Function at 0x1024a55
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x988
mov eax, dword [0x102a0ec]
push esi
xor esi, esi
lea ecx, [ebp - 0x948]
mov dword [ebp - 4], eax
mov dword [ebp - 0x908], esi
call fcn.0101bd0e
mov eax, dword [ebp + 0x10]
mov dword [0x102c67c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x102c678], eax
call fcn.010224b0
lea eax, [ebp - 0x948]
push eax
call fcn.01023f00
test eax, eax
je 0x1025060
lea eax, [ebp - 0x91c]
push eax
push 0x2001b
push esi
push dword [0x102a0f4]
mov dword [ebp - 0x90c], esi
push 0x80000002
mov dword [ebp - 0x910], esi
mov dword [ebp - 0x914], esi
mov dword [ebp - 0x91c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025060
cmp dword [ebp + 0xc], esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov edi, 0x1001780
jne 0x1024c33
lea eax, [ebp - 0x908]
push eax
push 0x2001b
push esi
push 0x1007270
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024c33
lea ecx, [ebp - 0x988]
call fcn.0101bdc5
lea ecx, [ebp - 0x988]
call fcn.0101bdfe
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
jmp 0x1024c02
inc dword [ebp - 0x910]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x988]
push eax
call fcn.010182f8
test eax, eax
jne 0x1024c20
lea eax, [ebp - 0x988]
push eax
call fcn.010242bb
test eax, eax
je 0x1024be2
cmp dword [ebp + 8], esi
je 0x1024b85
cmp dword [ebp - 0x94c], esi
jne 0x1024be2
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0x948]
push eax
call fcn.0101ff1e
lea eax, [ebp - 0x914]
push eax
push 2
push esi
push dword [ebp - 0x988]
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024be2
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push 0x10077f0
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x914]
call ebx
lea ecx, [ebp - 0x988]
call fcn.0101bdfe
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x910]
push dword [ebp - 0x908]
mov dword [ebp - 0x90c], 0x10
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1024b4a
push dword [ebp - 0x908]
call ebx
lea ecx, [ebp - 0x988]
call fcn.0101bdfe
lea eax, [ebp - 0x908]
push eax
push 0x2001b
push esi
push 0x1007304
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024d2f
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x904]
push eax
mov dword [ebp - 0x910], esi
push esi
jmp 0x1024d09
inc dword [ebp - 0x910]
lea eax, [ebp - 0x904]
push eax
call fcn.0101d1e2
test eax, eax
je 0x1024cf1
cmp dword [ebp + 8], esi
je 0x1024c9a
cmp dword [ebp - 0x504], esi
jne 0x1024cf1
lea eax, [ebp - 0x904]
push eax
call fcn.01027b75
lea eax, [ebp - 0x914]
push eax
push 2
push esi
lea eax, [ebp - 0x904]
push eax
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024cf1
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push 0x10077f0
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x914]
call ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x904]
push eax
push dword [ebp - 0x910]
push dword [ebp - 0x908]
mov dword [ebp - 0x90c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1024c77
push dword [ebp - 0x908]
call ebx
cmp dword [ebp + 0xc], esi
jne 0x1025056
lea eax, [ebp - 0x908]
push eax
push 0x2001b
push esi
push 0x100724c
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024e7d
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x918], esi
mov dword [ebp - 0x910], esi
push esi
jmp 0x1024e57
inc dword [ebp - 0x910]
lea eax, [ebp - 0x918]
push eax
push 0x208
lea eax, [ebp - 0x708]
push eax
mov eax, 0x12c
push eax
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.0101d620
test eax, eax
je 0x1024e3f
cmp dword [ebp + 8], esi
je 0x1024dcd
cmp dword [ebp - 0x918], esi
jne 0x1024e3f
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x92c]
lea eax, [ebp - 0xec]
push eax
call fcn.0101e9b6
lea eax, [ebp - 0x914]
push eax
push 2
push esi
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024e3f
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push 0x10077f0
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x914]
call ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x910]
push dword [ebp - 0x908]
mov dword [ebp - 0x90c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1024d82
push dword [ebp - 0x908]
call ebx
lea eax, [ebp - 0x908]
push eax
push 0x2001b
push esi
push 0x1007260
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025056
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x924], esi
mov dword [ebp - 0x910], esi
push esi
jmp 0x1025030
inc dword [ebp - 0x910]
lea eax, [ebp - 0x924]
push eax
mov eax, 0x208
push eax
lea ecx, [ebp - 0x708]
push ecx
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.0101d9d9
test eax, eax
je 0x1025018
cmp dword [ebp + 8], esi
je 0x1024f0e
cmp dword [ebp - 0x924], esi
jne 0x1025018
lea eax, [ebp - 0x918]
push eax
push 1
push esi
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x908]
mov dword [ebp - 0x918], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024fa1
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x920]
push eax
push esi
push 0x10078ec
push dword [ebp - 0x918]
mov dword [ebp - 0x928], 0x20a
mov dword [ebp - 0x920], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1024f99
cmp dword [ebp - 0x920], 1
jne 0x1024f99
lea eax, [ebp - 0x500]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1024f99
push dword [ebp - 0x918]
jmp 0x1025016
push dword [ebp - 0x918]
call ebx
push dword [ebp - 0x944]
lea eax, [ebp - 0x708]
push dword [ebp - 0x948]
push eax
lea eax, [ebp - 0x2f4]
push eax
push dword [ebp - 0x92c]
lea eax, [ebp - 0xec]
push eax
call fcn.0101eed4
lea eax, [ebp - 0x914]
push eax
push 2
push esi
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025018
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push 0x10077f0
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x914]
call ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x910]
push dword [ebp - 0x908]
mov dword [ebp - 0x90c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1024ec7
push dword [ebp - 0x908]
call ebx
push dword [ebp - 0x91c]
call ebx
pop edi
pop ebx
lea ecx, [ebp - 0x948]
call fcn.0101bd2f
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101672d
leave
ret 0x10