Function at 0x1005bd3
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1010100]
xor eax, dword [ebp + 4]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
jne 0x1005bf9
mov eax, 0x80070057
jmp 0x1005f82
push esi
push edi
push dword [0x1010070]
mov esi, 0xff
push esi
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x28], 1
call fcn.010032e8
mov edi, eax
cmp edi, ebx
jl 0x1005f75
push 0x10015bc
push esi
lea eax, [ebp - 0x130]
push eax
call fcn.01003a97
mov edi, eax
cmp edi, ebx
jl 0x1005f75
push dword [ebp + 8]
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.01003a97
mov edi, eax
cmp edi, ebx
jl 0x1005f75
push 0x10015bc
push esi
lea eax, [ebp - 0x130]
push eax
call fcn.01003a97
mov edi, eax
cmp edi, ebx
jl 0x1005f75
push dword [ebp + 0xc]
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.01003a97
mov edi, eax
cmp edi, ebx
jl 0x1005f75
lea eax, [ebp - 0x130]
push eax
push 0x1001f04
call fcn.01004423
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push 3
push ebx
lea eax, [ebp - 0x130]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, ebx
je 0x1005d0d
cmp edi, 2
jne 0x1005cee
lea eax, [ebp - 0x130]
push eax
push 0x1001ecc
call fcn.01004423
pop ecx
pop ecx
jmp 0x1005cfc
push edi
call fcn.01003f7b
cmp edi, ebx
jle 0x1005f75
and edi, 0xffff
or edi, 0x80070000
jmp 0x1005f75
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, ebx
jne 0x1005cee
mov eax, dword [ebp - 0x14]
cmp eax, esi
jb 0x1005d33
mov eax, esi
push 0x200
mov byte [ebp + eax - 0x439], bl
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1001ec8
push 0x208
lea eax, [ebp - 0x438]
push eax
call fcn.0100407f
mov edi, eax
cmp edi, ebx
jl 0x1005f75
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], 2
add eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x1005f75
cmp dword [ebp - 0x18], ebx
je 0x1005db7
cmp dword [ebp - 0x20], 1
je 0x1005ded
mov eax, dword [ebp - 0x10]
inc dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1005dac
cmp dword [ebp + 0xc], ebx
jne 0x1005f75
push dword [ebp - 0xc]
call fcn.01003851
test eax, eax
jne 0x1005e14
push dword [ebp - 0xc]
mov dword [ebp - 0x28], ebx
push 0x1001ea4
call fcn.01004423
pop ecx
pop ecx
push 0x10017b8
push 0x208
lea eax, [ebp - 0x438]
push eax
call fcn.01003a97
mov edi, eax
cmp edi, ebx
jl 0x1005f75
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x438]
push eax
mov dword [ebp + 8], ebx
call fcn.010059ba
mov edi, eax
cmp edi, 0x8000ffff
jne 0x1005e9b
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jae 0x1005e8f
push 2
push 0x1001e88
call fcn.01004423
pop ecx
pop ecx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x438]
push eax
call fcn.010059ba
mov edi, eax
cmp edi, 0x8000ffff
je 0x1005e52
cmp edi, 0x8000ffff
je 0x1005f51
cmp edi, 0x80000055
jne 0x1005ee8
call fcn.010052ad
test eax, eax
je 0x1005f31
push 0x1001e28
call fcn.01004423
mov eax, dword [0x1010c8c]
pop ecx
mov dword [ebp - 0x30], eax
mov eax, dword [0x1010c90]
push 0xffffffffffffffff
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 0x30]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1005d74
inc edi
jmp 0x1005f75
cmp edi, 0x80000056
je 0x1005f63
cmp edi, ebx
jl 0x1005f31
cmp dword [ebp - 0x1c], ebx
jne 0x1005f31
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1005d74
lea eax, [ebp - 0x230]
push eax
push 0x1001df4
call fcn.01004423
pop ecx
pop ecx
push dword [ebp + 0xc]
call fcn.01003f7b
jmp 0x1005f46
cmp dword [ebp - 0x28], ebx
jne 0x1005f70
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
je 0x1005d74
jmp 0x1005f75
push 0x1001db0
call fcn.01004423
pop ecx
mov edi, 0x800705b4
jmp 0x1005f75
push 0x1001d58
call fcn.01004423
pop ecx
jmp 0x1005f75
mov edi, 0x80004005
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.0100708e
leave
ret 0xc