Function at 0x5bb28a05
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x5bb70c3c]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x124], edi
call fcn.5bb27db5
test dword [0x5bb7381c], 0x40
je 0x5bb28a60
mov ecx, esi
call fcn.5bb27f36
cmp dword [ebp + 8], edi
jne 0x5bb28a85
test dword [esi + 8], 1
jne 0x5bb28a76
xor esi, esi
inc esi
jmp 0x5bb28dbf
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x128], 0x5ba4f194
jmp 0x5bb28ac3
cmp dword [ebp + 8], 1
jne 0x5bb28aa3
test dword [esi + 8], 2
je 0x5bb28a6e
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x128], 0x5ba4f1a0
jmp 0x5bb28ac3
cmp dword [ebp + 8], 2
jne 0x5bb28e8c
test dword [esi + 8], 0x10
je 0x5bb28a6e
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x128], 0x5ba4f1ac
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push dword [ebp - 0x128]
call fcn.5ba7bd2a
test eax, eax
je 0x5bb28af5
mov esi, 0x80004005
jmp 0x5bb28dbf
push ebx
push 4
pop ebx
push ebx
lea eax, [ebp - 0x130]
push eax
push ebx
push edi
push 0x5ba4cabc
push dword [ebp - 0x10c]
mov dword [ebp - 0x130], 0x50000
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5bb28b2c
mov esi, 0x80004005
jmp 0x5bb28dbe
mov eax, dword [ebp - 0x120]
xor ecx, ecx
jmp 0x5bb28b3a
mov eax, dword [eax + 8]
inc ecx
cmp eax, edi
jne 0x5bb28b36
lea eax, [ecx*4 + 1]
push eax
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x110]
push eax
call fcn.5baaee23
mov esi, eax
cmp esi, edi
jl 0x5bb28dbe
mov eax, dword [ebp - 0x110]
push edi
push edi
mov byte [eax], 0
push edi
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x10c]
call sub.SHLWAPI.dll_SHQueryInfoKeyA
cmp eax, edi
mov dword [ebp - 0x12c], eax
jne 0x5bb28b22
jmp 0x5bb28bd4
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x124]
mov dword [ebp - 0x140], ebx
push dword [ebp - 0x10c]
call sub.SHLWAPI.dll_SHEnumKeyExA
cmp eax, 0x103
mov dword [ebp - 0x12c], eax
je 0x5bb28bdc
cmp eax, edi
jne 0x5bb28bd4
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x10c]
call sub.SHLWAPI.dll_SHDeleteKeyA
dec dword [ebp - 0x124]
jns 0x5bb28b8c
push 0x5ba4f1e0
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, 0x104
push edi
push dword [ebp - 0x128]
lea eax, [ebp - 0x108]
push eax
call ebx
push edi
push 0x5ba4cc98
lea eax, [ebp - 0x108]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp - 0x120]
test esi, esi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x11c], esi
jne 0x5bb28c4e
mov esi, dword [ebp - 0x120]
jmp 0x5bb28e51
mov esi, dword [ebp - 0x11c]
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x5bb28c61
mov dword [ebp - 0x114], 1
jmp 0x5bb28cb6
push eax
push 0x5ba47830
lea eax, [ebp - 0x118]
push 4
push eax
call sub.SHLWAPI.dll_wnsprintfA
mov eax, dword [ebp - 0x13c]
add esp, 0x10
mov ecx, edi
sub ecx, eax
push ecx
lea ecx, [ebp - 0x118]
push ecx
lea eax, [ebp + eax - 0x108]
push eax
call ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x108]
push edx
push eax
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jl 0x5bb28dbc
mov esi, dword [ebp - 0x11c]
mov esi, dword [esi + 8]
test esi, esi
mov dword [ebp - 0x11c], esi
jne 0x5bb28c48
cmp dword [ebp - 0x114], esi
je 0x5bb28c3d
and dword [ebp - 0x114], esi
mov esi, dword [ebp - 0x120]
mov dword [ebp - 0x11c], esi
jmp 0x5bb28ce9
mov esi, dword [ebp - 0x11c]
cmp dword [esi], 0xffffffff
jne 0x5bb28da1
jmp 0x5bb28d4d
push dword [ebp - 0x114]
lea eax, [ebp - 0x118]
push 0x5ba47830
push 4
push eax
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x10
lea eax, [ebp - 0x134]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [ebp - 0x12c], eax
jne 0x5bb28d56
push dword [ebp - 0x134]
call dword [entry0]
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xfffffffd
jb 0x5bb28cf4
cmp dword [ebp - 0x12c], 2
jne 0x5bb28db7
mov eax, dword [ebp - 0x114]
mov dword [esi], eax
mov eax, dword [ebp - 0x13c]
mov ecx, edi
sub ecx, eax
push ecx
lea ecx, [ebp - 0x118]
push ecx
lea eax, [ebp + eax - 0x108]
push eax
call ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x108]
push edx
push eax
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jl 0x5bb28dbc
mov esi, dword [ebp - 0x11c]
mov esi, dword [esi + 8]
test esi, esi
mov dword [ebp - 0x11c], esi
jne 0x5bb28ce3
jmp 0x5bb28c3d
mov esi, 0x80004005
xor edi, edi
pop ebx
cmp dword [ebp - 0x110], edi
je 0x5bb28dde
mov eax, dword [0x5bb73714]
push dword [ebp - 0x110]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x110], edi
cmp dword [ebp - 0x10c], edi
je 0x5bb28df2
push dword [ebp - 0x10c]
call dword [entry0]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.5bb3f314
leave
ret 4
push dword [esi]
lea eax, [ebp - 0x118]
push 0x5ba47830
push 4
push eax
call sub.SHLWAPI.dll_wnsprintfA
mov eax, dword [ebp - 0x110]
add esp, 0x10
cmp byte [eax], 0
je 0x5bb28e36
push dword [ebp - 0x138]
push 0x5ba4cc68
push eax
call sub.SHLWAPI.dll_StrCatBuffA
push dword [ebp - 0x138]
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x110]
call sub.SHLWAPI.dll_StrCatBuffA
mov esi, dword [esi + 8]
test esi, esi
jne 0x5bb28e02
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x110]
push 1
push 0x5ba4f1e0
push dword [ebp - 0x128]
call fcn.5ba5c52a
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80004005
jmp 0x5bb28dbc
mov esi, 0x80070057
jmp 0x5bb28dbf