Function at 0x1000b300
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1001857e
mov eax, dword fs:[0]
push eax
mov eax, 0x2740
call fcn.1000e760
mov eax, dword [0x1001f220]
xor eax, esp
mov dword [esp + 0x273c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1001f220]
xor eax, esp
push eax
lea eax, [esp + 0x2754]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2764]
push 0x2710
xor ebp, ebp
lea eax, [esp + 0x44]
push ebp
push eax
mov dword [esp + 0x2768], 2
mov dword [esp + 0x40], 0x2710
call fcn.1000d040
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.10008b30
mov edi, dword [esp + 0x276c]
mov ebx, 0x10
cmp dword [esp + 0x2780], ebx
mov byte [esp + 0x275c], 3
jae 0x1000b39b
lea edi, [esp + 0x276c]
push ebp
lea ecx, [esp + 0x34]
push ecx
push ebp
call fcn.10008e90
push eax
push ebp
push ebp
push ebp
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebp
je 0x1000b499
cmp dword [esp + 0x2780], ebx
mov eax, dword [esp + 0x276c]
jae 0x1000b3d4
lea eax, [esp + 0x276c]
push eax
push str.Error_creating_registry_key:__s
lea edx, [esp + 0x34]
push esi
push edx
call fcn.10008d30
add esp, 0x10
lea ecx, [esp + 0x2c]
mov byte [esp + 0x275c], 2
call fcn.10008b50
cmp dword [esp + 0x2780], ebx
jb 0x1000b412
mov eax, dword [esp + 0x276c]
push eax
call fcn.1000cb22
add esp, 4
cmp dword [esp + 0x279c], ebx
mov edi, 0xf
mov dword [esp + 0x2780], edi
mov dword [esp + 0x277c], ebp
mov byte [esp + 0x276c], 0
jb 0x1000b446
mov ecx, dword [esp + 0x2788]
push ecx
call fcn.1000cb22
add esp, 4
mov eax, dword [esp + 0x27a4]
cmp eax, ebp
mov dword [esp + 0x279c], edi
mov dword [esp + 0x2798], ebp
mov byte [esp + 0x2788], 0
je 0x1000b492
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x27ac]
lea ecx, [esp + 0x27a4]
push ecx
push edx
push eax
call fcn.10002550
mov eax, dword [esp + 0x27b4]
push eax
call fcn.1000cb22
add esp, 0x14
mov eax, esi
jmp 0x1000b94d
cmp dword [esp + 0x279c], ebx
mov eax, dword [esp + 0x2788]
jae 0x1000b4b0
lea eax, [esp + 0x2788]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x44]
push edx
push ebp
push ebp
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.10009a00
add esp, 8
mov esi, dword [esp + 0x27a4]
mov eax, dword [esp + 0x27a8]
cmp esi, eax
mov byte [esp + 0x275c], 4
jbe 0x1000b500
call fcn.1000d255
mov eax, dword [esp + 0x27a8]
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], esi
jmp 0x1000b510
cmp dword [esp + 0x27a4], eax
mov esi, eax
jbe 0x1000b52b
call fcn.1000d255
mov eax, dword [esp + 0x27a8]
mov ebp, dword [esp + 0x24]
cmp dword [esp + 0x18], esi
je 0x1000b694
mov esi, dword [esp + 0x20]
cmp esi, ebp
jbe 0x1000b546
call fcn.1000d255
mov ebp, dword [esp + 0x24]
mov ebx, esi
cmp dword [esp + 0x20], ebp
mov esi, ebp
jbe 0x1000b559
call fcn.1000d255
mov ebp, dword [esp + 0x24]
cmp ebx, esi
je 0x1000b66d
cmp ebx, ebp
jb 0x1000b56e
call fcn.1000d255
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x27a8]
cmp dword [esp + 0x18], eax
jb 0x1000b584
call fcn.1000d255
mov ebp, dword [esp + 0x24]
cmp dword [ebx + 0x18], 0x10
mov edi, dword [ebx + 0x14]
jb 0x1000b592
mov edx, dword [ebx + 4]
jmp 0x1000b595
lea edx, [ebx + 4]
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x14]
cmp esi, edi
mov eax, esi
mov ecx, esi
jb 0x1000b5a6
mov ecx, edi
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x18], 0x10
jb 0x1000b5b5
mov eax, dword [eax + 4]
jmp 0x1000b5b8
add eax, 4
push ecx
push edx
push eax
call fcn.10001050
add esp, 0xc
test eax, eax
jne 0x1000b658
cmp esi, edi
jb 0x1000b658
cmp esi, edi
setne al
test eax, eax
jne 0x1000b658
cmp ebx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
mov dword [esp + 0x38], eax
mov edi, ebx
ja 0x1000b5f5
call fcn.1000d255
mov ebp, dword [esp + 0x24]
lea esi, [edi + 0x1c]
sub ebx, 0x1c
cmp esi, ebp
je 0x1000b619
sub edi, esi
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esi + edi]
call fcn.10001ab0
add esi, 0x1c
cmp esi, ebp
jne 0x1000b601
