Function at 0x10b14fe
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push esi
push eax
mov dword [ebp - 0x230], esi
call sub.msvcrt.dll_memset
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
xor eax, eax
mov dword [ebp - 0x254], esi
lea edi, [ebp - 0x250]
push 0x100add0
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push 0x104
push eax
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x24c], esi
call fcn.010aceee
add esp, 0x1c
cmp eax, esi
jge 0x10b15c6
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b17ff
test byte [ecx + 0x1c], 1
je 0x10b17ff
push eax
push 0x100ac18
push 0x1a
jmp 0x10b17f4
lea eax, [ebp - 0x230]
push eax
push 0x2001b
push esi
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
cmp dword [ebp + 0xc], esi
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10b1646
cmp eax, 2
jne 0x10b161d
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b17ff
test byte [eax + 0x1c], 4
je 0x10b17ff
push 0x100ac18
push 0x1b
jmp 0x10b16ed
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b17ff
test byte [ecx + 0x1c], 1
je 0x10b17ff
push eax
push 0x100ac18
push 0x1c
jmp 0x10b17f4
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x10b1690
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b17ff
test byte [ecx + 0x1c], 1
je 0x10b17ff
push eax
push 0x100ac18
push 0x1d
jmp 0x10b17f4
cmp dword [ebp - 0x238], esi
jne 0x10b16bb
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b17ff
test byte [eax + 0x1c], 4
je 0x10b17ff
push 0x100ac18
push 0x1e
jmp 0x10b16ed
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
jge 0x10b16fd
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b17ff
test byte [eax + 0x1c], 1
je 0x10b17ff
push 0x100ac18
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10b17ff
mov eax, dword [ebp - 0x238]
dec eax
cmp eax, esi
mov dword [ebp - 0x234], eax
jl 0x10b17ff
push 8
mov ebx, 0x100ac18
pop edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x234]
mov dword [ebp - 0x248], 0x10
push dword [ebp - 0x230]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
call dword [sym.imp.KERNEL32.dll_RegEnumValueW]
cmp eax, esi
jne 0x10b17dc
cmp dword [ebp - 0x23c], edi
jne 0x10b17ae
cmp dword [ebp - 0x24c], 0xb
jne 0x10b17ae
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x250]
jg 0x10b17ce
jl 0x10b179c
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x254]
ja 0x10b17ce
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10b17ce
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b17ce
test byte [eax + 0x1c], 2
je 0x10b17ce
push ebx
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
dec dword [ebp - 0x234]
jns 0x10b171a
jmp 0x10b17ff
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b17ff
test byte [ecx + 0x1c], 1
je 0x10b17ff
push eax
push ebx
push 0x20
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01027ecb
cmp dword [ebp - 0x230], esi
pop edi
pop esi
pop ebx
je 0x10b1816
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010a0b37
leave
ret 8