Function at 0x103f44a
Capabilities:
Delete registry value
Persist via autoplayhandlers registry key
Persist via contextmenuhandlers registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x7e8], edi
mov dword [ebp - 0x7fc], edi
call fcn.0103871f
test eax, eax
jne 0x1040787
push ebx
push esi
call fcn.010387c4
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x103fe48
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c418
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f523
push 0x10038d8
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f504
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f4de
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1002d58
push 1
push edi
push 0x100ccb0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c380
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f5b0
push 0x10039a0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f591
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f56b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1002d58
push 1
push edi
push 0x100ccb0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c2e8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f63d
push 0x10038d8
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f61e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f5f8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1002d58
push 1
push edi
push 0x100ccb0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c250
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f6ca
push 0x10039a0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f6ab
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f685
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1002d58
push 1
push edi
push 0x100ccb0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c1a8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f740
push 0x10038d8
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f738
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f712
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c0f8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f7b6
push 0x100cc60
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f7ae
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f788
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100be58
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f82c
push 0x10038d8
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f824
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f7fe
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100bda8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103f8a2
push 0x100cc60
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x103f89a
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103f874
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
lea eax, [ebp - 0x7fc]
push eax
push 0x2001f
push edi
push dword [0x10472a0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fe48
lea eax, [ebp - 0x7e8]
push eax
push 0x20019
push edi
push 0x10077d4
push dword [ebp - 0x7fc]
mov dword [ebp - 0x7f0], edi
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x810], edi
mov dword [ebp - 0x80c], edi
mov dword [ebp - 0x800], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fe40
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x514]
push eax
push edi
jmp 0x103fe1a
inc dword [ebp - 0x808]
lea eax, [ebp - 0x514]
push eax
call fcn.010389eb
test eax, eax
je 0x103fe02
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7e8]
call fcn.01038a4d
test eax, eax
je 0x103fe02
lea eax, [ebp - 0x810]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fe02
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x7e4]
push eax
push edi
push edi
push 0x1007890
push dword [ebp - 0x810]
mov dword [ebp - 0x7ec], edi
mov dword [ebp - 0x7f0], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x103f9d6
lea eax, [ebp - 0x514]
push eax
push 0x1007880
lea eax, [ebp - 0x7e4]
push 0x63
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x30c]
push eax
push edi
push edi
push 0x100c808
push dword [ebp - 0x810]
mov dword [ebp - 0x7f0], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x103fa22
lea eax, [ebp - 0x514]
push eax
push 0x100c7e4
lea eax, [ebp - 0x30c]
push 0x3f
push eax
call fcn.01028b64
add esp, 0x10
mov dword [ebp - 0x804], edi
cmp dword [ebp - 0x804], edi
lea eax, [ebp - 0x7f8]
push eax
push 0x2001f
mov dword [ebp - 0x7f8], edi
mov dword [ebp - 0x7f4], edi
push edi
lea eax, [ebp - 0x7e4]
je 0x103fa55
lea eax, [ebp - 0x30c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fdfa
push edi
lea eax, [ebp - 0x80c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c788
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103faaa
push 0x4e
push 0x10038d8
push 1
push edi
push edi
push dword [ebp - 0x80c]
call esi
push dword [ebp - 0x80c]
call ebx
push edi
lea eax, [ebp - 0x80c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100c728
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103faeb
push 0x4e
push 0x10039a0
push 1
push edi
push edi
push dword [ebp - 0x80c]
call esi
push dword [ebp - 0x80c]
call ebx
lea eax, [ebp - 0x7ec]
push eax
push 1
push edi
push 0x100cc38
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fb75
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103fb6d
cmp dword [ebp - 0x800], 1
je 0x103fb4d
cmp dword [ebp - 0x800], 2
jne 0x103fb6d
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x71c]
push eax
call fcn.010387f5
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x7ec]
push eax
push 0x20006
push edi
push 0x100c6b0
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fbd1
cmp dword [ebp - 0x7f4], edi
je 0x103fbb8
push 2
push 0x1002d58
push 1
push edi
push 0x100a884
push dword [ebp - 0x7ec]
call esi
jmp 0x103fbc9
push 0x100a884
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x28c]
push eax
push edi
push edi
push 0x1009c14
push dword [ebp - 0x810]
mov dword [ebp - 0x7f0], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103fcf9
lea eax, [ebp - 0x28c]
push eax
push 0x100cc14
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x103fddf
lea eax, [ebp - 0x7ec]
push eax
push 1
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fcb8
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103fcb0
cmp dword [ebp - 0x800], 1
je 0x103fc90
cmp dword [ebp - 0x800], 2
jne 0x103fcb0
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x71c]
push eax
call fcn.010387f5
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x28c]
push eax
push 0x100c69c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x103fddf
lea eax, [ebp - 0x7ec]
push eax
push 0x20006
push edi
lea eax, [ebp - 0x20c]
push eax
jmp 0x103fd95
lea eax, [ebp - 0x7ec]
push eax
push 1
push edi
push 0x100a35c
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fd83
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103fd7b
cmp dword [ebp - 0x800], 1
je 0x103fd5b
