Function at 0x76ef6787
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x76f11248]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x76ef6b60
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x20c], ebx
call fcn.76f00c7b
cmp dword [edi + 0x48], ebx
jne 0x76ef6ac7
cmp dword [edi + 0x50], ebx
je 0x76ef67d4
or dword [ebp - 0x20c], 1
cmp dword [edi + 0x4c], ebx
je 0x76ef67e0
or dword [ebp - 0x20c], 2
cmp dword [edi + 0x58], ebx
je 0x76ef67ec
or dword [ebp - 0x20c], 4
cmp dword [ebp - 0x20c], ebx
je 0x76ef67fe
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
push 0x2001f
push ebx
push 0x76ef6b4c
push ebx
push dword [edi + 0xc]
push dword [0x76f11f48]
call dword [sym.imp._CADVAPI.DLL_RegCreateKeyExA]
test eax, eax
jne 0x76ef6ac7
mov esi, dword [edi + 0x10]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x76ef6838
sub eax, ecx
push 0x100
lea ecx, [ebp - 0x204]
push ecx
mov edx, eax
mov ecx, esi
call fcn.76ef37b1
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp._Cmvrt.DLL_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push ebx
push 0x76ef6b38
push dword [ebp - 0x208]
call dword [sym.imp._CADVAPI.DLL_RegSetValueExW]
test eax, eax
jne 0x76ef6ac7
mov ecx, dword [edi + 0x18]
cmp ecx, ebx
mov esi, dword [sym.imp._CADVAPI.DLL_RegSetValueExA]
je 0x76ef68f9
cmp dword [edi + 0x50], ebx
je 0x76ef68f9
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x210], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x76ef68a9
sub eax, dword [ebp - 0x210]
push 0x100
lea edx, [ebp - 0x204]
push edx
mov edx, eax
call fcn.76ef37b1
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp._Cmvrt.DLL_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push ebx
push 0x76ef6b20
push dword [ebp - 0x208]
call dword [sym.imp._CADVAPI.DLL_RegSetValueExW]
jmp 0x76ef6910
push 1
push 0x76ef909f
push 1
push ebx
push 0x76efe8b0
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x76ef6ac7
mov ecx, dword [edi + 0x14]
cmp ecx, ebx
je 0x76ef697f
cmp dword [edi + 0x4c], ebx
je 0x76ef697f
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x210], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x76ef692f
sub eax, dword [ebp - 0x210]
push 0x100
lea edx, [ebp - 0x204]
push edx
mov edx, eax
call fcn.76ef37b1
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp._Cmvrt.DLL_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push ebx
push 0x76ef6afc
push dword [ebp - 0x208]
call dword [sym.imp._CADVAPI.DLL_RegSetValueExW]
jmp 0x76ef6996
push 1
push 0x76ef909f
push 1
push ebx
push 0x76efe89c
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x76ef6ac7
push 4
lea eax, [edi + 0x30]
push eax
push 4
push ebx
push 0x76efe88c
push dword [ebp - 0x208]
call esi
push 4
lea eax, [edi + 0x34]
push eax
push 4
push ebx
push 0x76efe878
push dword [ebp - 0x208]
call esi
push 4
lea eax, [edi + 0x38]
push eax
push 4
push ebx
push 0x76efe868
push dword [ebp - 0x208]
call esi
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push ebx
push 0x76efe858
push dword [ebp - 0x208]
call esi
mov eax, dword [edi + 0x24]
lea eax, [eax + eax*4]
shl eax, 2
push eax
push dword [edi + 0x28]
push 3
push ebx
push 0x76efe844
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x76ef6ac7
push 4
lea eax, [edi + 0x24]
push eax
push 4
push ebx
push 0x76efe82c
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x76ef6ac7
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push ebx
push 0x76efe7ec
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x76ef6ac7
cmp dword [edi + 0x2c], ebx
je 0x76ef6a8e
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax]
shl ecx, 2
push ecx
add eax, 4
push eax
push 3
push ebx
push 0x76efe818
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x76ef6ac7
push 4
push dword [edi + 0x2c]
push 4
push ebx
push 0x76efe800
jmp 0x76ef6abb
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push ebx
push 0x76efe800
push dword [ebp - 0x208]
mov dword [ebp - 0x210], ebx
call esi
test eax, eax
jne 0x76ef6ac7
push ebx
push ebx
push 3
push ebx
push 0x76efe818
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x76ef6ade
push dword [edi + 0xc]
push dword [0x76f11f48]
call dword [sym.imp._CADVAPI.DLL_RegDeleteKeyA]
cmp dword [ebp - 0x208], ebx
je 0x76ef6aea
push dword [ebp - 0x208]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.76ef2630
leave
ret 4