Function at 0x103a290
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x6c
push 0x1014950
call fcn.0103e7b6
mov eax, dword [0x107342c]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp - 0x74], edi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
cmp dword [ebp + 0xc], ebx
je 0x103a2d0
mov dword [0x107450c], edi
mov eax, edi
jmp 0x103a5b3
mov dword [ebp - 4], ebx
lea eax, [esi + 0x64]
mov dword [ebp - 0x78], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x5c], ebx
mov eax, dword [esi + 0x60]
cmp eax, ebx
je 0x103a2f7
push eax
call fcn.0103a14f
mov dword [esi + 0x60], ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x1011638
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103a4ed
push dword [0x1074a1c]
push 0x1011620
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x103a559
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x103a559
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a559
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [0x1074a1c]
push 0x1011608
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a559
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x68], eax
cmp eax, ebx
je 0x103a559
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a559
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [0x1074a1c]
push 0x10115ec
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a559
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x103a559
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a559
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [0x1074a1c]
push 0x10115d0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a4ea
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x103a559
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103a559
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edi, edi
inc edi
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi + 0x60], eax
cmp eax, ebx
je 0x103a559
push dword [ebp - 0x70]
call fcn.01032b06
mov ecx, dword [esi + 0x60]
mov dword [ecx], eax
push dword [ebp - 0x68]
call fcn.01032b06
mov ecx, dword [esi + 0x60]
mov dword [ecx + 4], eax
push dword [ebp - 0x6c]
call fcn.01032b06
mov ecx, dword [esi + 0x60]
mov dword [ecx + 0xc], eax
cmp dword [ebp - 0x64], ebx
je 0x103a53a
push dword [ebp - 0x64]
call fcn.01032b06
mov ecx, dword [esi + 0x60]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x60]
cmp dword [eax], ebx
je 0x103a550
cmp dword [eax + 4], ebx
je 0x103a550
cmp dword [eax + 0xc], ebx
je 0x103a550
mov dword [esi + 0x5c], edi
jmp 0x103a55c
push eax
call fcn.0103a14f
mov dword [esi + 0x60], ebx
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x70], ebx
je 0x103a575
push dword [ebp - 0x70]
call esi
cmp dword [ebp - 0x68], ebx
je 0x103a57f
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x6c], ebx
je 0x103a589
push dword [ebp - 0x6c]
call esi
cmp dword [ebp - 0x64], ebx
je 0x103a593
push dword [ebp - 0x64]
call esi
cmp dword [ebp - 0x58], ebx
je 0x103a5a1
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x74]
jmp 0x103a5b3
mov ecx, dword [ebp - 0x1c]
call fcn.0103e4d8
call fcn.0103e7f1
ret 8