mov ebp, dword [esp + 0x24]
lea esi, [ebp - 0x1c]
cmp esi, ebp
mov edi, ebp
je 0x1000b651
cmp dword [esi + 0x18], 0x10
jb 0x1000b634
mov ecx, dword [esi + 4]
push ecx
call fcn.1000cb22
add esp, 4
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
add esi, 0x1c
cmp esi, edi
jne 0x1000b622
mov ebp, dword [esp + 0x24]
sub ebp, 0x1c
mov dword [esp + 0x24], ebp
cmp ebx, ebp
jb 0x1000b665
call fcn.1000d255
mov ebp, dword [esp + 0x24]
add ebx, 0x1c
jmp 0x1000b548
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x27a8]
jb 0x1000b683
call fcn.1000d255
mov ebp, dword [esp + 0x24]
add dword [esp + 0x18], 0x1c
mov eax, dword [esp + 0x27a8]
jmp 0x1000b510
cmp dword [esp + 0x27a4], eax
mov dword [esp + 0x38], eax
jbe 0x1000b6aa
call fcn.1000d255
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x27a4]
cmp eax, dword [esp + 0x27a8]
lea ebx, [esp + 0x27a0]
mov dword [esp + 0x14], eax
jbe 0x1000b6ce
call fcn.1000d255
mov ebp, dword [esp + 0x24]
cmp dword [esp + 0x20], ebp
lea esi, [esp + 0x27a0]
mov edi, ebp
jbe 0x1000b6e2
call fcn.1000d255
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
push ecx
push esi
lea eax, [esp + 0x30]
push edi
push eax
mov ecx, eax
call fcn.10008730
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x44]
push eax
sub esp, 0x10
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.10002ee0
call fcn.100098f0
mov eax, dword [esp + 0x27a0]
mov ebp, 0x10
add esp, 0x18
cmp dword [esp + 0x279c], ebp
jae 0x1000b741
lea eax, [esp + 0x2788]
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x44]
push edx
push 7
xor esi, esi
push esi
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
cmp edi, esi
je 0x1000b860
push str.Error_setting_registry_value
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.10008d30
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp eax, esi
je 0x1000b7a3
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x20]
push ecx
push edx
push eax
call fcn.10002550
mov eax, dword [esp + 0x30]
push eax
call fcn.1000cb22
add esp, 0x14
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0x275c], 2
call fcn.10008b50
cmp dword [esp + 0x2780], ebp
jb 0x1000b7d9
mov ecx, dword [esp + 0x276c]
push ecx
call fcn.1000cb22
add esp, 4
cmp dword [esp + 0x279c], ebp
mov ebx, 0xf
mov dword [esp + 0x2780], ebx
mov dword [esp + 0x277c], esi
mov byte [esp + 0x276c], 0
jb 0x1000b80d
mov edx, dword [esp + 0x2788]
push edx
call fcn.1000cb22
add esp, 4
mov eax, dword [esp + 0x27a4]
cmp eax, esi
mov dword [esp + 0x279c], ebx
mov dword [esp + 0x2798], esi
mov byte [esp + 0x2788], 0
je 0x1000b859
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x27ac]
lea edx, [esp + 0x27a4]
push edx
push ecx
push eax
call fcn.10002550
mov edx, dword [esp + 0x27b4]
push edx
call fcn.1000cb22
add esp, 0x14
mov eax, edi
jmp 0x1000b94d
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x1000b895
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
push ecx
push eax
call fcn.10002550
mov edx, dword [esp + 0x30]
push edx
call fcn.1000cb22
add esp, 0x14
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0x275c], 2
call fcn.10008b50
cmp dword [esp + 0x2780], ebp
jb 0x1000b8cb
mov eax, dword [esp + 0x276c]
push eax
call fcn.1000cb22
add esp, 4
cmp dword [esp + 0x279c], ebp
mov edi, 0xf
mov dword [esp + 0x2780], edi
mov dword [esp + 0x277c], esi
mov byte [esp + 0x276c], 0
jb 0x1000b8ff
mov ecx, dword [esp + 0x2788]
push ecx
call fcn.1000cb22
add esp, 4
mov eax, dword [esp + 0x27a4]
cmp eax, esi
mov dword [esp + 0x279c], edi
mov dword [esp + 0x2798], esi
mov byte [esp + 0x2788], 0
je 0x1000b94b
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x27ac]
lea ecx, [esp + 0x27a4]
push ecx
push edx
push eax
call fcn.10002550
mov eax, dword [esp + 0x27b4]
push eax
call fcn.1000cb22
add esp, 0x14
xor eax, eax
mov ecx, dword [esp + 0x2754]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x273c]
xor ecx, esp
call fcn.1000d030
add esp, 0x274c
ret 0x4c