Function at 0x1000bdf5
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100eb79b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x8844
call fcn.10041750
mov eax, dword [0x1013a420]
xor eax, esp
mov dword [esp + 0x8840], eax
push ebx
push esi
push edi
mov eax, dword [0x1013a420]
xor eax, esp
push eax
lea eax, [esp + 0x8858]
mov dword fs:[0], eax
test ecx, ecx
je 0x1000c011
xor ebx, ebx
cmp word [ecx], bx
je 0x1000c011
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 0xf003f
push ebx
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000c011
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x1000bead
cmp dword [esp + 0x14], ebx
je 0x1000bea5
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000c013
mov esi, ebx
mov dword [esp + 0x1c], 0x3fff
mov edi, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x8860], ebx
test eax, eax
je 0x1000bfe9
xor eax, eax
mov dword [esp + 0x1c], 0x3fff
push eax
push eax
push eax
push eax
mov word [esp + 0x85c], ax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x860]
push eax
push ebx
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1000bfba
push 0x7fe
mov word [esp + 0x50], ax
xor esi, esi
lea eax, [esp + 0x52]
mov dword [esp + 0x30], 1
push esi
push eax
call fcn.1003e9c0
add esp, 0xc
mov dword [esp + 0x30], 0x800
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x34]
push eax
push esi
lea eax, [esp + 0x85c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000bfba
push 0x1012d11c
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000bfba
mov word [esp + 0x34], ax
lea ecx, [esp + 0x34]
lea eax, [esp + 0x84c]
mov dword [esp + 0x48], 7
push eax
mov dword [esp + 0x48], esi
call fcn.10002ed6
lea eax, [esp + 0x34]
mov byte [esp + 0x8860], 1
push eax
lea ecx, [esp + 0x24]
call fcn.1000fd99
push esi
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x8868], 0
call fcn.10002f54
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x1000bed4
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
jmp 0x1000bfe9
cmp dword [esi + 0x14], 8
jb 0x1000bfd9
mov eax, dword [esi]
jmp 0x1000bfdb
mov eax, esi
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esi, 0x18
cmp esi, edi
jne 0x1000bfcf
cmp dword [esp + 0x14], 0
je 0x1000c003
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esp + 0x14], 0
lea ecx, [esp + 0x20]
call fcn.1000fe24
jmp 0x1000bea5
xor eax, eax
mov ecx, dword [esp + 0x8858]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8840]
xor ecx, esp
call fcn.1003890f
mov esp, ebp
pop ebp
ret