Function at 0x7d281600
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
push 4
push esi
push dword [esp + 0x18]
call fcn.7d284eb0
test eax, eax
je 0x7d281632
push eax
call fcn.7d281050
push 0x431
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
add esp, 8
ret 0x34
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x7d28184f
push 1
push esi
call fcn.7d221de3
mov edi, eax
test edi, edi
je 0x7d28184f
push ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0xc]
push ebp
push str.Type
push eax
call ebx
mov ebp, dword [sym.imp.ntdll.dll_NtSetValueKey]
lea eax, [esp + 0x2c]
push 4
push eax
push 4
push 0
lea eax, [esp + 0x20]
push eax
push edi
call ebp
test eax, eax
js 0x7d28182d
push str.Start
lea eax, [esp + 0x14]
push eax
call ebx
push 4
lea eax, [esp + 0x34]
push eax
push 4
push 0
lea eax, [esp + 0x20]
push eax
push edi
call ebp
test eax, eax
js 0x7d28182d
push str.ErrorControl
lea eax, [esp + 0x14]
push eax
call ebx
push 4
lea eax, [esp + 0x38]
push eax
push 4
push 0
lea eax, [esp + 0x20]
push eax
push edi
call ebp
test eax, eax
js 0x7d28182d
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x7d281722
push str.DisplayName
lea eax, [esp + 0x14]
push eax
call ebx
mov ecx, ebp
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d2816f2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebp
push 1
push 0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d28182d
mov ebp, dword [esp + 0x38]
test ebp, ebp
je 0x7d281770
push str.ImagePath
lea eax, [esp + 0x14]
push eax
call ebx
mov ecx, ebp
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d281740
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebp
push 1
push 0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d28182d
mov ebp, dword [esp + 0x48]
test ebp, ebp
je 0x7d2817bc
push str.ObjectName
lea eax, [esp + 0x14]
push eax
call ebx
mov ecx, ebp
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d281790
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebp
push 1
push 0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
js 0x7d28182d
push esi
call fcn.7d280840
test eax, eax
js 0x7d28182d
push edi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d2817d2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 6]
push eax
call fcn.7d2217b2
mov ecx, dword [str.sbox5.58.0]
mov edi, eax
mov dword [edi], ecx
mov ecx, edi
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi + 2], ax
test ax, ax
jne 0x7d281800
push edi
call sub.ntdll.dll__wcslwr
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0x34
push edi
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push edi
call dword [sym.imp.ntdll.dll_NtClose]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret 0x34
pop edi
xor eax, eax
pop esi
add esp, 8
ret 0x34