Function at 0x10002315
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9bc
push ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x10008164
call sub.ole32.dll_StringFromGUID2
push 0
push 0
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call sub.KERNEL32.dll_WideCharToMultiByte
push 0x200
lea eax, [ebp - 0x644]
push eax
call fcn.100035ae
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x200
lea eax, [ebp - 0x644]
push eax
call fcn.100033f2
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
lea eax, [ebp - 0x418]
push eax
push closesocket
call sub.ADVAPI32.dll_RegDeleteKeyA
push 0
push 0
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call sub.KERNEL32.dll_WideCharToMultiByte
push 0x200
lea eax, [ebp - 0x644]
push eax
call fcn.100035ae
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x418]
push eax
push closesocket
call sub.ADVAPI32.dll_RegDeleteKeyA
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x100081be]
push eax
push 0x10008178
lea eax, [ebp - 0x644]
push eax
call fcn.10003126
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x644]
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExA
push eax
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x100024d2
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegDeleteValueA
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x10008206]
push eax
push 0x100081bf
lea eax, [ebp - 0x644]
push eax
call fcn.10003126
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x644]
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExA
push eax
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x10002582
push 0x200
lea eax, [ebp - 0x644]
push eax
call fcn.100034c8
push dword [0x10008164]
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegDeleteValueA
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [0x10008160], 0
je 0x1000279d
push 0x104
lea eax, [ebp - 0x418]
push eax
push dword [0x10008160]
call sub.KERNEL32.dll_GetModuleFileNameA
lea eax, [ebp - 0x418]
push eax
push 0x20
lea eax, [ebp - 0x438]
push eax
call fcn.10001e13
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
mov al, byte [0x1000823d]
push eax
push 0x10008207
lea eax, [ebp - 0x644]
push eax
call fcn.10003126
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x644]
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExA
push eax
push 0x200
lea eax, [ebp - 0x644]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x1000279d
mov dword [ebp - 0x314], 1
and dword [ebp - 0x43c], 0
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.100033b3
lea eax, [ebp - 0x43c]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x10002795
inc dword [ebp - 0x43c]
push dword [ebp - 0x43c]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
or eax, eax
je 0x10002795
mov dword [ebp - 0x440], eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.100033b3
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x440]
lea eax, [ebp - 0x314]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
call sub.ntdll.dll_RtlZeroMemory
pop eax
or eax, eax
jne 0x1000278a
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x440]
call sub.ntdll.dll_strstr
add esp, 8
or eax, eax
je 0x1000278a
mov dword [ebp - 0x444], eax
mov ebx, eax
lea eax, [ebp - 0x438]
push eax
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
cmp byte [ebx], 0x2c
jne 0x10002723
inc ebx
push ebx
push dword [ebp - 0x444]
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 0x440]
call sub.KERNEL32.dll_lstrlenA
mov edx, dword [ebp - 0x440]
cmp byte [eax + edx - 1], 0x2c
jne 0x1000274c
and byte [eax + edx - 1], 0
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.100033b3
pop eax
push eax
push dword [ebp - 0x440]
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueExA
push 0x208
lea eax, [ebp - 0x20c]
push eax
call sub.ntdll.dll_RtlZeroMemory
push dword [ebp - 0x440]
call sub.KERNEL32.dll_GlobalFree
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
pop ebx
leave
ret