Function at 0x10078af
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x208]
sub esp, 0x288
mov eax, dword [0x10171b0]
push esi
push edi
push 0x2c
mov dword [ebp + 0x204], eax
call fcn.01012759
test eax, eax
pop ecx
je 0x10078e1
mov ecx, eax
call fcn.0100db1c
mov esi, eax
jmp 0x10078e3
xor esi, esi
test esi, esi
je 0x1007901
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push 0x1001550
push esi
call dword [eax]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
test edi, edi
je 0x1007908
xor eax, eax
jmp 0x1007b4e
mov eax, dword [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 0x210]
test ebx, ebx
lea edi, [ebp + 0x1f4]
je 0x1007b65
and dword [ebp - 0x34], 0
and dword [ebp - 0x3c], 0
mov ebx, 0x10014e0
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp eax, 0x80070002
jne 0x100797b
mov eax, dword [ebp - 0x44]
mov esi, ebx
lea edi, [ebp + 0x1f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
push 0
push 0x1001d70
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x3c], 1
test eax, eax
jne 0x1007a98
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push 5
pop esi
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x1007a8f
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x80]
push edx
mov word [ebp - 0x80], 0x30
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x1007a86
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], esi
lea edx, [ebp - 0x80]
xor esi, esi
push edx
mov word [ebp - 0x80], 0x30
mov dword [ebp - 0x64], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jl 0x1007a7d
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x1007a2b
mov eax, dword [ebp + 0x218]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
and eax, 0xffffffc0
add eax, 0x40
and ecx, 0xffffffbf
or eax, ecx
mov ecx, dword [ebp - 0x38]
or eax, 0x2000
push eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x70]
cmp dword [ebp - 0x3c], esi
je 0x1007a55
push 0x111
push 0x1001d6c
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x30], si
call fcn.01012580
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x214]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp + 0x210]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor edi, edi
push 0x10013e0
push edi
push edi
lea ecx, [ebp + 0x1f8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], 4
call fcn.01006f11
push 0xffffffffffffffff
lea ecx, [ebp + 0x1f8]
call fcn.01006f5b
push 1
push 0x2001f
push 2
call fcn.0100723a
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x1007b35
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push edi
push 0x10
mov esi, 0x1001d60
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x1007b29
mov eax, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
and eax, 0xffffffdf
push 4
and ebx, 0x20
or ebx, eax
lea eax, [ebp - 0x40]
push eax
push 4
push edi
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp + 0x1f8]
call fcn.01006f84
lea ecx, [ebp + 0x1f8]
call fcn.01006f36
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x204]
pop edi
pop esi
call fcn.0101207f
add ebp, 0x208
leave
ret 0xc
mov esi, 0x10014e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x1007a9e