Function at 0x1024fee
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x1001808
push 0x80000002
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x102503a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x102523e
cmp dword [ebp - 0xc], ebx
jne 0x1025053
mov edi, 0x80004005
jmp 0x102524f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10098ec
push dword [ebp - 0xc]
mov dword [ebp - 8], 4
call esi
cmp eax, 2
je 0x10250ae
cmp eax, ebx
mov byte [ebp - 1], 1
jle 0x102508f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x102523d
mov eax, dword [ebp - 0x10]
sub eax, 4
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x102523d
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10098dc
push dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
jle 0x10250d6
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x102523d
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x102523d
mov eax, 0x104
cmp dword [ebp - 8], eax
jbe 0x1025100
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.01023c1d
mov edi, eax
cmp edi, ebx
jl 0x102523d
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push ebx
push ebx
push 0x10098dc
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jle 0x102513d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x102523d
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10098c0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
jle 0x102516f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x102523d
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x102523d
mov eax, 0x104
cmp dword [ebp - 8], eax
jbe 0x1025199
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.01023c1d
mov edi, eax
cmp edi, ebx
jl 0x102523d
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push ebx
push ebx
push 0x10098c0
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jle 0x10251d6
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x102523d
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.0100d194
push dword [ebp - 0x18]
lea ecx, [esi + 0x24]
call sub.MFC42u.DLL_CString::operator_1
push dword [ebp - 0x14]
lea ecx, [esi + 0x20]
call sub.MFC42u.DLL_CString::operator_1
cmp byte [ebp - 1], bl
je 0x1025214
mov eax, dword [ebp - 0x1c]
mov ecx, esi
mov byte [esi + 0x38], 1
mov dword [esi + 0x34], eax
call fcn.01024c3f
jmp 0x1025217
mov byte [esi + 0x38], bl
movzx eax, byte [esi + 0x38]
mov ecx, esi
mov dword [ebp - 0x20], eax
call fcn.0100d1aa
cmp byte [ebp - 1], bl
je 0x102523d
cmp dword [ebp - 0x20], ebx
jne 0x102523d
push 0x10098ec
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop esi
cmp dword [ebp - 0xc], ebx
je 0x102524f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.01023d2d
lea eax, [ebp - 0x18]
push eax
call fcn.01023d2d
mov eax, edi
pop edi
pop ebx
leave
ret