Function at 0x1012cd6
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd14
mov eax, dword [0x10180ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd10], eax
lea eax, [ebp - 0xd14]
push eax
xor esi, esi
lea eax, [ebp - 0xce0]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x1002590
push closesocket
mov dword [ebp - 0xd04], ecx
mov dword [ebp - 0xce0], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x1012d4a
jle 0x1012fd7
and eax, 0xffff
or eax, 0x80070000
jmp 0x1012fd7
push ebx
mov dword [ebp - 0xce8], esi
push edi
mov dword [ebp - 0xce4], esi
lea eax, [ebp - 0xd0c]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0xcec]
push eax
push esi
lea eax, [ebp - 0xd08]
push eax
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0xce4]
mov dword [ebp - 0xd08], 0x148
push dword [ebp - 0xce0]
mov dword [ebp - 0xcec], esi
mov dword [ebp - 0xd0c], 0x290
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1012f9f
cmp dword [ebp - 0xcec], 1
jne 0x1012fa6
mov edi, dword [sym.imp.msvcrt.dll_swscanf]
lea eax, [ebp - 0xcf4]
push eax
lea eax, [ebp - 0xcd4]
push eax
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0x294]
push 0x100257c
push eax
mov dword [ebp - 0xcf8], esi
mov dword [ebp - 0xcf4], esi
mov word [ebp - 6], si
call edi
add esp, 0x14
cmp eax, 3
jne 0x1012fa6
cmp dword [ebp - 0xcf0], esi
je 0x1012e27
lea eax, [ebp - 0xcd4]
push eax
push dword [ebp - 0xcf0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1012fa6
push dword [ebp - 0xcf8]
call fcn.01014824
test eax, eax
je 0x1012fa6
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0xd00]
push eax
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0x524]
push 0x1002568
push eax
mov dword [ebp - 0xd00], esi
call edi
add esp, 0x14
cmp eax, 3
jne 0x1012f86
lea eax, [ebp - 0x7b4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
cmp ebx, esi
je 0x1012f7f
mov ecx, dword [ebp - 0xd04]
lea eax, [ebp - 0xcd8]
push eax
push ebx
push dword [ebp - 0xd00]
mov dword [ebp - 0xcd8], esi
push dword [ebp - 0xd10]
call fcn.010129bd
test eax, eax
mov edi, dword [ebp - 0xcd8]
jl 0x1012f75
cmp edi, esi
je 0x1012f7f
lea ecx, [ebp - 0xcd8]
push ecx
mov dword [ebp - 0xcd8], esi
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
test eax, eax
jl 0x1012f65
mov eax, dword [ebp - 0xcd8]
lea edx, [ebp - 0xcfc]
push edx
mov dword [ebp - 0xcfc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0xcd8]
lea edx, [ebp - 0xcdc]
push edx
mov dword [ebp - 0xcdc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 0xcfc]
cmp eax, dword [ebp - 0xcf4]
jne 0x1012f59
cmp dword [ebp - 0xcdc], esi
je 0x1012f59
lea eax, [ebp - 0xa44]
push eax
push dword [ebp - 0xcdc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1012f59
mov eax, dword [ebp - 0xcd8]
cmp eax, esi
je 0x1012f53
mov dword [ebp - 0xcd8], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
push dword [ebp - 0xcdc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0xcd8]
cmp eax, esi
je 0x1012f75
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
je 0x1012f7f
mov eax, dword [edi]
push edi
call dword [eax + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0xce0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x1012fbb
jmp 0x1012fa6
cmp eax, 0x103
je 0x1012fb1
inc dword [ebp - 0xce4]
jmp 0x1012d58
mov dword [ebp - 0xce8], 1
cmp dword [ebp - 0xce8], esi
je 0x1012d52
push dword [ebp - 0xce0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01007f54
leave
ret 8