Function at 0x100089c0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x58
mov dword [ebp - 0x30], eax
mov eax, dword [eax]
mov dword [ebp - 0x20], edx
mov edx, ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call sym._get_word
mov edi, eax
test eax, eax
js 0x10008df0
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x100
xor esi, esi
mov dword [ebp - 0x34], eax
call eax
mov dword [ebp - 0x28], pe_nt_image_headers32
mov dword [ebp - 0x1c], eax
mov eax, edi
mov edi, esi
jmp 0x10008b40
mov dword [esp + 4], str.ForceRemove
mov eax, dword [ebx]
mov esi, 1
mov edi, 3
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x10008e00
mov edx, ebx
lea eax, [ebp - 0x18]
call sym._get_word
test eax, eax
js 0x10008b8b
test byte [0x1000c038], 8
jne 0x10008c20
mov eax, dword [ebp + 8]
test eax, eax
je 0x10008bd0
mov esi, dword [ebx]
cmp edi, 2
je 0x10008f50
cmp edi, 4
je 0x10008c60
cmp edi, 3
je 0x10009060
lea eax, [ebp - 0x14]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
test eax, eax
jne 0x1000941c
movzx eax, word [ecx]
cmp ax, 0x3d
je 0x10008cd8
cmp ax, 0x7b
je 0x10008f00
test byte [0x1000c038], 8
jne 0x10008ca0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10008bb0
mov eax, 9
bt eax, edi
jae 0x10008bb0
test byte [0x1000c038], 8
jne 0x10008ff8
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x14]
sub esp, 8
test eax, eax
je 0x10008b27
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov edx, ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call sym._get_word
test eax, eax
js 0x10009190
mov edx, dword [ebx]
cmp word [edx + 2], 0
jne 0x10008b53
cmp word [edx], 0x7d
je 0x10009333
mov dword [esp + 4], str.NoRemove
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x10008a20
mov edx, ebx
lea eax, [ebp - 0x18]
mov esi, 1
mov edi, 1
call sym._get_word
test eax, eax
jns 0x10008a5a
mov ecx, esi
mov edi, eax
mov byte [ebp - 0x20], cl
jmp 0x10008dc0
test byte [0x1000c038], 8
jne 0x10008c92
lea esi, [esi]
cmp edi, 2
setne dl
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10008b27
test dl, dl
je 0x10008b27
jmp 0x10008b1b
lea eax, [edi - 2]
and eax, 0xfffffffd
mov dword [ebp - 0x24], eax
jne 0x10008e60
cmp edi, 4
je 0x10008ba0
mov ecx, dword [ebp - 0x18]
cmp word [ecx], 0x3d
je 0x10009080
mov esi, ecx
test byte [0x1000c038], 4
jne 0x10009356
mov eax, dword [ebp - 0x1c]
mov edi, 0x80020009
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x10008deb
mov eax, dword [ebx]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.name___s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10008a67
test byte [0x1000c038], 8
jne 0x10009090
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov edx, 1
sub esp, 8
test byte [0x1000c038], 8
je 0x10008bb6
mov edi, 4
lea esi, cs:[esi]
nop
mov dword [esp + 0x14], edi
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str._x__x_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10008ad8
mov dword [ebp - 0x24], 0
mov esi, 1
add ecx, 2
mov edx, ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
call sym._get_word
test eax, eax
js 0x10008b8b
cmp dword [ebx + 8], 1
jne 0x100094d3
mov eax, dword [ebp + 8]
test eax, eax
je 0x10008fc0
mov ecx, dword [ebx]
movzx eax, word [ecx]
cmp ax, 0x64
je 0x100092d0
cmp ax, 0x73
jne 0x100090f8
mov edx, ebx
lea eax, [ebp - 0x18]
call sym._get_word
test eax, eax
js 0x10008b8b
mov edx, dword [ebx]
cmp word [edx], 0
je 0x1000954b
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x10008d50
sub eax, edx
add eax, 2
xor ecx, ecx
cmp dword [ebp - 0x24], 0
cmovne ecx, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x10008fe1
mov ecx, esi
mov edi, eax
mov byte [ebp - 0x20], cl
test byte [0x1000c038], 4
jne 0x10009495
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovg edi, eax
lea esi, [esi]
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
test eax, eax
je 0x10008deb
cmp byte [ebp - 0x20], 0
