Function at 0x1039563
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x6c
push 0x1014658
call fcn.0103d528
mov eax, dword [0x10723e4]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp - 0x74], edi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
cmp dword [ebp + 0xc], ebx
je 0x10395a3
mov dword [0x1073440], edi
mov eax, edi
jmp 0x1039886
mov dword [ebp - 4], ebx
lea eax, [esi + 0x64]
mov dword [ebp - 0x78], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x5c], ebx
mov eax, dword [esi + 0x60]
cmp eax, ebx
je 0x10395ca
push eax
call fcn.01039422
mov dword [esi + 0x60], ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x1011378
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10397c0
push dword [0x107393c]
push 0x1011360
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x103982c
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x103982c
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103982c
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [0x107393c]
push 0x1011348
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103982c
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x68], eax
cmp eax, ebx
je 0x103982c
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103982c
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [0x107393c]
push 0x101132c
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103982c
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x103982c
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103982c
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [0x107393c]
push 0x1011310
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x10397bd
push dword [ebp - 0x5c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x103982c
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jne 0x103982c
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edi, edi
inc edi
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi + 0x60], eax
cmp eax, ebx
je 0x103982c
push dword [ebp - 0x70]
call fcn.01032328
mov ecx, dword [esi + 0x60]
mov dword [ecx], eax
push dword [ebp - 0x68]
call fcn.01032328
mov ecx, dword [esi + 0x60]
mov dword [ecx + 4], eax
push dword [ebp - 0x6c]
call fcn.01032328
mov ecx, dword [esi + 0x60]
mov dword [ecx + 0xc], eax
cmp dword [ebp - 0x64], ebx
je 0x103980d
push dword [ebp - 0x64]
call fcn.01032328
mov ecx, dword [esi + 0x60]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x60]
cmp dword [eax], ebx
je 0x1039823
cmp dword [eax + 4], ebx
je 0x1039823
cmp dword [eax + 0xc], ebx
je 0x1039823
mov dword [esi + 0x5c], edi
jmp 0x103982f
push eax
call fcn.01039422
mov dword [esi + 0x60], ebx
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x70], ebx
je 0x1039848
push dword [ebp - 0x70]
call esi
cmp dword [ebp - 0x68], ebx
je 0x1039852
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x6c], ebx
je 0x103985c
push dword [ebp - 0x6c]
call esi
cmp dword [ebp - 0x64], ebx
je 0x1039866
push dword [ebp - 0x64]
call esi
cmp dword [ebp - 0x58], ebx
je 0x1039874
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x74]
jmp 0x1039886
mov ecx, dword [ebp - 0x1c]
call fcn.0103d24a
call fcn.0103d563
ret 8