cmp dword [ebp - 0x800], 2
jne 0x103fd7b
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x71c]
push eax
call fcn.010387f5
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x7ec]
push eax
push 0x20006
push edi
push 0x100a328
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103fddf
cmp dword [ebp - 0x7f4], edi
je 0x103fdc6
push 2
push 0x1002d58
push 1
push edi
push 0x100a884
push dword [ebp - 0x7ec]
call esi
jmp 0x103fdd7
push 0x100a884
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call ebx
push dword [ebp - 0x7f8]
call ebx
inc dword [ebp - 0x804]
cmp dword [ebp - 0x804], 2
jl 0x103fa28
push dword [ebp - 0x810]
call ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x808]
push dword [ebp - 0x7e8]
mov dword [ebp - 0x7f0], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x103f928
push dword [ebp - 0x7e8]
call ebx
push dword [ebp - 0x7fc]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100bcd8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103fea3
push 2
push 0x1002d58
push 1
push edi
push 0x100bca4
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1002d58
push 1
push edi
push 0x100bc78
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100bba8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103fee7
push 2
push 0x1002d58
push 1
push edi
push 0x100bb74
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100ba90
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ff2b
push 2
push 0x1002d58
push 1
push edi
push 0x100ba48
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b970
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ff6f
push 2
push 0x1002d58
push 1
push edi
push 0x100b938
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b860
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ffb3
push 2
push 0x1002d58
push 1
push edi
push 0x100b834
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b760
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103fff7
push 2
push 0x1002d58
push 1
push edi
push 0x100b734
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b660
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104003b
push 2
push 0x1002d58
push 1
push edi
push 0x100b734
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b598
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10400db
push 0x24
push 0x100cbf0
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x18
push 0x100cbb4
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x1004598
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100ca50
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104017b
push 0x24
push 0x100ca28
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x1c
push 0x100ca0c
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x1004598
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b338
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104021b
push 0x24
push 0x100c9e8
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x10
push 0x100c9d8
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x1004598
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b4d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10402bb
push 0x24
push 0x100c9b4
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x14
push 0x100c9a0
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 8
push 0x100c998
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b180
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104035b
push 0x24
push 0x100c974
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x10
push 0x100c964
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x1004598
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b258
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10403fb
push 0x24
push 0x100c940
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x10
push 0x100c964
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x1004598
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b408
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104049b
push 0x24
push 0x100c91c
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x16
push 0x100c904
push 1
push edi
push 0x100cb98
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x100c8f8
push 1
push edi
push 0x100cb80
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100b0c8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1040550
push 0x26
push 0x100c8d0
push 1
push edi
push 0x100cbe0
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10059f4
push 1
push edi
push 0x100cbcc
push dword [ebp - 0x7e8]
call esi
push 0x4e
push 0x100c880
push 1
push edi
push 0x100c860
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x100cb18
push 2
push edi
push 0x1009aec
push dword [ebp - 0x7e8]
call esi
push 0x16
push 0x100c848
push 1
push edi
push 0x100c838
push dword [ebp - 0x7e8]
call esi
push 0x100c820
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7e8]
call ebx
lea eax, [ebp - 0x7e8]
push eax
push 0x2001f
push edi
push 0x100c628
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1040680
lea eax, [ebp - 0x7fc]
push eax
push 0x2001f
push edi
push 0x1002f50
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1040678
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x804], 0x104
jmp 0x1040649
push edi
lea eax, [ebp - 0x808]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7fc]
mov dword [ebp - 0x804], 0x104
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1040649
push 0x1002d58
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x104062e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1040604
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100c608
push dword [ebp - 0x808]
call esi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x808]
call ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x514]
push eax
push edi
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10405af
push dword [ebp - 0x7fc]
call ebx
push dword [ebp - 0x7e8]
call ebx
lea eax, [ebp - 0x7fc]
push eax
push 0x20006
push edi
push 0x100c550
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1040785
push 0x1002d58
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x104077d
lea eax, [ebp - 0x7f4]
push eax
push 2
push edi
push 0x100c500
push dword [ebp - 0x7fc]
mov dword [ebp - 0x7f4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1040723
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10406f1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100c608
push dword [ebp - 0x7f4]
call esi
push dword [ebp - 0x7f4]
call ebx
lea eax, [ebp - 0x7f4]
push eax
push 2
push edi
push 0x100c4b0
push dword [ebp - 0x7fc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104077d
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x104074b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100c608
push dword [ebp - 0x7f4]
call esi
push dword [ebp - 0x7f4]
call ebx
push dword [ebp - 0x7fc]
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01031a01
leave
ret