Function at 0x12430c4
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x12430cc
push ebx
push esi
push edi
mov eax, 0x1235444
call fcn.00f10fdc
xor eax, eax
push ebp
push 0x12434df
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x124319d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 0x13
call fcn.012341c4
mov eax, dword [ebp - 0x14]
call fcn.00f0aa04
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.01233b80
mov eax, dword [ebp - 0x1c]
call fcn.00f0aa04
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00f0a6e0
mov eax, dword [ebp - 0x18]
call fcn.01234b4c
pop edx
call fcn.01234dcc
mov dword [0x16812f0], eax
lea edx, [ebp - 0x20]
mov eax, 0x15
call fcn.012342a0
mov eax, dword [ebp - 0x20]
call fcn.00f0aa04
push eax
lea edx, [ebp - 0x28]
mov eax, 0x1e
call fcn.01233b80
mov eax, dword [ebp - 0x28]
call fcn.00f0aa04
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.00f0a6e0
mov eax, dword [ebp - 0x24]
call fcn.01234b4c
pop edx
call fcn.01234dcc
mov dword [0x16812f4], eax
xor eax, eax
call fcn.01235048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x12431cb
push 0x1688804
call dword [0x16812f4]
mov eax, 0x8980e
call fcn.00f072bc
cmp eax, 0xfff97aba
jle 0x12431f1
push 0x1688804
call sub.user32.dll_DispatchMessageW
push 1
push 0
push 0
push 0
push 0x1688804
call sub.user32.dll_PeekMessageW
mov eax, dword [0x16814e4]
cmp byte [eax], 0
jne 0x12431cb
mov eax, 0x7fffffff
call fcn.00f072bc
cmp eax, 0xfffffff6
jge 0x12434a4
lea eax, [0xf15424]
lea eax, [0xf1542c]
call sub.advapi32.dll_ImpersonateNamedPipeClient
lea eax, [0xf1543c]
lea eax, [0xf15444]
lea eax, [0xf1544c]
lea eax, [0xf1545c]
lea eax, [0xf15468]
lea eax, [0xf15470]
lea eax, [0xf15478]
lea eax, [0xf15480]
lea eax, [0xf15490]
lea eax, [0xf15498]
lea eax, [0xf154a0]
lea eax, [0xf154a8]
lea eax, [0xf154b0]
lea eax, [0xf154b8]
lea edx, [0xf15220]
lea edx, [0xf15228]
lea edx, [0xf15230]
lea edx, [0xf15238]
lea edx, [0xf15240]
lea eax, [0xf15248]
lea eax, [0xf15250]
lea ebx, [0xf15258]
lea eax, [0xf15260]
lea eax, [0xf15268]
lea eax, [0xf15270]
lea eax, [0xf15278]
lea eax, [0xf15280]
lea eax, [0xf15288]
lea eax, [0xf15290]
lea eax, [0xf15298]
lea eax, [0xf152a0]
lea eax, [0xf152a8]
lea eax, [0xf152b0]
lea eax, [0xf152b8]
call sub.advapi32.dll_AddAuditAccessAceEx
lea eax, [0xf152c8]
lea eax, [0xf152d0]
lea eax, [0xf152e0]
lea eax, [0xf15314]
lea eax, [0xf1531c]
lea eax, [0xf15324]
lea eax, [0xf1532c]
lea eax, [0xf15334]
lea eax, [0xf1533c]
lea eax, [0xf15344]
lea eax, [0xf1534c]
lea eax, [0xf15354]
lea eax, [0xf1535c]
lea eax, [0xf15364]
lea eax, [0xf1536c]
lea eax, [0xf15374]
lea eax, [0xf1537c]
lea eax, [0xf15384]
lea eax, [0xf1538c]
lea eax, [0xf15394]
lea eax, [0xf1539c]
lea eax, [0xf153a4]
lea eax, [0xf153ac]
lea eax, [0xf153b4]
lea eax, [0xf153bc]
lea eax, [0xf153c4]
lea eax, [0xf153d4]
lea eax, [0xf153ec]
lea eax, [0xf153f4]
lea eax, [0xf153fc]
lea eax, [0xf15404]
lea eax, [0xf1540c]
lea eax, [0xf15414]
lea eax, [0xf1541c]
call sub.advapi32.dll_RegCreateKeyExA
call sub.advapi32.dll_RegCreateKeyExW
call sub.advapi32.dll_RegDeleteKeyW
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [0xf15520]
call sub.advapi32.dll_RegDeleteValueW
call sub.advapi32.dll_RegDeleteValueA
call sub.advapi32.dll_RegDeleteValueW
call sub.advapi32.dll_RegEnumKeyExW
call sub.advapi32.dll_RegEnumKeyExA
call sub.advapi32.dll_RegEnumKeyExW
lea eax, [0xf15558]
lea eax, [0xf15560]
call sub.advapi32.dll_RegEnumValueW
call sub.advapi32.dll_RegEnumValueA
call sub.advapi32.dll_RegEnumValueW
call sub.advapi32.dll_RegFlushKey
lea eax, [0xf15588]
call sub.advapi32.dll_RegLoadKeyW
lea eax, [0xf15598]
lea eax, [0xf155a0]
lea eax, [0xf155a8]
lea eax, [0xf155b0]
call sub.advapi32.dll_RegOpenKeyExW
lea eax, [0xf155c0]
call sub.advapi32.dll_RegQueryInfoKeyW
lea eax, [0xf155d0]
lea eax, [0xf155d8]
lea eax, [0xf155e0]
lea eax, [0xf155e8]
lea eax, [0xf155f0]
lea eax, [0xf155f8]
call sub.advapi32.dll_RegQueryValueExW
lea eax, [0xf15608]
lea eax, [0xf15610]
call sub.advapi32.dll_RegReplaceKeyW
lea eax, [0xf15620]
lea eax, [0xf15628]
call sub.advapi32.dll_RegRestoreKeyW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12434e6
lea eax, [ebp - 0x28]
call fcn.00f09d68
lea eax, [ebp - 0x24]
call fcn.00f09db0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00f09dc8
lea eax, [ebp - 0x18]
call fcn.00f09db0
lea eax, [ebp - 0x14]
call fcn.00f09d68
ret