Function at 0x1029bbf
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x125c
call fcn.01031a20
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push ebx
mov dword [ebp - 0x1250], ebx
mov dword [ebp - 0x125c], ebx
mov dword [ebp - 0x1258], 1
call fcn.010296be
call fcn.01029046
lea eax, [ebp - 0x1250]
push eax
push 0x2001f
push ebx
push 0x1003430
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1029d7b
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
mov dword [ebp - 0x1254], ebx
cmp dword [ebp - 0x1254], ebx
lea eax, [ebp - 0x104]
je 0x1029c44
push 0x1003410
jmp 0x1029c49
push 0x10033f4
push 0x7f
push eax
call fcn.01028a67
push 0x10033e4
push 0x7f
lea eax, [ebp - 0x204]
push eax
call fcn.01028a67
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0x124c]
push eax
lea eax, [ebp - 0x1258]
push eax
push ebx
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x1250]
mov dword [ebp - 0x125c], 0x1048
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029d5b
cmp dword [ebp - 0x1258], 1
jne 0x1029d5b
lea eax, [ebp - 0x124c]
push 0x2f
push eax
mov word [ebp - 0x206], bx
call edi
cmp eax, ebx
pop ecx
pop ecx
je 0x1029d48
lea esi, [eax + 2]
push 0x2f
push esi
call edi
cmp eax, ebx
pop ecx
pop ecx
je 0x1029ce7
lea esi, [eax + 2]
push 0x2f
push esi
call edi
cmp eax, ebx
pop ecx
pop ecx
je 0x1029ce7
mov word [eax], bx
cmp esi, ebx
je 0x1029d48
push 0x3f
push esi
call edi
cmp eax, ebx
pop ecx
pop ecx
je 0x1029cf9
mov word [eax], bx
push esi
call dword [sym.imp.msvcrt.dll__wcslwr]
mov dword [esp], 0x10033c0
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, ebx
pop ecx
pop ecx
je 0x1029d48
mov word [eax], bx
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x1029d1c
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x1250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1029d5b
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x1250]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc dword [ebp - 0x1254]
cmp dword [ebp - 0x1254], 2
jl 0x1029c2f
push dword [ebp - 0x1250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea eax, [ebp - 0x1250]
push eax
push 3
push ebx
push 0x1002db8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1029e15
push 4
pop esi
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0x1254]
push eax
lea eax, [ebp - 0x1258]
push eax
push ebx
push 0x10033a0
push dword [ebp - 0x1250]
mov dword [ebp - 0x1254], ebx
mov dword [ebp - 0x125c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029e09
cmp dword [ebp - 0x1258], esi
je 0x1029de4
cmp dword [ebp - 0x1258], 3
jne 0x1029e09
push dword [ebp - 0x125c]
lea eax, [ebp - 0x1254]
push eax
push dword [ebp - 0x1258]
push ebx
push 0x1003380
push dword [ebp - 0x1250]
push ebx
call fcn.0103376e
push dword [ebp - 0x1250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.01031a01
leave
ret