Function at 0x91e150
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x115c
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x1158], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
push 0x20019
push ebx
push esi
push 0x80000002
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x91e5d3
push 0x3ff
lea ecx, [esp + 0x955]
push ebx
push ecx
mov byte [esp + 0x95c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea edx, [esp + 0x135]
push ebx
push edx
mov byte [esp + 0x13c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea eax, [esp + 0x545]
push ebx
push eax
mov byte [esp + 0x54c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x2d]
push ebx
push ecx
mov byte [esp + 0x34], bl
call fcn.00a7ffb0
mov eax, dword [esp + 0x28]
add esp, 0xc
push 0x400
lea edx, [esp + 0x954]
push edx
push ebx
push eax
mov dword [esp + 0x28], 0x410
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x91e5db
jmp 0x91e254
mov esi, dword [esp + 0x24]
cmp byte [esp + 0x950], 0
je 0x91e5db
lea ecx, [esp + 0x950]
push ecx
push esi
lea edx, [esp + 0x138]
push 0xaac2e4
push edx
call fcn.00a78f30
add esp, 0x10
push str.BackupLocation
lea eax, [esp + 0x1c]
lea edi, [esp + 0x544]
lea ecx, [esp + 0x134]
mov edx, 0x80000002
call fcn.0094c020
cmp al, 1
jne 0x91e441
cmp byte [esp + 0x540], 0
je 0x91e441
push 0xae1a94
lea eax, [esp + 0x1c]
lea edi, [esp + 0x2c]
lea ecx, [esp + 0x134]
mov edx, 0x80000002
mov dword [esp + 0x1c], 0x104
call fcn.0094c020
push ebx
mov eax, edi
push eax
lea ecx, [esp + 0x548]
push ecx
call fcn.0095c8c0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x130]
inc eax
test cl, cl
jne 0x91e2f3
push ebx
lea edx, [esp + 0x134]
push str.FBackup_
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x91e441
lea ecx, [esp + eax + 0x130]
cmp ecx, ebx
je 0x91e441
mov eax, str.FBackUp_
inc eax
cmp byte [eax], 0
jne 0x91e332
sub eax, str.FBackUp_
add ecx, eax
cmp byte [ecx], 0
je 0x91e429
push ebx
push ebx
push ecx
lea eax, [esp + 0x54c]
call fcn.009655c0
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x91e429
mov eax, dword [0xbd6594]
cmp eax, ebx
jne 0x91e397
mov dword [0xbd6594], edi
mov eax, 1
add dword [0xbf9f18], eax
add dword [esp + 0x14], eax
add dword [esp + 0x10], eax
mov dword [edi + 0x20], edi
mov ecx, dword [0xbd6594]
mov dword [ecx + 0x30], eax
jmp 0x91e52e
mov ebx, dword [eax + 0x20]
test ebx, ebx
je 0x91e3ae
mov edx, dword [ebx]
mov eax, dword [edi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov eax, ebx
jmp 0x91e3dc
mov ebx, eax
test ebx, ebx
je 0x91e3e5
mov ecx, dword [edi]
test ecx, ecx
je 0x91e3d3
mov eax, dword [ebx]
test eax, eax
je 0x91e3d3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x91e3d3
mov dword [edi + 0x2c], 1
mov eax, ebx
mov ebx, dword [ebx + 0x18]
test ebx, ebx
jne 0x91e3b4
test eax, eax
jne 0x91e3fd
mov eax, dword [0xbd6594]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x24], edi
mov dword [0xbd6594], edi
mov ecx, dword [eax + 0x30]
inc ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x18], eax
jmp 0x91e41e
mov dword [edi + 0x1c], eax
mov dword [edi + 0x24], eax
mov ecx, dword [eax + 0x18]
mov dword [eax + 0x18], edi
mov dword [edi + 0x18], ecx
test ecx, ecx
je 0x91e416
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x24], edi
mov eax, dword [0xbd6594]
inc dword [eax + 0x30]
mov edx, dword [0xbd6594]
mov dword [edx + 0x20], edi
xor ebx, ebx
mov eax, 1
add dword [0xbf9f18], eax
add dword [esp + 0x14], eax
add dword [esp + 0x10], eax
jmp 0x91e52e
lea eax, [esp + 0x130]
push eax
call fcn.0091e150
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x91e51e
cmp byte [esp + 0x130], 0
je 0x91e520
lea ecx, [esp + 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x130]
dec edx
cmp byte [eax + edx], 0x5c
je 0x91e520
cmp dword [0xb32da4], 0xffffffff
jne 0x91e4ac
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xb32da4
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.009691d0
add esp, 0x20
cmp dword [0xb32da4], ebx
jne 0x91e4d8
lea eax, [esp + 0x130]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
cmp edi, 2
jne 0x91e509
lea ecx, [esp + 0x130]
push ecx
jmp 0x91e4fd
push ebx
lea edx, [esp + 0x134]
push edx
push 0x80000002
call fcn.0095f730
mov edi, eax
add esp, 0xc
cmp edi, 2
jne 0x91e509
lea eax, [esp + 0x130]
push eax
call fcn.00989f40
cmp eax, 1
jne 0x91e509
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x91e520
mov dword [esp + 0x20], 1
jmp 0x91e520
jl 0x91e52a
add dword [esp + 0x10], esi
cmp dword [esp + 0x20], ebx
jne 0x91e52e
inc dword [esp + 0x14]
push 0x3ff
lea ecx, [esp + 0x955]
push ebx
push ecx
mov byte [esp + 0x95c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea edx, [esp + 0x135]
push ebx
push edx
mov byte [esp + 0x13c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea eax, [esp + 0x545]
push ebx
push eax
mov byte [esp + 0x54c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x2d]
push ebx
push ecx
mov byte [esp + 0x34], 0
call fcn.00a7ffb0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
add esp, 0xc
push 0x400
lea edx, [esp + 0x954]
push edx
push eax
push ecx
mov dword [esp + 0x28], 0x410
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x91e250
jmp 0x91e5db
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x91e5ea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1164]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret