Function at 0x1009446
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1017048]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x408], eax
jne 0x1009472
mov eax, 0x1001ac0
push eax
push 0x1001d58
call fcn.0100f591
pop ecx
pop ecx
lea ecx, [ebp - 0x3f0]
mov dword [ebp - 0x3fc], ebx
mov dword [ebp - 0x3f0], ebx
mov byte [ebp - 0x3f1], bl
call fcn.01008658
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x10094ea
cmp eax, 2
jne 0x10094be
mov bl, 1
jmp 0x10094cd
push eax
push esi
push 0x1001938
call fcn.0100f591
add esp, 0xc
lea ecx, [ebp - 0x3f0]
call fcn.01008676
lea ecx, [ebp - 0x3fc]
call fcn.01008676
mov al, bl
jmp 0x1009812
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3ec]
push eax
mov dword [ebp - 0x3f8], ebx
mov dword [ebp - 0x400], ebx
push ebx
jmp 0x10097b4
inc dword [ebp - 0x400]
mov esi, dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3f8]
call fcn.01008658
cmp byte [ebp + 0x10], bl
push eax
lea eax, [ebp - 0x3ec]
jne 0x100955d
push 0x2001f
push ebx
push eax
push esi
call fcn.01008692
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x10096e6
cmp esi, 5
jne 0x10096d5
jmp 0x1009597
push 0x20019
push ebx
push eax
push esi
call fcn.01008692
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x100977b
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x408]
push dword [ebp - 0x3f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
jne 0x100977b
push 0x100185c
call fcn.01008bd6
test al, al
pop ecx
je 0x10096d5
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x3f0]
call fcn.01008e1b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x100960a
lea eax, [ebp - 0x3ec]
push eax
push esi
push 0x10017d8
call fcn.0100f591
add esp, 0xc
cmp byte [ebp + 0x10], bl
je 0x10096d5
lea ecx, [ebp - 0x3f8]
call fcn.01008676
lea ecx, [ebp - 0x3f0]
call fcn.01008676
lea ecx, [ebp - 0x3fc]
call fcn.01008676
xor al, al
jmp 0x1009811
mov esi, dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3fc]
call fcn.01008658
push eax
push 0x60000
push ebx
lea eax, [ebp - 0x3ec]
push eax
push esi
call fcn.01008692
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x10096b4
push dword [ebp - 0x3fc]
call fcn.01008fb5
mov esi, eax
cmp esi, ebx
pop ecx
lea eax, [ebp - 0x3ec]
jne 0x100965f
push eax
push 0x1001750
call fcn.0100f591
pop ecx
pop ecx
jmp 0x1009677
push esi
push eax
push 0x1001ce0
call fcn.0100f591
add esp, 0xc
cmp byte [ebp + 0x10], bl
jne 0x10095e2
push ebx
lea ecx, [ebp - 0x3fc]
call fcn.01008634
cmp byte [ebp + 0x10], bl
jne 0x10096d5
mov esi, dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3f8]
call fcn.01008658
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x3ec]
push eax
push esi
call fcn.01008692
add esp, 0x14
mov esi, eax
jmp 0x10096d5
lea eax, [ebp - 0x3ec]
push eax
push esi
push 0x1001510
call fcn.0100f591
add esp, 0xc
push ebx
lea ecx, [ebp - 0x3fc]
call fcn.01008634
cmp esi, ebx
jne 0x100977b
cmp byte [ebp + 0x10], bl
jne 0x100976d
push dword [ebp - 0x408]
push dword [ebp - 0x3f8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, ebx
jne 0x100977b
cmp byte [ebp + 0x10], bl
jne 0x100976d
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push dword [ebp - 0x3f8]
mov dword [ebp - 0x40c], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x1009751
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x3f0]
call fcn.010086c9
test eax, eax
pop ecx
pop ecx
jne 0x1009751
dec dword [ebp - 0x400]
lea eax, [ebp - 0x3ec]
push eax
push 0x1001c98
call fcn.0100f591
pop ecx
pop ecx
mov byte [0x101881c], 1
jmp 0x100979c
lea eax, [ebp - 0x3ec]
push eax
push 0x1001c50
jmp 0x100975d
cmp esi, 2
je 0x100979c
push esi
lea eax, [ebp - 0x3ec]
push eax
push 0x1001be0
call fcn.0100f591
add esp, 0xc
mov byte [ebp - 0x3f1], 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x400]
push dword [ebp - 0x3f0]
mov dword [ebp - 0x404], 0x1f4
call edi
cmp eax, ebx
je 0x1009515
cmp eax, 0x103
je 0x10097e7
push eax
push 0x1001b68
call fcn.0100f591
pop ecx
pop ecx
jmp 0x10095e2
lea ecx, [ebp - 0x3f8]
call fcn.01008676
lea ecx, [ebp - 0x3f0]
call fcn.01008676
lea ecx, [ebp - 0x3fc]
call fcn.01008676
cmp byte [ebp - 0x3f1], bl
sete al
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100f0dc
leave
ret