Function at 0x10003a10
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x10036014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x10
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4bc], 8
push eax
mov ebx, edx
mov dword [ebp - 0x4b8], 5
mov edi, ecx
mov dword [ebp - 0x4b4], 1
push ebx
push edi
mov dword [ebp - 0x4b0], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsW]
test eax, eax
jne 0x10003a9e
mov eax, dword [0x100368b0]
cmp eax, 0x100368b0
je 0x10003a8b
push dword [eax + 0x14]
mov edx, 0x1002fd70
mov ecx, 0xa
push dword [eax + 0x10]
call fcn.10001d00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10011ed6
mov esp, ebp
pop ebp
ret
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetSelectedDevice]
test eax, eax
jne 0x10003ae1
mov eax, dword [0x100368b0]
cmp eax, 0x100368b0
je 0x10003a8b
push dword [eax + 0x14]
mov edx, 0x1002fd70
mov ecx, 0xb
push dword [eax + 0x10]
call fcn.10001d00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10011ed6
mov esp, ebp
pop ebp
ret
xor eax, eax
push eax
push 0x104
mov word [ebp - 0x4ac], ax
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 4
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x10003c46
cmp dword [ebp - 0x4c4], 1
jne 0x10003c46
lea eax, [ebp - 0x4c0]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlCriticalDeviceDataBase
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003c46
push 0x104
lea eax, [ebp - 0x29c]
push eax
push 0
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, 1
cmp eax, 0x103
je 0x10003c3a
lea ecx, [ecx]
test eax, eax
jne 0x10003c15
lea eax, [ebp - 0x4c8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x29c]
push eax
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003c15
lea eax, [ebp - 0x4cc]
mov dword [ebp - 0x4cc], 0x80
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0
push str.Service
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003c09
cmp dword [ebp - 0x4c4], 1
jne 0x10003c09
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.100168b7
add esp, 8
test eax, eax
jne 0x10003c09
lea eax, [ebp - 0x29c]
push eax
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x29c]
push eax
push esi
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc esi
cmp eax, 0x103
jne 0x10003b70
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
push 0
push 1
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDeleteDevRegKey]
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiRemoveDevice]
test eax, eax
jne 0x10003c95
cmp dword [0x100368b0], 0x100368b0
je 0x10003c90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x100368b0]
mov edx, 0x1002fd70
mov ecx, 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10001da0
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011ed6
mov esp, ebp
pop ebp
ret