Function at 0x105d408
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push edi
push 0x100a1a0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105d86e
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 7
pop ebx
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push 0x100a168
push dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edi
call esi
test eax, eax
jne 0x105d865
cmp dword [ebp - 0x20], ebx
jne 0x105d865
push dword [ebp - 0x24]
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, edi
pop ecx
mov dword [ebp - 0x30], eax
je 0x105d865
lea ecx, [ebp - 0x24]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x100a168
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x105d85c
cmp dword [ebp - 0x20], ebx
jne 0x105d85c
push edi
push dword [ebp - 0x24]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0xc], edi
call fcn.0105b9ce
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x14], ebx
jle 0x105d7e8
cmp dword [ebp - 4], edi
je 0x105d7c6
and eax, 0x80000001
jns 0x105d4ed
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x105d537
xor esi, esi
cmp ebx, edi
jle 0x105d512
mov eax, dword [ebp - 4]
lea ebx, [eax + esi*4]
cmp dword [ebx], edi
je 0x105d50c
push dword [ebx]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], edi
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x105d4f8
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
push dword [ebp - 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x8000ffff
jmp 0x105d871
cmp ebx, 2
jl 0x105d7c6
xor ecx, ecx
push 4
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, edi
pop ecx
mov dword [ebp - 0x10], eax
je 0x105d7c6
cmp ebx, edi
mov dword [ebp - 8], edi
jle 0x105d739
mov ebx, 0x208
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ecx, 2
lea esi, [ecx + eax]
cmp dword [esi], edi
je 0x105d62e
lea eax, [ecx + eax + 4]
cmp dword [eax], edi
je 0x105d62e
push edi
push dword [eax]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], edi
call fcn.01058be1
cmp eax, edi
mov dword [ebp - 0x1c], eax
jl 0x105d680
push 1
push dword [esi]
lea eax, [ebp - 0x34]
push eax
call fcn.01058be1
cmp eax, edi
mov dword [ebp - 0x1c], eax
jl 0x105d680
mov esi, dword [ebp - 0x28]
push esi
call fcn.0105c2dc
test eax, eax
push esi
jne 0x105d691
call fcn.01056f43
test eax, eax
je 0x105d71b
push esi
call fcn.0105cf1a
test eax, eax
je 0x105d71b
xor esi, esi
inc esi
push esi
push edi
push edi
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x34]
call fcn.0105c64d
cmp eax, 0xd2af8
je 0x105d615
cmp eax, edi
jne 0x105d6aa
push dword [ebp - 0x28]
mov eax, dword [ebp + 8]
push 0x100b82c
push 4
mov dword [eax], esi
call fcn.0105e5ad
add esp, 0xc
jmp 0x105d66b
mov eax, dword [ebp - 4]
cmp dword [ecx + eax + 4], edi
jne 0x105d66b
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edx, dword [ebp - 0x2c]
shl edx, 2
cmp eax, edi
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [edx + ecx], eax
mov dword [edx + ecx + 4], edi
je 0x105d66b
push dword [esi]
push 0x104
push eax
call fcn.01034c79
test eax, eax
jl 0x105d66b
add dword [ebp - 0x2c], 2
add dword [ebp - 0xc], 2
add dword [ebp - 8], 2
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jl 0x105d572
jmp 0x105d739
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push dword [eax + ecx*4 + 4]
push 0x100b7d0
jmp 0x105d696
push 0x100b780
push 4
call fcn.0105e5ad
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [eax], edi
jmp 0x105d7c6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
push ebx
lea esi, [eax + ecx*4]
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
push ebx
mov dword [esi], eax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
pop ecx
mov ecx, dword [esi]
cmp ecx, edi
mov dword [esi + 4], eax
je 0x105d705
cmp eax, edi
je 0x105d705
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea eax, [eax + edx*4]
push dword [eax]
mov ebx, 0x104
push ebx
push ecx
mov dword [ebp - 0x34], eax
call fcn.01034c79
test eax, eax
jl 0x105d705
mov eax, dword [ebp - 0x34]
push dword [eax + 4]
push ebx
push dword [esi + 4]
call fcn.01034c79
test eax, eax
jl 0x105d705
add dword [ebp - 0xc], 2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
mov eax, dword [ebp - 4]
push dword [eax + ecx*4 + 4]
push 0x100b75c
jmp 0x105d72f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
mov eax, dword [ebp - 4]
push dword [eax + ecx*4 + 4]
push 0x100b710
push 4
call fcn.0105e5ad
add esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [eax], edi
je 0x105d7c6
cmp dword [ebp - 0x14], edi
jle 0x105d7c6
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 0x14]
add esi, 4
dec ebx
shr ebx, 1
inc ebx
cmp dword [esi], edi
je 0x105d7c0
push dword [esi]
call fcn.0105cf1a
test eax, eax
je 0x105d7c0
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, edi
mov dword [ebp - 0x34], eax
je 0x105d7c0
cmp word [eax], di
je 0x105d7c0
push eax
push 0x100992c
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x105d7a2
push dword [esi]
call fcn.0105c37d
test eax, eax
je 0x105d7c0
push edi
push 1
push dword [esi]
call fcn.0105aed9
jmp 0x105d7bd
push dword [ebp - 0x34]
push 0x1009938
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x105d7c0
push dword [esi]
call fcn.0105c1f3
mov dword [ebp - 0x1c], eax
add esi, 8
dec ebx
jne 0x105d756
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jge 0x105d7e4
cmp eax, edi
jle 0x105d7e6
mov ecx, dword [ebp + 8]
cmp dword [ecx], edi
je 0x105d7e4
push eax
push dword [ebp - 0x10]
call fcn.01058aac
jmp 0x105d7fd
cmp eax, edi
jne 0x105d7fd
mov eax, dword [ebp + 8]
cmp dword [eax], edi
je 0x105d7fd
push 0x100a168
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
cmp dword [ebp - 0xc], edi
jle 0x105d81f
mov eax, dword [ebp - 0x10]
lea ebx, [eax + esi*4]
mov eax, dword [ebx]
cmp eax, edi
je 0x105d819
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], edi
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x105d804
cmp dword [ebp - 0x10], edi
je 0x105d82d
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
xor esi, esi
cmp dword [ebp - 0x14], edi
jle 0x105d84e
mov eax, dword [ebp - 4]
lea ebx, [eax + esi*4]
cmp dword [ebx], edi
je 0x105d848
push dword [ebx]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], edi
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x105d834
cmp dword [ebp - 4], edi
je 0x105d85c
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 4