017b4
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x30], si
call fcn.010125ec
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x214]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp + 0x210]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor edi, edi
push 0x1001540
push edi
push edi
lea ecx, [ebp + 0x1f8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], 4
call fcn.01004604
push 0xffffffffffffffff
lea ecx, [ebp + 0x1f8]
call fcn.0100464e
push 1
push 0x2001f
push 2
call fcn.0100afc2
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x100b8bd
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push edi
push 0x10
mov esi, 0x1001e18
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x100b8b1
mov eax, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
and eax, 0xffffffdf
push 4
and ebx, 0x20
or ebx, eax
lea eax, [ebp - 0x40]
push eax
push 4
push edi
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp + 0x1f8]
call fcn.01004677
lea ecx, [ebp + 0x1f8]
call fcn.01004629
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x204]
pop edi
pop esi
call fcn.010120eb
add ebp, 0x208
leave
ret 0xc
mov esi, 0x100140c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x100b826