Function at 0x10007f49
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x11c]
push ebx
push eax
mov dword [ebp - 0xc], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
push 0x10010200
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x11c]
push 0x1001003c
push eax
call esi
lea eax, [ebp - 0x11c]
push 0x10010260
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x2001f
lea eax, [ebp - 0x11c]
push ebx
push eax
push 0x80000003
call edi
test eax, eax
jne 0x10008155
lea eax, [ebp - 0x11c]
push 0x1001003c
push eax
call esi
lea eax, [ebp - 0x11c]
push 0x100101c0
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0x2001f
lea eax, [ebp - 0x11c]
push ebx
push eax
push 0x80000003
call edi
test eax, eax
jne 0x1000814c
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push ebx
push str.o_JYXpY___EoYHHUR_O
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
call edi
test eax, eax
jne 0x10008140
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x1c], esi
je 0x10008140
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push ebx
push str.o_JYXpY___EoYHHUR_O
push dword [ebp - 8]
call edi
test eax, eax
jne 0x10008139
mov eax, dword [esi + 8]
add esi, 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esi, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], ebx
mov eax, dword [esi]
add esi, 4
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x10008099
push eax
push esi
push 1
push ebx
push str.lNSDEoYNJYN
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100080aa
mov eax, dword [ebp - 0xc]
shr eax, 1
and eax, 1
mov dword [ebp - 0x14], eax
jmp 0x100080aa
push str.lNSDEoYNJYN
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push ebx
push str.lNSDEyR_PY
push dword [ebp - 4]
call edi
add esi, dword [ebp - 0x18]
mov eax, dword [esi]
add esi, 4
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x100080dd
push eax
push esi
push 1
push ebx
push str.lNSDEsJYNUXY
push dword [ebp - 4]
call edi
jmp 0x100080eb
push str.lNSDEsJYNUXY
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esi, dword [ebp - 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000810e
test byte [ebp - 0xc], 4
je 0x1000810e
add esi, 4
push eax
push esi
push 1
push ebx
push str.IHS
push dword [ebp - 4]
call edi
jmp 0x1000811c
push str.IHS
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 3
push ebx
push str.xYZ_IPH
push dword [ebp - 8]
call edi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0xc], 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret