Function at 0x100a68b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x103e010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push edi
mov word [ebp - 0x404], ax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x408]
push eax
xor esi, esi
push 0xf003f
push esi
push 0x1001a90
push 0x80000002
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x41c], esi
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x100a706
jle 0x100a6ff
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x100a94f
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push esi
push esi
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x100a767
jle 0x100a733
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a94f
test byte [eax + 0x1c], 1
je 0x100a94f
push edi
push 0x10017f0
push 0x5f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x100a94f
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x414], eax
cmp eax, esi
jbe 0x100a94d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
push esi
push esi
xor eax, eax
push esi
mov word [ebp - 0x204], ax
push esi
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x414]
dec eax
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x410], 0x100
call ebx
test eax, eax
jne 0x100a940
lea eax, [ebp - 0x40c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x100a810
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100a913
test byte [ecx + 0x1c], 1
je 0x100a913
push eax
lea eax, [ebp - 0x204]
push eax
push 0x10017f0
push 0x60
jmp 0x100a85c
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x100a86c
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100a913
test byte [ecx + 0x1c], 1
je 0x100a913
push eax
lea eax, [ebp - 0x204]
push eax
push 0x10017f0
push 0x61
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01018c98
jmp 0x100a913
mov edi, dword [ebp - 0x41c]
cmp edi, esi
jbe 0x100a913
push esi
push esi
xor eax, eax
push esi
mov word [ebp - 0x404], ax
push esi
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [edi - 1]
push eax
push dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x100
call ebx
cmp eax, esi
je 0x100a8df
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100a8f9
test byte [ecx + 0x1c], 1
je 0x100a8f9
push eax
lea eax, [ebp - 0x204]
push eax
push 0x10017f0
push 0x62
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01018c98
jmp 0x100a8f9
mov ecx, dword [ebp - 0x420]
push esi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100a3cd
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
dec edi
jne 0x100a87a
cmp dword [ebp - 0x40c], esi
je 0x100a940
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov dword [ebp - 0x40c], esi
dec dword [ebp - 0x414]
jne 0x100a782
pop ebx
xor edi, edi
cmp dword [ebp - 0x408], esi
je 0x100a963
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010084d5
leave
ret