Function at 0x1016bacd
Capabilities:
Delete registry key
Query or enumerate registry key
Set registry value

Disassembly:
sub esp, 0x24c
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x248], eax
or dword [esp], 0xffffffff
or dword [esp + 4], 0xffffffff
push ebx
push ebp
xor ebx, ebx
mov ebp, ecx
push edi
mov dword [esp + 0x24], ebp
mov edi, ebx
mov dword [esp + 0x14], ebx
cmp dword [ebp + 0x20], ebx
je 0x1016bb07
xor eax, eax
jmp 0x1016be3f
push esi
mov esi, 0x208
push esi
lea eax, [esp + 0x54]
push eax
push dword [0x1023a224]
mov byte [esp + 0x48], bl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1016bb31
mov eax, 0xc44d
jmp 0x1016be3e
lea ecx, [esp + 0x50]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1016bb38
sub ecx, edx
mov edx, esi
lea eax, [esp + 0x50]
sub edx, ecx
add eax, ecx
jmp 0x1016bb55
cmp byte [eax - 1], 0x5c
je 0x1016bb5d
dec eax
inc edx
lea ecx, [esp + 0x50]
cmp eax, ecx
ja 0x1016bb4d
push 0x1016be58
push edx
push eax
call dword [sym.imp.msvcr100.dll_strcpy_s]
mov eax, dword [ebp + 0x1c]
mov dword [eax + 0x40], ebx
mov eax, dword [ebp + 0x1c]
mov dword [eax + 0x10], ebx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 0xe4]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0x10]
mov esi, eax
test esi, esi
je 0x1016be3e
mov ecx, esi
call fcn.1016b844
test eax, eax
je 0x1016bc7a
cmp dword [ebp + 0x20], ebx
jne 0x1016bc5b
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push str.VBKeySave5
push SysReAllocString
call fcn.1015692e
test eax, eax
je 0x1016bbc9
mov dword [esp + 0x10], edi
push eax
call fcn.100bb859
mov edi, eax
test edi, edi
jne 0x1016bc8b
mov edi, 0x10e
push edi
call fcn.1000e3fc
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push edi
call fcn.1000e3fc
push eax
xor edi, edi
inc edi
push edi
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push dword [ebp + 0x1c]
call dword [sym.imp.ole32.dll_CoGetCurrentProcess]
push eax
lea eax, [esp + 0x44]
push 0x1014cc00
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x14]
call fcn.10169fc9
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x18]
mov dword [ebp + 0x20], edi
mov edi, dword [esp + 0x20]
call fcn.1015692e
test eax, eax
je 0x1016bc4f
mov dword [esp + 0x14], edi
push eax
call fcn.100bb859
mov edi, eax
test edi, edi
jne 0x1016bc8b
push ebx
mov ecx, esi
call fcn.1016ad59
mov edi, eax
test edi, edi
jne 0x1016bc8b
push dword [esp + 0x14]
mov ecx, esi
call fcn.1016b088
mov edi, eax
test edi, edi
jne 0x1016bc8b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jne 0x1016bb91
cmp dword [ebp + 0x20], ebx
je 0x1016bcfd
test edi, edi
je 0x1016bd04
cmp dword [esp + 0x14], 0xffffffff
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1016bca7
push dword [esp + 0x14]
call ebx
cmp byte [esp + 0x3c], 0
je 0x1016bcbc
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x14]
call fcn.10169fc9
cmp dword [esp + 0x10], 0xffffffff
je 0x1016bcf9
push 0x208
lea eax, [esp + 0x54]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push dword [esp + 0x10]
mov esi, eax
call ebx
cmp esi, 0x103
jne 0x1016bcf9
push str.VBKeySave5
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp + 0x20], 0
mov eax, edi
jmp 0x1016be3e
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.1016bf24
mov edi, dword [esp + 0x18]
mov ebx, eax
test ebx, ebx
jne 0x1016bd61
mov ecx, dword [edi]
lea eax, [esp + 0x1c]
push eax
push edi
call dword [ecx + 0x1c]
test eax, eax
js 0x1016bd54
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + 0x18]
mov esi, ecx
lea edi, [esp + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], eax
movzx eax, word [ecx + 0x1a]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x18]
push ecx
mov dword [esp + 0x24], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x30]
jmp 0x1016bd71
push 0xc44d
push eax
call fcn.100d79f3
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 0xe4]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
test ebx, ebx
jne 0x1016bdc6
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
test esi, esi
je 0x1016bdbe
mov ecx, esi
call fcn.1016b844
test eax, eax
je 0x1016bdb1
push ebp
push edi
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
call fcn.1016ae64
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov esi, eax
test ebx, ebx
je 0x1016bd8d
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x18]
push dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [esp + 0x10]
call esi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 0xe4]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
test ebx, ebx
jne 0x1016be2b
test esi, esi
je 0x1016be1f
mov ecx, esi
call fcn.1016b85f
test eax, eax
je 0x1016be12
mov ecx, esi
call fcn.1015692e
test eax, eax
js 0x1016be0a
xor ebx, ebx
jmp 0x1016be12
push eax
call fcn.100d7c0e
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov esi, eax
test ebx, ebx
je 0x1016bdec
test ebx, ebx
jne 0x1016be2b
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
jmp 0x1016be32
mov ecx, ebp
call fcn.1015692e
test edi, edi
je 0x1016be3c
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, ebx
pop esi
mov ecx, dword [esp + 0x254]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x24c
ret