Function at 0x100c3da
Capabilities:
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10133a4]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], ebx
call fcn.0100a8bd
test eax, eax
mov dword [ebp - 0x58], eax
je 0x100c649
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, eax
test edi, edi
je 0x100c648
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x20]
push ebx
push eax
call esi
push ebx
lea eax, [edi + 0x40]
push eax
call esi
push str.NDDE_
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x1002768
mov esi, 0x1013860
push esi
call ebx
add esp, 0x10
push 0
push esi
push dword [0x1013508]
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push 0x1002750
mov dword [edi + 0xc], eax
call fcn.0100eda2
push str.NDDE_0001
push dword [ebp - 0x5c]
push 0x1002768
push esi
call ebx
add esp, 0x18
push 0
push esi
push dword [0x1013508]
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push 0x1002744
mov dword [edi + 0x10], eax
call fcn.0100eda2
pop ecx
pop ecx
push 0
push dword [0x1014184]
push dword [edi + 0xc]
push dword [ebp - 0x58]
call fcn.0100c1ea
test eax, eax
mov dword [edi], eax
je 0x100c62b
push eax
push dword [ebp - 0x58]
call fcn.0100c30c
test eax, eax
je 0x100c61e
lea eax, [edi + 0x20]
push eax
push 0x1013fe0
push esi
call ebx
add esp, 0xc
push esi
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebp - 0x88]
push eax
lea eax, [edi + 0x20]
push eax
mov dword [ebp - 0x5c], eax
call fcn.01009ac6
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x100c529
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x58]
mov dword [ebp - 0x88], 0x2c
mov dword [ebp - 0x84], 1
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x100c530
push 1
push dword [ebp - 0x58]
call ebx
push 5
push dword [edi + 0x14]
call ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push dword [ebp - 0x58]
push 0x222
push dword [0x1013d24]
call ebx
push 0
push 1
push 0x230
push dword [0x1013d24]
call ebx
mov eax, dword [ebp - 0x58]
push 0
push eax
mov dword [0x10134f0], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [ebp + 0xc], 0
mov dword [0x10134f4], eax
lea eax, [ebp - 0x54]
je 0x100c5ca
push esi
push str.Connections
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
cmp word [edi + 0x18], 0xa
push 4
setne al
inc eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push 4
push 0
lea eax, [ebp - 0x54]
push eax
push dword [0x1013e8c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push 0x1002728
call fcn.0100eda2
pop ecx
pop ecx
jmp 0x100c619
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 4
push str.Connections
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
push eax
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x54]
push eax
push dword [0x1013e8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x5c], 2
jne 0x100c619
push esi
push 0x2e
push 0x111
push dword [0x1013ba4]
call ebx
xor eax, eax
inc eax
jmp 0x100c647
push 0x1002710
call fcn.0100eda2
pop ecx
jmp 0x100c645
push dword [0x1013508]
call sub.USER32.dll_DdeGetLastError
push eax
push esi
push 0x10026ec
call fcn.0100eda2
add esp, 0xc
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100ec8a
leave
ret 8