Function at 0x10156ca
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x101c986
call fcn.01017df8
sub esp, 0x224
mov eax, dword [0x101f128]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
push 0x104
lea eax, [ebp - 0x21c]
xor ebx, ebx
push eax
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x230], 4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10014f4
lea eax, [ebp - 0x21c]
push eax
call esi
push 0x1002b84
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push 0x1002b7c
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
mov edi, eax
push 0x1003ec8
push edi
call fcn.0101116e
mov eax, dword [ebp + 8]
add esp, 0x10
sub eax, ebx
je 0x101589c
dec eax
je 0x1015885
dec eax
je 0x1015784
push dword [ebp + 8]
push 0x1003e8c
push edi
call fcn.0101116e
mov ebx, 0x8000ffff
jmp 0x1015ad0
push 0x1003e50
push edi
call fcn.0101116e
pop ecx
pop ecx
push 0x1001a30
mov esi, 0x80000002
push esi
call fcn.01016d71
push eax
push 0x1003e10
push edi
call fcn.0101116e
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0xf003f
push ebx
push 0x1003dc8
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x101580b
push 4
lea eax, [ebp - 0x228]
push eax
push 4
push ebx
push 0x1003d98
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10157fd
push eax
push 0x1003d50
push edi
call fcn.0101116e
add esp, 0xc
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101581a
push eax
push 0x1003cf8
push edi
call fcn.0101116e
add esp, 0xc
mov esi, 0x101f2fc
push 1
mov ecx, esi
call fcn.0100e39d
push eax
push 0x1003ca8
push edi
call fcn.0101116e
add esp, 0xc
mov ecx, esi
call fcn.0100e5c1
push eax
push 0x1003c60
push edi
call fcn.0101116e
add esp, 0xc
push edi
mov ecx, 0x101f398
call fcn.010155c5
mov ebx, eax
push ebx
push 0x1003c18
push edi
call fcn.0101116e
add esp, 0xc
call fcn.01019842
test eax, eax
jne 0x1015ad3
call fcn.010185ae
call fcn.010190b7
jmp 0x1015ad3
push 0x1003be0
push edi
call fcn.0101116e
pop ecx
pop ecx
mov ebx, 0x80070057
jmp 0x1015ad3
push 0x1003ba8
push edi
call fcn.0101116e
pop ecx
pop ecx
lea eax, [ebp - 0x220]
push eax
push 0xf003f
push 0
push 0x1003dc8
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10159e5
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push 0x1003d98
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10159ad
cmp dword [ebp - 0x22c], 4
jne 0x10159ad
push 0x1003b30
push edi
call fcn.0101116e
pop ecx
pop ecx
push 0x1001a30
push esi
call fcn.01016d71
push eax
push 0x1003e10
push edi
call fcn.0101116e
add esp, 0xc
call fcn.0101b872
mov esi, eax
test esi, esi
jne 0x101597d
call fcn.0101b607
mov esi, eax
test esi, esi
je 0x1015976
push esi
push 0x1003ac8
push edi
call fcn.0101116e
push 0x1003a8c
push edi
call fcn.0101116e
add esp, 0x14
test esi, esi
jle 0x1015974
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
call fcn.0101b843
jmp 0x10159bc
push esi
push 0x1003a28
push edi
call fcn.0101116e
push 0x1003a8c
push edi
call fcn.0101116e
add esp, 0x14
test esi, esi
jg 0x101599f
mov ebx, esi
jmp 0x10159bc
and esi, 0xffff
or esi, 0x80070000
jmp 0x101599b
push eax
push 0x10039b0
push edi
call fcn.0101116e
add esp, 0xc
test ebx, ebx
jl 0x10159d1
push 0x1003d98
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jl 0x1015ad3
mov esi, 0x101f2fc
push 0
mov ecx, esi
call fcn.0100e67d
xor ebx, ebx
cmp eax, ebx
jl 0x1015a99
mov dword [ebp - 0x224], ebx
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0100bdb5
cmp eax, ebx
jge 0x1015a29
push eax
push 0x1003940
push edi
call fcn.0101116e
add esp, 0xc
jmp 0x1015a48
push dword [ebp - 0x224]
push 0x10038f8
push edi
call fcn.0101116e
add esp, 0xc
push dword [ebp - 0x224]
call fcn.010111db
push ebx
mov ecx, esi
call fcn.0100e1cc
push edi
call fcn.01011bda
push 0x10038c0
push edi
call fcn.0101116e
pop ecx
pop ecx
push 1
push 1
push edi
mov ecx, 0x101f398
call fcn.010153d4
mov ebx, eax
test ebx, ebx
jge 0x1015a87
push ebx
push 0x1003860
push edi
call fcn.0101116e
add esp, 0xc
push dword [ebp - 0x224]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1015ab4
push eax
push 0x10037f8
push edi
call fcn.0101116e
add esp, 0xc
mov ecx, esi
call fcn.0100e5c1
mov ebx, 0x80004005
test ebx, ebx
jl 0x1015ad3
push edi
call fcn.01011997
mov ebx, eax
test ebx, ebx
jge 0x1015ad3
push ebx
push 0x10037a0
push edi
call fcn.0101116e
add esp, 0xc
push ebx
push 0x1003748
push edi
call fcn.0101116e
add esp, 0xc
test edi, edi
je 0x1015af6
push edi
call dword [sym.imp.msvcrt.dll_fflush]
push edi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, ebx
pop ebx
call fcn.0101793c
leave
ret 4