Function at 0x1082b24
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x10a6184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push esi
push eax
mov dword [ebp - 0x230], esi
call sub.msvcrt.dll_memset
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
xor eax, eax
mov dword [ebp - 0x254], esi
lea edi, [ebp - 0x250]
push 0x1012180
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push 0x104
push eax
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x24c], esi
call fcn.0103e1ed
add esp, 0x1c
cmp eax, esi
jge 0x1082bec
mov ecx, dword [0x10a60d8]
cmp ecx, 0x10a60d8
je 0x1082e25
test byte [ecx + 0x1c], 1
je 0x1082e25
push eax
push 0x1011fb0
push 0x1a
jmp 0x1082e1a
lea eax, [ebp - 0x230]
push eax
push 0x2001b
push esi
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
cmp dword [ebp + 0xc], esi
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1082c6c
cmp eax, 2
jne 0x1082c43
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x1082e25
test byte [eax + 0x1c], 4
je 0x1082e25
push 0x1011fb0
push 0x1b
jmp 0x1082d13
mov ecx, dword [0x10a60d8]
cmp ecx, 0x10a60d8
je 0x1082e25
test byte [ecx + 0x1c], 1
je 0x1082e25
push eax
push 0x1011fb0
push 0x1c
jmp 0x1082e1a
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x1082cb6
mov ecx, dword [0x10a60d8]
cmp ecx, 0x10a60d8
je 0x1082e25
test byte [ecx + 0x1c], 1
je 0x1082e25
push eax
push 0x1011fb0
push 0x1d
jmp 0x1082e1a
cmp dword [ebp - 0x238], esi
jne 0x1082ce1
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x1082e25
test byte [eax + 0x1c], 4
je 0x1082e25
push 0x1011fb0
push 0x1e
jmp 0x1082d13
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
jge 0x1082d23
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x1082e25
test byte [eax + 0x1c], 1
je 0x1082e25
push 0x1011fb0
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015b76
jmp 0x1082e25
mov eax, dword [ebp - 0x238]
dec eax
cmp eax, esi
mov dword [ebp - 0x234], eax
jl 0x1082e25
push 8
mov ebx, 0x1011fb0
pop edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x234]
mov dword [ebp - 0x248], 0x10
push dword [ebp - 0x230]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1082e02
cmp dword [ebp - 0x23c], edi
jne 0x1082dd4
cmp dword [ebp - 0x24c], 0xb
jne 0x1082dd4
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x250]
jg 0x1082df4
jl 0x1082dc2
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x254]
ja 0x1082df4
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1082df4
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x1082df4
test byte [eax + 0x1c], 2
je 0x1082df4
push ebx
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015b76
dec dword [ebp - 0x234]
jns 0x1082d40
jmp 0x1082e25
mov ecx, dword [0x10a60d8]
cmp ecx, 0x10a60d8
je 0x1082e25
test byte [ecx + 0x1c], 1
je 0x1082e25
push eax
push ebx
push 0x20
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010160ad
cmp dword [ebp - 0x230], esi
pop edi
pop esi
pop ebx
je 0x1082e3c
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01039921
leave
ret 8