Function at 0x100d6be
Capabilities:
Delete registry value
Query or enumerate registry value
Terminate process

Disassembly:
mov dword [ebp + 0x58], edi
jmp 0x100d854
push 5
call dword [fcn.0101b028]
test eax, eax
mov dword [ebp + 0x6c], eax
je 0x1011fb9
jmp 0x100d7b5
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x4c8
push edi
lea eax, [ebp + 0x60]
push eax
push 0x2000000
xor edi, edi
push edi
push dword [ebp + 0x70]
mov dword [ebp + 0x58], 1
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d5c3
cmp dword [0x103f7d0], edi
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x54], edi
jne 0x100d84b
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x104
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp + 0x50]
push eax
push edi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x54]
mov dword [ebp + 0x4c], 0x50
push dword [ebp + 0x60]
mov dword [ebp + 0x5c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x100d7cf
cmp eax, edi
jne 0x100d86b
cmp dword [ebp + 0x50], 1
jne 0x1011f9a
cmp dword [ebp + 0x50], 2
je 0x1011fd2
cmp dword [0x103f7d4], edi
jne 0x1011fa9
push 0x618
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x100d7cd
push dword [ebp + 0x70]
push edi
call esi
lea eax, [ebp - 0x54]
push eax
lea eax, [edi + 0x208]
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [edi + 0x410]
push eax
call esi
cmp dword [ebp + 0x6c], 0
je 0x100d5d3
push edi
push 0x7fffffff
push dword [ebp + 0x6c]
call dword [fcn.0101af40]
cmp eax, 0xffffffff
je 0x1011fb9
xor edi, edi
inc dword [ebp + 0x54]
cmp dword [0x103f7d0], edi
je 0x100d710
mov eax, dword [ebp + 0x6c]
cmp eax, edi
je 0x100d849
mov eax, dword [eax]
cmp eax, edi
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x70], edi
jle 0x100d840
mov edi, dword [ebp + 0x74]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
and edi, 1
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call dword [fcn.0101af24]
test edi, edi
mov esi, eax
jne 0x102020a
push dword [ebp + 0x7c]
lea eax, [esi + 0x410]
push dword [ebp + 0x74]
push eax
push esi
call dword [ebp + 0x78]
test edi, edi
jne 0x1020225
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x5c]
jl 0x100d7fd
xor edi, edi
push dword [ebp + 0x6c]
call dword [0x101b590]
pop esi
pop ebx
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x103f7d0], edi
jne 0x1020240
mov eax, dword [ebp + 0x58]
pop edi
add ebp, 0x64
leave
ret 0x14
cmp eax, 0x103
je 0x100d7de
jmp 0x1020202
cmp dword [ebp + 0x50], 2
jne 0x100d7cf
jmp 0x100d75f
cmp word [ebp - 0x54], 0x2a
jne 0x100d7cf
jmp 0x100d775
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100d7cd
test eax, eax
jne 0x100d82c
jmp 0x100d813
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call esi
push ebx
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
cmp eax, edi
je 0x100d7cf
cmp eax, ebx
ja 0x100d7cf
jmp 0x100d769
mov dword [ebp + 0x58], edi
jmp 0x100d7de
lea eax, [esi + 0x208]
cmp word [eax], 0x21
je 0x100d813
push eax
push dword [ebp + 0x60]
call ebx
jmp 0x1011fc5
lea eax, [esi + 0x208]
cmp word [eax], 0x21
jne 0x100d82c
push eax
push dword [ebp + 0x60]
call ebx
jmp 0x100d82c
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]