je 0x10008deb
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [ebp - 0x18]
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [eax], esi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x1000f82e
mov eax, dword [ebx]
xor esi, esi
mov edi, 2
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
je 0x10008a48
mov dword [esp + 4], str.Delete
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
je 0x10009120
xor edi, edi
test byte [0x1000c038], 8
jne 0x10008c20
mov eax, dword [ebp + 8]
test eax, eax
je 0x10008e60
mov esi, dword [ebx]
jmp 0x10008a8f
mov esi, dword [ebx]
cmp word [esi], 0
je 0x100091a0
mov eax, esi
nop
add eax, 2
cmp word [eax], 0
jne 0x10008e70
sub eax, esi
mov ecx, eax
mov edx, eax
sar ecx, 1
mov dword [ebp - 0x24], ecx
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jae 0x10009038
mov dword [esp + 8], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov word [eax + edx], cx
lea eax, [ebp - 0x14]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x10008ee4
test byte [0x1000c038], 4
jne 0x10009130
movzx eax, word [ecx]
mov esi, 1
cmp ax, 0x3d
je 0x10008ce4
cmp ax, 0x7b
jne 0x10008acb
movzx eax, word [ecx + 2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswspace]
test eax, eax
je 0x10008acb
mov edx, ebx
lea eax, [ebp - 0x18]
call sym._get_word
test eax, eax
js 0x10008f3e
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [esp], eax
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
call sym._do_process_key
test eax, eax
jns 0x10008acb
mov byte [ebp - 0x20], 1
mov edi, eax
jmp 0x10008dc0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
cmp word [esi], 0
je 0x10009343
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x10008f68
sub eax, esi
mov ecx, eax
mov edx, eax
sar ecx, 1
mov dword [ebp - 0x24], ecx
add ecx, 1
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jae 0x100090d0
mov dword [esp + 8], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], esi
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
call sym._memcpy
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov eax, esi
xor esi, esi
mov word [eax + edx], si
cmp word [ecx], 0x3d
jne 0x10008bf1
xor esi, esi
jmp 0x10008ce4
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x2d
jne 0x10008fcf
add eax, 2
mov dword [ebp - 0x18], eax
mov edx, ebx
lea eax, [ebp - 0x18]
call sym._get_word
test eax, eax
js 0x10008b8b
cmp edi, 2
je 0x10008acb
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx]
jmp 0x10008ac1
mov eax, dword [ebp - 0x1c]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Deleting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10008afe
lea eax, [edx + edx]
mov dword [ebp - 0x28], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x10008e92
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov esi, dword [ebx]
sub esp, 8
jmp 0x10008a8f
xor esi, esi
mov edi, 2
jmp 0x10008ce4
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Deleting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
mov esi, dword [ebx]
jmp 0x10008c6d
lea eax, [edx + edx]
mov dword [ebp - 0x28], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x10008f8a
cmp ax, 0x62
je 0x100091b8
mov eax, esi
mov byte [ebp - 0x20], al
test byte [0x1000c038], 4
jne 0x1000945c
mov edi, 0x80020009
jmp 0x10008dc0
mov esi, 1
mov edi, 4
jmp 0x10008a48
mov eax, dword [ebp - 0x1c]
mov edx, 0xffffffff
mov dword [ebp - 0x2c], ecx
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], esi
mov esi, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_not_open_key__s:__08lx_n
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
mov ecx, dword [ebp - 0x2c]
movzx eax, word [ecx]
cmp ax, 0x3d
jne 0x10008ef6
jmp 0x10008ce4
mov ecx, edi
mov edi, eax
cmp ecx, 2
setne byte [ebp - 0x20]
jmp 0x10008dc0
mov dword [ebp - 0x24], 0
mov eax, 1
xor edx, edx
jmp 0x10008e87
mov edx, ebx
lea eax, [ebp - 0x18]
call sym._get_word
