Function at 0x10034be
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x10081b8]
push ebx
push esi
push edi
push 0x100
mov dword [ebp + 0x1a0], eax
lea eax, [ebp - 0x64]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x1ac]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x10018f4
call fcn.01004bf7
mov edi, dword [0x1008404]
pop ecx
jmp 0x10037ad
lea eax, [ebp - 0x62]
push eax
lea eax, [edi + 0x20a]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10037a7
mov esi, dword [ebp + 0x1b0]
movzx eax, si
push eax
push dword [ebp + 0x1ac]
push 0x10018d8
call fcn.01004bf7
xor eax, eax
mov al, byte [edi + 0x410]
and esi, 1
add esp, 0xc
and eax, 1
cmp ax, si
je 0x10035a1
push 0x10018bc
call fcn.01004bf7
pop ecx
push 2
lea eax, [ebp - 0x70]
push eax
call fcn.01002e5a
test eax, eax
jne 0x1003596
lea ebx, [edi + 0x208]
push ebx
push 0x10018a4
call fcn.01004bf7
pop ecx
pop ecx
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10035a1
push 0x100187c
call fcn.01004bf7
pop ecx
mov ax, word [ebp + 0x1b0]
neg si
mov word [edi + 0x410], ax
lea eax, [ebp - 0x68]
push eax
lea ebx, [edi + 0x208]
sbb esi, esi
xor eax, eax
push eax
and esi, 0xfffffffa
push eax
add esi, 0x2a
mov word [ebx], si
mov esi, dword [ebp + 0x1ac]
push 4
push esi
push eax
mov byte [esi], 0x24
call sub.NDdeApi.dll_Ordinal_509
push dword [ebp - 0x68]
push 0x100185c
call fcn.01004bf7
pop ecx
pop ecx
push dword [ebp - 0x68]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x74], eax
jne 0x100360e
push 0x1001848
call fcn.01004bf7
pop ecx
jmp 0x1003755
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp - 0x68]
push eax
push 4
push esi
push 0
call sub.NDdeApi.dll_Ordinal_509
test eax, eax
je 0x100362f
push eax
push 0x1001830
jmp 0x1003745
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1003659
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100181c
jmp 0x1003745
and dword [ebp - 0x68], 0
lea eax, [ebp - 0x6c]
push eax
push 0
jmp 0x1003718
mov eax, dword [ebp - 0x6c]
mov cl, byte [eax]
xor esi, esi
test cl, cl
je 0x1003687
cmp cl, 1
je 0x1003687
push 0x1001804
call fcn.01004bf7
jmp 0x100370d
test byte [eax + 4], 1
je 0x10036a0
push 0x1001800
call fcn.01004bf7
mov eax, dword [ebp - 0x6c]
pop ecx
mov esi, 0x80000000
test byte [eax + 4], 2
je 0x10036ba
push 0x1001800
call fcn.01004bf7
mov eax, dword [ebp - 0x6c]
pop ecx
or esi, 0x40000000
mov edx, dword [eax + 4]
mov ecx, 0x102fd
and edx, ecx
cmp edx, ecx
jne 0x10036dc
push 0x10017fc
call fcn.01004bf7
mov eax, dword [ebp - 0x6c]
pop ecx
or esi, 0xc0010000
mov ecx, dword [eax + 4]
mov eax, 0xf03ff
and ecx, eax
cmp ecx, eax
jne 0x10036fb
push 0x10017f8
call fcn.01004bf7
pop ecx
or esi, 0x10000000
push esi
push 0x10017ec
call fcn.01004bf7
mov eax, dword [ebp - 0x6c]
pop ecx
mov dword [eax + 4], esi
inc dword [ebp - 0x68]
pop ecx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x1003668
push dword [ebp - 0x74]
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x100374c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10017d8
call fcn.01004bf7
pop ecx
pop ecx
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea esi, [edi + 0x40c]
push dword [esi]
push dword [0x10081d0]
call sub.USER32.dll_DdeFreeStringHandle
push 0x4b0
push ebx
push dword [0x10081d0]
call sub.USER32.dll_DdeCreateStringHandleW
test eax, eax
mov dword [esi], eax
jne 0x100378b
push 0x10017b8
call fcn.01004bf7
jmp 0x10037a6
push 2
lea eax, [ebp - 0x70]
push eax
call fcn.01002e5a
test eax, eax
je 0x10037e1
push ebx
push 0x100178c
call fcn.01004bf7
pop ecx
pop ecx
mov edi, dword [edi + 0x41c]
test edi, edi
jne 0x100350b
push dword [ebp + 0x1ac]
push 0x100176c
call fcn.01004bf7
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x1a0]
pop edi
pop esi
pop ebx
call fcn.01006d6c
add ebp, 0x1a4
leave
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea ebx, [edi + 0x208]
call esi
push eax
push edi
push ebx
push 0x1001744
call fcn.01004bf7
add esp, 0x10
push edi
call esi
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1008a60]
push dword [0x1008430]
push dword [0x10081d0]
call sub.USER32.dll_DdePostAdvise
xor eax, eax
inc eax
jmp 0x10037c9