Function at 0x10203ea
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push esi
push eax
mov dword [ebp - 0x230], esi
call sub.msvcrt.dll_memset
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
xor eax, eax
mov dword [ebp - 0x254], esi
lea edi, [ebp - 0x250]
push 0x1004120
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push 0x104
push eax
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x24c], esi
call fcn.01006a35
add esp, 0x1c
cmp eax, esi
jge 0x10204b2
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10206eb
test byte [ecx + 0x1c], 1
je 0x10206eb
push eax
push 0x1003ff0
push 0x1a
jmp 0x10206e0
lea eax, [ebp - 0x230]
push eax
push 0x2001b
push esi
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
cmp dword [ebp + 0xc], esi
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1020532
cmp eax, 2
jne 0x1020509
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10206eb
test byte [eax + 0x1c], 4
je 0x10206eb
push 0x1003ff0
push 0x1b
jmp 0x10205d9
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10206eb
test byte [ecx + 0x1c], 1
je 0x10206eb
push eax
push 0x1003ff0
push 0x1c
jmp 0x10206e0
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x102057c
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10206eb
test byte [ecx + 0x1c], 1
je 0x10206eb
push eax
push 0x1003ff0
push 0x1d
jmp 0x10206e0
cmp dword [ebp - 0x238], esi
jne 0x10205a7
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10206eb
test byte [eax + 0x1c], 4
je 0x10206eb
push 0x1003ff0
push 0x1e
jmp 0x10205d9
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
jge 0x10205e9
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10206eb
test byte [eax + 0x1c], 1
je 0x10206eb
push 0x1003ff0
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x10206eb
mov eax, dword [ebp - 0x238]
dec eax
cmp eax, esi
mov dword [ebp - 0x234], eax
jl 0x10206eb
push 8
mov ebx, 0x1003ff0
pop edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x234]
mov dword [ebp - 0x248], 0x10
push dword [ebp - 0x230]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x10206c8
cmp dword [ebp - 0x23c], edi
jne 0x102069a
cmp dword [ebp - 0x24c], 0xb
jne 0x102069a
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x250]
jg 0x10206ba
jl 0x1020688
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x254]
ja 0x10206ba
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10206ba
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10206ba
test byte [eax + 0x1c], 2
je 0x10206ba
push ebx
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
dec dword [ebp - 0x234]
jns 0x1020606
jmp 0x10206eb
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10206eb
test byte [ecx + 0x1c], 1
je 0x10206eb
push eax
push ebx
push 0x20
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
cmp dword [ebp - 0x230], esi
pop edi
pop esi
pop ebx
je 0x1020702
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01011f27
leave
ret 8