Function at 0x1000a380
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bbe6
mov eax, dword fs:[0]
push eax
sub esp, 0xc40
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0xc3c], esi
mov dword [ebp - 0xc38], esi
mov dword [ebp - 0xc34], esi
lea eax, [ebp - 0xc40]
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 0xc40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000a42d
cmp dword [ebp - 0xc3c], esi
je 0x1000a426
cmp dword [ebp - 0xc38], esi
jle 0x1000a417
mov ecx, dword [ebp - 0xc3c]
mov edx, dword [ecx + esi*4]
push edx
call fcn.1000b015
inc esi
add esp, 4
cmp esi, dword [ebp - 0xc38]
jl 0x1000a3fc
mov eax, dword [ebp - 0xc3c]
push eax
call fcn.1000c71e
add esp, 4
xor eax, eax
jmp 0x1000a6ed
cmp dword [ebp - 0xc40], esi
jne 0x1000a476
cmp dword [ebp - 0xc3c], esi
je 0x1000a426
cmp dword [ebp - 0xc38], esi
jle 0x1000a460
mov ecx, dword [ebp - 0xc3c]
mov edx, dword [ecx + esi*4]
push edx
call fcn.1000b015
inc esi
add esp, 4
cmp esi, dword [ebp - 0xc38]
jl 0x1000a445
mov eax, dword [ebp - 0xc3c]
push eax
call fcn.1000c71e
add esp, 4
xor eax, eax
jmp 0x1000a6ed
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 1
mov ebx, 0x800
xor eax, eax
xor edx, edx
push 0x7fe
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
push edx
lea eax, [ebp - 0x82e]
xor ecx, ecx
push eax
mov word [ebp - 0x30], cx
mov word [ebp - 0x830], dx
call fcn.1000ae30
push esi
push str.url_d
lea ecx, [ebp - 0x30]
push 0xf
push ecx
call fcn.1000c37d
add esp, 0x1c
lea edx, [ebp - 0xc4c]
push edx
lea eax, [ebp - 0x830]
push eax
mov eax, dword [ebp - 0xc40]
lea ecx, [ebp - 0xc48]
push ecx
push 0
lea edx, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0xc48], 1
mov dword [ebp - 0xc4c], ebx
call edi
test eax, eax
jne 0x1000a5b3
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp - 0xc2e]
push edx
mov word [ebp - 0xc30], cx
call fcn.1000ae30
lea eax, [ebp - 0x830]
push 1
push eax
call fcn.10021c60
add esp, 0x14
test eax, eax
je 0x1000a5a2
push 0x200
lea ecx, [ebp - 0xc30]
push ecx
lea edx, [ebp - 0x830]
push edx
call fcn.10025e70
add esp, 0xc
test eax, eax
jne 0x1000a5a2
mov dword [ebp - 0xc44], eax
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0xc44]
call fcn.10009aa0
lea ecx, [ebp - 0xc44]
push ecx
lea ecx, [ebp - 0xc3c]
mov byte [ebp - 4], 1
call fcn.1000a2a0
mov edx, dword [ebp - 0xc44]
push edx
mov byte [ebp - 4], 0
call fcn.1000b015
add esp, 4
mov ecx, dword [ebp - 0xc40]
lea eax, [ebp - 0x30]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc esi
cmp esi, 0x19
jle 0x1000a486
mov eax, dword [ebp - 0xc38]
mov esi, 1
mov ebx, eax
cmp eax, esi
jl 0x1000a69e
xor edi, edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x82e]
xor edx, edx
push ecx
mov word [ebp - 0x30], dx
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov word [ebp - 0x830], ax
call fcn.1000ae30
push esi
push str.url_d
lea edx, [ebp - 0x30]
push 0xf
push edx
call fcn.1000c37d
lea eax, [esi - 1]
add esp, 0x1c
test eax, eax
js 0x1000a709
cmp eax, dword [ebp - 0xc38]
jge 0x1000a709
mov eax, dword [ebp - 0xc3c]
mov ecx, dword [edi + eax]
push 0x400
push ecx
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x830]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000a660
sub eax, edx
sar eax, 1
je 0x1000a692
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0xc40]
lea ecx, [ebp - 0x830]
push ecx
push 1
push 0
lea edx, [ebp - 0x30]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc esi
add edi, 4
cmp esi, ebx
jle 0x1000a5d4
mov ecx, dword [ebp - 0xc40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc3c], 0
je 0x1000a6e8
xor esi, esi
cmp dword [ebp - 0xc38], esi
jle 0x1000a6d9
mov edx, dword [ebp - 0xc3c]
mov eax, dword [edx + esi*4]
push eax
call fcn.1000b015
inc esi
add esp, 4
cmp esi, dword [ebp - 0xc38]
jl 0x1000a6be
mov ecx, dword [ebp - 0xc3c]
push ecx
call fcn.1000c71e
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]