Function at 0x10291a6
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 0x518]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1003558
mov edi, 0x80000001
push edi
mov dword [ebp - 0x518], esi
mov dword [ebp - 0x51c], esi
call ebx
test eax, eax
jne 0x102921e
push 0x1003534
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x100350c
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x518]
push eax
push 0x20019
push esi
push 0x1001e58
push edi
mov dword [ebp - 0x518], esi
call ebx
test eax, eax
jne 0x102925a
push 0x10034f0
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x518]
push eax
push 0x2001f
push esi
push 0x10034a0
push edi
call ebx
test eax, eax
jne 0x10292cb
mov dword [ebp - 0x51c], 0x80
jmp 0x102929c
lea eax, [ebp - 0x30c]
push eax
push dword [ebp - 0x518]
mov dword [ebp - 0x51c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x30c]
push eax
push esi
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x102927f
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x518]
push eax
push 2
push esi
push 0x10026c8
push edi
call ebx
test eax, eax
jne 0x102930c
xor ebx, ebx
push dword [ebx + 0x1001c60]
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add ebx, 4
cmp ebx, 0xa0
jb 0x10292e3
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x518]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10026c8
push edi
mov dword [ebp - 0x518], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1029393
push 4
pop eax
push eax
lea ecx, [ebp - 0x520]
push ecx
push eax
push esi
push 0x100346c
push dword [ebp - 0x518]
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x51c], eax
call ebx
push dword [ebp - 0x51c]
lea eax, [ebp - 0x520]
push eax
push 4
push esi
push 0x1003440
push dword [ebp - 0x518]
mov dword [ebp - 0x520], 1
push esi
call fcn.0102f9d6
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10033d8
push edi
mov dword [ebp - 0x518], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
lea eax, [ebp - 0x518]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1003368
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102948b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x26fd
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102941b
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10293f1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003358
push dword [ebp - 0x518]
call ebx
push 0x104
push 1
lea eax, [ebp - 0x514]
push eax
call fcn.010302a3
test eax, eax
je 0x102947f
push 0x1001b64
push 0x104
lea eax, [ebp - 0x514]
push eax
call fcn.01027edd
test eax, eax
jl 0x102947f
lea eax, [ebp - 0x514]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1029455
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x514]
push eax
push 1
push esi
push 0x1003348
push dword [ebp - 0x518]
call ebx
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x518]
push eax
push 2
push esi
push 0x1003290
push edi
mov dword [ebp - 0x518], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102950b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xa4
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10294ff
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10294d5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1002fb4
push dword [ebp - 0x518]
call ebx
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret