Function at 0x10095b5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], ebx
je 0x10097cd
cmp dword [ebp + 0xc], ebx
je 0x10097cd
mov edi, dword [ebp + 0x14]
cmp edi, ebx
je 0x10097cd
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x5c]
or eax, 0xf003f
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x10097d0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
je 0x1009643
lea eax, [ebp - 4]
push eax
call fcn.01001324
jmp 0x10097d0
cmp dword [ebp - 0x1c], ebx
jne 0x1009668
lea eax, [ebp - 4]
push eax
call fcn.01001324
push ebx
push dword [edi + 0x5c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
jmp 0x10097d0
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x1009678
mov dword [ebp - 8], 0x100
jmp 0x1009684
cmp eax, 0x100
jae 0x1009684
add eax, eax
mov dword [ebp - 8], eax
call fcn.010015e4
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x10096a0
lea eax, [ebp - 4]
push eax
call fcn.01001324
push 0xe
jmp 0x10097cf
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 4]
push eax
call fcn.010026af
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x10096cb
lea eax, [ebp - 4]
push eax
call fcn.01001324
lea eax, [ebp - 0x14]
push eax
call fcn.01001820
jmp 0x1009699
xor edi, edi
xor esi, esi
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0x1c], ebx
jbe 0x100971e
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
add eax, eax
cmp eax, ebx
je 0x10096ec
mov byte [ecx], bl
inc ecx
dec eax
jne 0x10096e6
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x100976f
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.01002c06
cmp eax, 0xffffffff
jne 0x1009777
push 0xe
pop esi
mov dword [ebp - 0xc], esi
lea eax, [ebp - 0x18]
push eax
call fcn.01002024
push dword [ebp - 0x14]
call fcn.01002dfe
mov dword [ebp - 0x20], eax
cmp esi, 0xe
je 0x10097a8
cmp eax, ebx
je 0x10097a8
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jbe 0x10097a8
mov edi, dword [ebp + 0x10]
inc edi
push esi
push dword [ebp - 0x14]
call fcn.01002f4a
push dword [ebp + 0x14]
push edi
push eax
push dword [ebp - 4]
call fcn.010095b5
cmp eax, ebx
je 0x1009782
cmp dword [ebp - 0xc], ebx
jne 0x1009785
mov dword [ebp - 0xc], eax
jmp 0x1009785
cmp dword [ebp - 0xc], ebx
jne 0x1009777
mov dword [ebp - 0xc], esi
inc edi
cmp edi, dword [ebp - 0x1c]
jae 0x100971e
jmp 0x10096d7
inc dword [ebp - 0x10]
inc esi
cmp esi, dword [ebp - 0x20]
jb 0x100974b
cmp dword [ebp - 0x10], ebx
je 0x10097a8
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
jne 0x10097a1
cmp dword [ebp - 0x10], eax
jne 0x10097a1
xor esi, esi
jmp 0x10097ab
mov esi, 0x80030201
jmp 0x10097ab
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.01001820
lea eax, [ebp - 4]
push eax
call fcn.01001324
cmp esi, ebx
jne 0x10097d0
mov eax, dword [ebp + 0x14]
push ebx
push dword [eax + 0x5c]
jmp 0x1009655
push 0x57
pop esi
cmp dword [ebp + 0x10], ebx
jne 0x1009824
cmp esi, ebx
je 0x100980a
cmp esi, 0x80030201
jne 0x10097f4
push ebx
push 0x8d
call fcn.0100339e
push eax
call fcn.01002f79
jmp 0x10097fa
push esi
call fcn.01003151
push 0x20001
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
jmp 0x100981e
push ebx
call fcn.01003151
push 0x20000
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.010030dc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10