Function at 0x735828
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a9890
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x248], 0
mov dword [ebp - 4], 0
mov eax, ecx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x244]
push edx
mov esi, dword [eax]
push 0x2001f
xor ecx, ecx
mov dword [ebp - 0x244], ecx
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
je 0x735898
mov esi, dword [ebp - 0x248]
jmp 0x7358c3
mov edx, dword [ebp - 0x248]
xor ebx, ebx
test edx, edx
je 0x7358b7
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [ebp - 0x248], 0
mov esi, dword [ebp - 0x244]
mov dword [ebp - 0x248], esi
test ebx, ebx
je 0x7358fb
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x7358e3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x240], 0x100
lea ecx, [ebp - 0x234]
xor ebx, ebx
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x735b4c
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x130]
push eax
xor edx, edx
mov dword [ebp - 0x130], edx
push 0x2001f
push edx
push ecx
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
je 0x735976
mov esi, dword [ebp - 0x134]
jmp 0x7359a1
mov edx, dword [ebp - 0x134]
xor ebx, ebx
test edx, edx
je 0x735995
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [ebp - 0x134], 0
mov esi, dword [ebp - 0x130]
mov dword [ebp - 0x134], esi
test ebx, ebx
je 0x7359ca
mov dword [ebp - 4], 0
test esi, esi
je 0x735a72
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
jmp 0x735a72
mov dword [ebp - 0x12c], 0x100
lea ecx, [ebp - 0x120]
xor ebx, ebx
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x735af1
lea ecx, [ebp - 0x134]
lea eax, [ebp - 0x120]
push eax
call fcn.00735828
mov ebx, eax
test ebx, ebx
jne 0x735a50
mov dword [ebp - 0x12c], 0x100
lea ecx, [ebp - 0x120]
xor ebx, ebx
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x7359fe
jmp 0x735af1
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x134]
test edx, edx
je 0x735a72
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
test ebx, ebx
jne 0x735ab4
mov dword [ebp - 0x240], 0x100
lea ecx, [ebp - 0x234]
xor ebx, ebx
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x73592f
jmp 0x735b4c
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x248]
test edx, edx
je 0x735ad6
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x735b0c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x134]
test edx, edx
je 0x735a72
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
jmp 0x735a72
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x735b67
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x248]
test edx, edx
je 0x735b9a
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4