Function at 0xbb1194
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0xb02841
call fcn.00af8df7
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push eax
push 3
xor ebx, ebx
push ebx
push edx
push reloc.SHCORE.dll_Ordinal_1
mov dword [ebp - 0x10], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xbb1304
push ebx
push ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xbb1202
push eax
push 0xa192a4
push 0x2e
pop edx
call fcn.00bb318d
cmp dword [ebp - 0x24], ebx
jbe 0xbb1304
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
inc edx
mov dword [ebp - 0x18], edx
call fcn.00bb084a
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x30]
inc edx
mov dword [ebp - 0x1c], edx
call fcn.00bb084a
mov byte [ebp - 4], 3
mov ecx, ebx
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], ecx
push eax
push ebx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x28], ebx
push eax
push esi
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0xbb12ad
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], esi
test eax, eax
je 0xbb12cb
mov eax, dword [eax]
mov ebx, dword [eax + 8]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call dword [0xc99200]
mov ecx, dword [ebp + 0x2c]
call ebx
test al, al
je 0xbb12c0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x14]
test eax, eax
jne 0xbb12c3
dec ecx
jmp 0xbb12c3
cmp eax, 0x103
je 0xbb12de
cmp eax, 0xea
jne 0xbb12d1
mov ecx, dword [ebp - 0x14]
jmp 0xbb12c5
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
inc ecx
jmp 0xbb1235
call dword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xbad_function_call_void_]
push eax
push ecx
mov ecx, dword [ebp + 4]
push 0x46
pop edx
call fcn.00bb3043
test edi, edi
je 0xbb12f1
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xbb1304
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x10], 0
je 0xbb1316
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, dword [ebp + 0x2c]
test edi, edi
je 0xbb133a
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
lea eax, [ebp + 8]
cmp edi, eax
mov ecx, esi
setne byte [ebp - 0x20]
push dword [ebp - 0x20]
call dword [0xc99200]
mov ecx, edi
call esi
call fcn.00af8dc0
ret 0x28