Function at 0x5426c7
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sbb bh, bh
adc eax, sym.imp.ADVAPI32.dll_EqualSid
mov ecx, dword [esp + 0x10]
push 0
or ecx, eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edi, dword [esp + 0x10]
or eax, ebp
or eax, ebx
push 0
or edi, eax
mov eax, dword [0x60c644]
push 0
push eax
push 0
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, eax
mov eax, dword [esp + 0x10]
or ecx, ebx
or ecx, edi
push 0
or ecx, esi
push 0
or eax, ecx
push 0
push 0
push eax
push 0
push 0
push 0
push 0
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov esi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov edx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
or eax, edi
push 0
push 0
or eax, esi
push 0
push 0
or eax, edx
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x40], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x60c644]
or ecx, eax
push edx
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [esp + 0x10]
push 0
or ebx, eax
push 0
push 0
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or eax, ecx
mov edx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
or eax, ebp
mov ecx, dword [esp + 0x10]
or eax, ebx
or eax, edi
push 0
or eax, esi
push 0
or eax, edx
push 0
or ecx, eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSid]
mov esi, dword [esp + 0x10]
push 0
or esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
mov ecx, dword [esp + 0x10]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
mov edi, dword [esp + 0x10]
push 0xd
push 0x38
push 0
or edi, eax
push 0x14
push 0xa
mov dword [esp + 0x24], edi
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov edi, dword [esp + 0x10]
or eax, ebx
push 0
or edi, eax
mov dword [esp + 0x14], edi
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x2c], edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
or dword [esp + 0x10], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov ecx, dword [esp + 0x10]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
mov edi, dword [esp + 0x10]
push 0
or edi, eax
mov dword [esp + 0x14], edi
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov ecx, dword [esp + 0x10]
pop edi
or ecx, eax
pop esi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret