Function at 0x100105cc
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.10043680
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov dword [ebp - 0x1c], ecx
push dword [0x10061178]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], 0x1000
mov dword [ebp - 0xc], ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x1001061c
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 8], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov byte [ebp - 0x1420], bl
jne 0x1001071f
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x10061198]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 4
push dword [ebp - 8]
call edi
test eax, eax
jne 0x10010713
mov esi, 0x2222
cmp dword [ebp - 0xc], esi
jne 0x10010713
mov eax, dword [ebp - 0x1c]
mov dword [0x1007842c], esi
mov eax, dword [eax + 0xec]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x10010685
xor eax, eax
jmp 0x100106bb
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
add eax, 3
and al, 0xfc
call fcn.10043680
mov esi, esp
push ebx
push ebx
push dword [ebp - 0x18]
mov byte [esi], bl
push esi
push 0xffffffffffffffff
push dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, esi
mov esi, 0x2222
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 0x1420]
push ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push dword [ebp - 8]
call edi
cmp eax, ebx
jne 0x10010713
cmp dword [ebp - 0x20], ebx
jne 0x100106f5
lea eax, [ebp - 0x1420]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 0x1420], bl
jmp 0x1001071f
lea eax, [ebp - 0x1420]
push esi
push eax
call fcn.10044590
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.100112f3
cmp byte [ebp - 0x1420], bl
jne 0x10010829
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [0x10061174]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10010829
xor eax, eax
cmp dword [ebp - 8], ebx
je 0x1001075c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 8], esi
jne 0x10010829
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [0x10061198]
mov dword [ebp - 4], 0x1000
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 4
push esi
call edi
test eax, eax
jne 0x10010972
mov eax, 0x1111
cmp dword [ebp - 0x10], eax
jne 0x10010972
mov dword [0x1007842c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xec]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x100107c3
xor eax, eax
jmp 0x100107f7
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
add eax, 3
and al, 0xfc
call fcn.10043680
mov esi, esp
push ebx
push ebx
push dword [ebp - 0x18]
mov byte [esi], bl
push esi
push 0xffffffffffffffff
push dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, esi
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], ebx
push ecx
lea ecx, [ebp - 0x1420]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push esi
call edi
test eax, eax
jne 0x10010829
cmp dword [ebp - 4], ebx
jne 0x1001094b
lea eax, [ebp - 0x1420]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 4]
mov esi, 0x400
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.CddbHost
mov dword [ebp - 4], esi
push dword [ebp - 8]
mov byte [ebp - 0x420], bl
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
jne 0x10010886
cmp byte [ebp - 0x420], bl
je 0x10010886
lea eax, [ebp - 0x420]
push eax
push 0x10078434
call fcn.100444a0
pop ecx
lea eax, [ebp - 0x420]
pop ecx
push eax
push str.GetClientRegistryInfo:_Setting_Host:_s_n
call fcn.1001a1cc
pop ecx
pop ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.CddbTarget
mov byte [ebp - 0x420], bl
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
jne 0x100108de
cmp byte [ebp - 0x420], bl
je 0x100108de
lea eax, [ebp - 0x420]
push eax
push 0x100784b4
call fcn.100444a0
pop ecx
lea eax, [ebp - 0x420]
pop ecx
push eax
push str.GetClientRegistryInfo:_Setting_Target:_s_n
call fcn.1001a1cc
pop ecx
pop ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.CddbAdServer
mov byte [ebp - 0x420], bl
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
jne 0x10010930
cmp byte [ebp - 0x420], bl
je 0x10010930
lea eax, [ebp - 0x420]
push eax
call fcn.10032534
pop ecx
lea eax, [ebp - 0x420]
push eax
push str.GetClientRegistryInfo:_Setting_AdServer:_s_n
call fcn.1001a1cc
pop ecx
pop ecx
cmp dword [ebp - 8], ebx
je 0x1001093e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea esp, [ebp - 0x142c]
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x1420]
push 0x2222
push eax
call fcn.10044590
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.100112f3
jmp 0x10010829
cmp esi, ebx
je 0x1001097d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x10010940