Function at 0x102823c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x234
mov eax, 0x104274d
call fcn.01001615
mov esi, 0x1028560
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call dword [0x1050b68]
test al, al
je 0x102827e
push 0x1028550
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call fcn.0101ddc6
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x228]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10192a8
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push eax
call fcn.0100b113
cmp eax, ebx
mov dword [ebp - 0x21c], eax
jl 0x1028543
push 0x101931c
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x238], 0x104
call fcn.01003615
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x228]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x22c], eax
jne 0x1028504
mov edi, SysStringLen
inc dword [ebp - 0x234]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x238], 0x104
call fcn.01003615
mov eax, dword [ebp - 0x23c]
push dword [eax - 0xc]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.0100977f
push dword [ebp - 0x23c]
mov byte [ebp - 4], 2
push dword [ebp - 0x230]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x102848e
lea eax, [ebp - 0x224]
push eax
push 1
push ebx
lea eax, [ebp - 0x218]
push eax
push edi
call esi
test eax, eax
jne 0x10283e7
lea eax, [ebp - 0x240]
push eax
push 1
push ebx
push 0x100af48
push dword [ebp - 0x224]
call esi
test eax, eax
jne 0x10283d6
push 0x100b728
push dword [ebp - 0x240]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
call fcn.0100b113
cmp eax, ebx
mov dword [ebp - 0x21c], eax
jge 0x10283ca
cmp eax, 0x80070002
jne 0x10283ca
mov dword [ebp - 0x21c], ebx
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1028486
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
call fcn.01027f8f
cmp eax, ebx
mov dword [ebp - 0x21c], eax
jl 0x10284e0
push 0x10032fc
lea ecx, [ebp - 0x220]
call fcn.0101cbaf
push 0x100af48
lea ecx, [ebp - 0x220]
call fcn.0101cbaf
lea eax, [ebp - 0x224]
push eax
push 1
push ebx
push dword [ebp - 0x220]
push edi
call esi
test eax, eax
jne 0x1028478
push 0x100b728
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
call fcn.0100b113
cmp eax, ebx
mov dword [ebp - 0x21c], eax
jge 0x102846c
cmp eax, 0x80070002
jne 0x102846c
mov dword [ebp - 0x21c], ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
cmp dword [ebp - 0x21c], ebx
jl 0x10284e0
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.01002480
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.01002480
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x234]
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x22c], eax
jne 0x10284fc
jmp 0x1028308
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.01002480
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.01002480
cmp dword [ebp - 0x22c], ebx
je 0x1028529
cmp dword [ebp - 0x22c], 0x103
jne 0x1028518
mov dword [ebp - 0x21c], ebx
jmp 0x1028529
push dword [ebp - 0x22c]
call fcn.0100b113
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.01002480
mov eax, dword [ebp - 0x21c]
call fcn.01001652
ret