Function at 0x103f958
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x107342c]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x2a0], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x103f9c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
jmp 0x103fbda
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push esi
call ebx
test eax, eax
jne 0x103f9e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
jmp 0x103fbd9
lea eax, [ebp - 0x294]
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov dword [ebp - 0x290], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x290], edi
jne 0x103fbd9
push dword [ebp - 0x298]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x28c]
push 0x1015270
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
lea eax, [ebp - 0x28c]
push 0x10151e8
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
lea eax, [ebp - 0x28c]
push 0x10151a8
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
lea eax, [ebp - 0x28c]
push 0x1015180
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x103fb1f
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x29c]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x294]
call fcn.0103f04b
cmp eax, esi
mov dword [ebp - 0x290], eax
jne 0x103fbd7
push dword [ebp - 0x2b0]
push dword [ebp - 0x29c]
push dword [ebp + 0xc]
push dword [ebp - 0x298]
push dword [ebp - 0x294]
push dword [ebp - 0x2a4]
call fcn.0103f6fd
cmp eax, esi
mov dword [ebp - 0x290], eax
jne 0x103fbd7
push dword [ebp - 0x2a4]
call ebx
test eax, eax
jne 0x103fb3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
jmp 0x103fbd7
test byte [ebp + 0x14], 2
jne 0x103fb60
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
add eax, 6
push eax
push esi
call dword [sym.imp.USER32.dll_UpdatePerUserSystemParameters]
test eax, eax
jne 0x103fb60
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x103fbcb
test byte [ebp + 0x14], 1
jne 0x103fb75
call fcn.0103f380
cmp eax, esi
mov dword [ebp - 0x290], eax
jne 0x103fbd1
test byte [ebp + 0x14], 4
jne 0x103fbd1
lea eax, [ebp - 0x2a8]
push eax
push 0x10154cc
push 0x17
push esi
push 0x10154bc
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jne 0x103fbc6
mov eax, dword [ebp - 0x2a8]
or word [ebp - 0x2b8], 0xffff
lea edx, [ebp - 0x2c0]
push edx
push 0x1015444
mov word [ebp - 0x2c0], 0xb
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
cmp eax, esi
je 0x103fbd1
and eax, 0xffff
mov dword [ebp - 0x290], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor edi, edi
pop ebx
mov eax, dword [ebp - 0x2a8]
cmp eax, edi
je 0x103fbea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x29c], edi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x103fc00
push dword [ebp - 0x29c]
call esi
cmp dword [ebp - 0x294], edi
je 0x103fc14
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2a0], edi
je 0x103fc24
push dword [ebp - 0x2a0]
call esi
cmp dword [ebp - 0x290], edi
je 0x103fc3d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x2a4]
call fcn.0103f740
cmp dword [ebp - 0x2ac], edi
pop edi
pop esi
je 0x103fc50
cmp dword [ebp - 0x2ac], 1
jne 0x103fc56
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x290]
call fcn.0103e4d8
leave
ret 0x10