Function at 0x1027017
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x41c], 0x104
mov dword [ebp - 0x420], 0x208
mov dword [ebp - 0x418], 1
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x424], edi
cmp eax, edi
jne 0x1027076
mov eax, 0x80070057
jmp 0x10273d6
push edi
lea eax, [ebp - 0x424]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x1001d50
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10270a2
mov eax, 0x80004005
jmp 0x10273d6
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov esi, dword [sym.imp.msvcrt.dll__wcsnicmp]
mov dword [ebp - 0x434], edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x41c], 0x104
mov dword [ebp - 0x420], 0x208
push edi
jmp 0x10272f1
inc dword [ebp - 0x438]
cmp dword [ebp - 0x418], 1
jne 0x10272a1
mov eax, dword [ebp - 0x434]
sub eax, edi
mov dword [ebp - 0x42c], edi
je 0x102721b
dec eax
je 0x102719a
push 5
dec eax
push 0x1001d44
lea eax, [ebp - 0x20c]
push eax
je 0x1027175
call esi
add esp, 0xc
test eax, eax
je 0x10272ab
push 2
lea eax, [ebp - 0x20c]
push 0x1001d3c
push eax
call esi
add esp, 0xc
test eax, eax
je 0x10272ab
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1027166
jmp 0x1027273
call esi
add esp, 0xc
test eax, eax
jne 0x10272ab
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x102718b
jmp 0x1027273
push 2
lea eax, [ebp - 0x20c]
push 0x1001d3c
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x10272ab
push 6
lea eax, [ebp - 0x20c]
push 0x1001d2c
push eax
call esi
add esp, 0xc
test eax, eax
je 0x10272ab
push 5
lea eax, [ebp - 0x20c]
push 0x1001d20
push eax
call esi
add esp, 0xc
test eax, eax
je 0x10272ab
push 0xe
lea eax, [ebp - 0x20c]
push 0x1001d00
push eax
call esi
add esp, 0xc
test eax, eax
je 0x10272ab
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x102720f
jmp 0x1027273
push 6
lea eax, [ebp - 0x20c]
push 0x1001d2c
push eax
call esi
add esp, 0xc
test eax, eax
je 0x1027260
push 5
lea eax, [ebp - 0x20c]
push 0x1001d20
push eax
call esi
add esp, 0xc
test eax, eax
je 0x1027260
push 0xe
lea eax, [ebp - 0x20c]
push 0x1001d00
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x10272ab
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1027269
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push edi
push eax
push dword [ebp - 0x424]
call ebx
mov dword [ebp - 0x42c], eax
jmp 0x10272ab
mov dword [ebp - 0x430], 0x80004005
mov dword [ebp - 0x41c], 0x104
mov dword [ebp - 0x420], 0x208
cmp dword [ebp - 0x42c], edi
jne 0x1027307
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x438]
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10270fa
jmp 0x1027311
mov dword [ebp - 0x430], 0x80004005
inc dword [ebp - 0x434]
cmp dword [ebp - 0x434], 4
jl 0x10270b6
cmp dword [ebp - 0x430], edi
jl 0x10273b2
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, 0x208
mov dword [ebp - 0x41c], 0x104
mov dword [ebp - 0x420], ebx
jmp 0x1027370
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x41c], 0x104
mov dword [ebp - 0x420], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x428]
call esi
test eax, eax
je 0x102734d
push dword [ebp - 0x428]
push dword [ebp - 0x424]
call fcn.0102f291
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1001d50
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x430]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0102df7d
leave
ret 4