Function at 0x10b16bf
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push esi
push eax
mov dword [ebp - 0x230], esi
call sub.msvcrt.dll_memset
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
xor eax, eax
mov dword [ebp - 0x254], esi
lea edi, [ebp - 0x250]
push 0x100add0
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push 0x104
push eax
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x24c], esi
call fcn.010ad159
add esp, 0x1c
cmp eax, esi
jge 0x10b1787
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b19c0
test byte [ecx + 0x1c], 1
je 0x10b19c0
push eax
push 0x100ac18
push 0x1a
jmp 0x10b19b5
lea eax, [ebp - 0x230]
push eax
push 0x2001b
push esi
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
cmp dword [ebp + 0xc], esi
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10b1807
cmp eax, 2
jne 0x10b17de
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b19c0
test byte [eax + 0x1c], 4
je 0x10b19c0
push 0x100ac18
push 0x1b
jmp 0x10b18ae
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b19c0
test byte [ecx + 0x1c], 1
je 0x10b19c0
push eax
push 0x100ac18
push 0x1c
jmp 0x10b19b5
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x10b1851
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b19c0
test byte [ecx + 0x1c], 1
je 0x10b19c0
push eax
push 0x100ac18
push 0x1d
jmp 0x10b19b5
cmp dword [ebp - 0x238], esi
jne 0x10b187c
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b19c0
test byte [eax + 0x1c], 4
je 0x10b19c0
push 0x100ac18
push 0x1e
jmp 0x10b18ae
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
jge 0x10b18be
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b19c0
test byte [eax + 0x1c], 1
je 0x10b19c0
push 0x100ac18
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10b19c0
mov eax, dword [ebp - 0x238]
dec eax
cmp eax, esi
mov dword [ebp - 0x234], eax
jl 0x10b19c0
push 8
mov ebx, 0x100ac18
pop edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x234]
mov dword [ebp - 0x248], 0x10
push dword [ebp - 0x230]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
call dword [sym.imp.KERNEL32.dll_RegEnumValueW]
cmp eax, esi
jne 0x10b199d
cmp dword [ebp - 0x23c], edi
jne 0x10b196f
cmp dword [ebp - 0x24c], 0xb
jne 0x10b196f
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x250]
jg 0x10b198f
jl 0x10b195d
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x254]
ja 0x10b198f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10b198f
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b198f
test byte [eax + 0x1c], 2
je 0x10b198f
push ebx
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
dec dword [ebp - 0x234]
jns 0x10b18db
jmp 0x10b19c0
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b19c0
test byte [ecx + 0x1c], 1
je 0x10b19c0
push eax
push ebx
push 0x20
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010294b2
cmp dword [ebp - 0x230], esi
pop edi
pop esi
pop ebx
je 0x10b19d7
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010a0c4b
leave
ret 8