Function at 0x4103cb
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
cmp dword [ebp + 8], 0
push esi
je 0x4107ab
push ebx
push edi
push 0x1c
mov esi, 0x42d28c
pop ecx
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x25
mov esi, 0x42d1f8
pop ecx
lea edi, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push 0x21
mov esi, 0x42d170
pop ecx
lea edi, [ebp - 0x44c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x24
mov esi, 0x42d0dc
pop ecx
lea edi, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1c
mov esi, 0x42d06c
pop ecx
lea edi, [ebp - 0x344]
rep movsd dword es:[edi], dword [esi]
push 0x1b
mov esi, 0x42cffc
pop ecx
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f
mov esi, 0x42cf7c
pop ecx
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x28
mov esi, 0x42cedc
pop ecx
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x422a00
lea edi, [ebp - 0x28]
mov esi, ebx
lea eax, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x42b1b8
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push eax
push 1
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x42ce9c
push esi
call ebx
lea eax, [ebp - 0x2d4]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
lea eax, [ebp - 0x9c]
push 0x42ce6c
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push dword [ebp + 0xc]
push 1
push 0x42ce4c
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x9c]
push 0x42ce2c
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x42c030
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x42c024
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x42c008
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x42ce20
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x42ce10
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x42ce08
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x42cdfc
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x42cdf0
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x44c]
push 0x42cdcc
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x344]
push dword [ebp + 0xc]
push 1
push 0x42eef4
push eax
push esi
call ebx
and word [ebp - 0x864], 0
mov edx, 0x82
mov ecx, edx
xor eax, eax
and word [ebp - 0x658], ax
lea edi, [ebp - 0x862]
push dword [ebp + 0xc]
and word [ebp - 0xa70], ax
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x656]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0xa6e]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x42cda8
lea eax, [ebp - 0x864]
push 0x104
push eax
mov dword [ebp + 8], 1
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x658]
push 0x42cd70
push 0x104
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0xa70]
push 0x42cd4c
push 0x104
push eax
call edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x864]
push eax
call edi
add esp, 0x34
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x864]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x42cd28
push eax
push esi
call ebx
lea eax, [ebp + 8]
push 4
push eax
push 4
lea eax, [ebp - 0x10c]
push 0x42cd0c
push eax
push esi
call ebx
lea eax, [ebp - 0x658]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x658]
push eax
push 1
push 0x42cce8
lea eax, [ebp - 0x10c]
push eax
push esi
call ebx
lea eax, [ebp - 0xa70]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa70]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x42ccc4
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x3c4]
push dword [ebp + 0xc]
push 1
push 0x42eef4
push eax
push esi
call ebx
pop edi
pop ebx
jmp 0x4107cd
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x42cc6c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x422a00
push 0x42ce9c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
pop esi
leave
ret