test eax, eax
js 0x10008b8b
mov eax, dword [ebx]
cmp word [eax], 0
mov dword [ebp - 0x3c], eax
je 0x10009555
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x100091e0
mov ecx, dword [ebp - 0x3c]
sub eax, ecx
sar eax, 1
add eax, 1
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
mov ecx, dword [ebp - 0x34]
call ecx
mov dword [ebp - 0x38], eax
test eax, eax
je 0x10009568
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x10009389
mov eax, esi
mov dword [ebp - 0x48], edi
xor ecx, ecx
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ebx
mov ebx, dword [ebp - 0x3c]
mov byte [ebp - 0x3d], al
jmp 0x1000928c
lea edx, [eax - 0x61]
cmp dx, 5
jbe 0x100092c0
lea edx, [eax - 0x41]
cmp dx, 5
ja 0x100093ff
sub eax, 0x37
movzx edx, word [ebx + ecx*4 + 2]
lea esi, [edx - 0x30]
cmp si, 9
jbe 0x100092b3
lea esi, [edx - 0x61]
cmp si, 5
jbe 0x100092c8
lea esi, [edx - 0x41]
cmp si, 5
ja 0x100093ff
sub edx, 0x37
shl eax, 4
or eax, edx
mov byte [edi + ecx], al
add ecx, 1
cmp dword [ebp - 0x2c], ecx
je 0x1000937f
movzx eax, word [ebx + ecx*4]
test ax, ax
je 0x1000937f
lea edx, [eax - 0x30]
cmp dx, 9
ja 0x10009238
movzx edx, word [ebx + ecx*4 + 2]
sub eax, 0x30
lea esi, [edx - 0x30]
cmp si, 9
ja 0x1000925f
sub edx, 0x30
jmp 0x10009278
sub eax, 0x57
jmp 0x10009251
sub edx, 0x57
jmp 0x10009278
mov edx, ebx
lea eax, [ebp - 0x18]
call sym._get_word
test eax, eax
js 0x10008b8b
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
xor eax, eax
test edx, edx
cmovne eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp 0x10008d84
mov esi, edi
mov edi, eax
cmp esi, 2
setne byte [ebp - 0x20]
jmp 0x10008dc0
mov dword [ebp - 0x24], 0
xor edx, edx
mov ecx, 1
jmp 0x10008f7f
mov dword [esp + 0xc], str.value_not_set__n
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
jmp 0x10008c00
mov edi, dword [ebp - 0x48]
movzx esi, byte [ebp - 0x3d]
mov ebx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
xor eax, eax
test edx, edx
cmovne eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x100094c2
mov ecx, esi
mov edi, eax
mov byte [ebp - 0x20], cl
test byte [0x1000c038], 4
jne 0x10009577
test edi, edi
jle 0x100093ee
movzx edi, di
or edi, 0x80070000
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x10008dc0
movzx eax, byte [ebp - 0x3d]
mov edi, 0x80004005
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x10008dc0
mov esi, ecx
mov edi, eax
test byte [0x1000c038], 4
jne 0x1000951e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
test edi, edi
jle 0x10009440
movzx edi, di
or edi, 0x80070000
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x10008ddc
jmp 0x10008deb
mov edx, 0xffffffff
mov eax, ecx
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Wrong_resource_type:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
jmp 0x10009114
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_set_value_of_key:__08lx_n
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
jmp 0x10008daf
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x10008fe1
mov eax, esi
mov byte [ebp - 0x20], al
test byte [0x1000c038], 4
je 0x10009114
mov eax, dword [ebx]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Wrong_registry_type:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
jmp 0x10009114
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_not_create_open__key:__08lx_n
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
jmp 0x1000942d
mov eax, 2
jmp 0x10008d5e
mov dword [esp], 0
mov eax, dword [ebp - 0x34]
call eax
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x100095a4
mov eax, esi
mov edi, 0x8007000e
mov byte [ebp - 0x20], al
jmp 0x10008dc0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_not_set_value_of_key:_0x_08lx_n
mov dword [esp + 8], str.do_process_key
mov dword [esp + 4], 0x1000c038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.1_2
jmp 0x100093e1
mov dword [ebp - 0x44], 0
jmp 0x10009389