Function at 0x1028afa
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x40c], 1
call fcn.0102d126
test eax, eax
jne 0x1028ee7
cmp dword [ebp + 8], esi
push ebx
setne al
push edi
push dword [ebp + 8]
mov dword [ebp - 0x40c], eax
call fcn.010288dd
push esi
lea eax, [ebp - 0x408]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10023f8
mov ebx, 0x80000002
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1028b93
push 4
lea eax, [ebp - 0x40c]
push eax
push 4
push esi
push 0x10023dc
push dword [ebp - 0x408]
call edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x408]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003160
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1028be5
cmp dword [ebp - 0x40c], esi
push 4
sete al
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x410]
push eax
push 4
push esi
push 0x100314c
push dword [ebp - 0x408]
call edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x408]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10030b8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1028c28
push 4
lea eax, [ebp - 0x40c]
push eax
push 4
push esi
push 0x10030a4
push dword [ebp - 0x408]
call edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x408]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1002fe8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1028ee5
push 4
lea eax, [ebp - 0x40c]
push eax
push 4
push esi
push 0x1002fd8
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], 2
call edi
push 0xff
lea eax, [ebp - 0x204]
push eax
call fcn.0103066c
test eax, eax
je 0x1028da8
add dword [eax], eax
invalid
mov ebx, dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [ebp - 0x410], esi
jmp 0x1028c9a
push 0x2c
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x204]
push 0x1002b50
push eax
call ebx
pop ecx
pop ecx
cmp eax, esi
jne 0x1028c94
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1028cb7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
mov ebx, 0x1002fc8
push ebx
push dword [ebp - 0x408]
call edi
cmp dword [ebp + 8], esi
jne 0x1028d98
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1002fe8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1028dba
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1028d1a
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x410]
call edi
push 0x1002fc4
mov ebx, 0x100
push ebx
lea eax, [ebp - 0x204]
push eax
call fcn.01027e68
lea eax, [ebp - 0x204]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x1028d60
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push 0x1002fb4
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1028dbf
push 0x1002fe8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp + 8], esi
je 0x1028dba
mov dword [ebp - 0x40c], esi
mov ebx, 0x100
jmp 0x1028dc9
mov ebx, 0x100
mov dword [ebp - 0x40c], 1
push 4
lea eax, [ebp - 0x40c]
push eax
push 4
push esi
push 0x1002f9c
push dword [ebp - 0x408]
call edi
push 0xff
lea eax, [ebp - 0x204]
push eax
call fcn.0102fc69
test eax, eax
je 0x1028e8c
lea eax, [ebp - 0x204]
cmp dword [ebp + 8], esi
je 0x1028e0d
push 0x1002f88
jmp 0x1028e12
push 0x1002f74
push ebx
push eax
call fcn.01027edd
push ebx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnExpandEnvStringsW]
test eax, eax
je 0x1028e59
lea eax, [ebp - 0x404]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1028e3b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x404]
push eax
push 2
jmp 0x1028e7e
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1028e62
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push 0x1002f60
push dword [ebp - 0x408]
call edi
push 4
push 0x1002fc4
push 1
push esi
push 0x1002fb4
push dword [ebp - 0x408]
push esi
call fcn.0102f9d6
push 0x14
push 0x1002f4c
push 1
push esi
push 0x1002f34
push dword [ebp - 0x408]
push esi
call fcn.0102f9d6
push 0x2a
push 0x1002f08
push 1
push esi
push esi
push dword [ebp - 0x408]
push esi
call fcn.0102f9d6
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0102df7d
leave
ret 4