Function at 0x100b11b
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6fc
mov eax, dword [0x1017048]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x6f4], eax
jne 0x100b148
mov eax, 0x1001ac0
push eax
push 0x1004398
call fcn.0100f591
lea eax, [ebp - 0x6b5]
push eax
lea eax, [ebp - 0x6bc]
push eax
mov al, byte [0x1018811]
neg al
mov ebx, 0x80000002
mov dword [ebp - 0x6ec], edi
mov dword [ebp - 0x6c0], edi
mov dword [ebp - 0x6c8], edi
mov dword [ebp - 0x6bc], edi
mov byte [ebp - 0x6b6], 0
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push esi
push 0x1001df4
push ebx
call fcn.010093d6
add esp, 0x20
test al, al
je 0x100b247
cmp byte [0x1018811], 0
push 0x1a
pop ecx
mov esi, 0x1004328
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6b5]
push eax
lea eax, [ebp - 0x6c0]
push eax
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xc0]
je 0x100b22f
push 0xf013f
push eax
push 0x1001df4
push ebx
call fcn.010093d6
mov byte [ebp - 0x6b7], al
lea eax, [ebp - 0x6b5]
push eax
lea eax, [ebp - 0x6c8]
push eax
push 0xf023f
lea eax, [ebp - 0xc0]
push eax
push 0x1004314
push ebx
call fcn.010093d6
add esp, 0x30
cmp byte [ebp - 0x6b7], 0
jne 0x100b280
test al, al
jne 0x100b280
xor bl, bl
jmp 0x100b24d
push 0xf003f
push eax
push 0x1001df4
push ebx
call fcn.010093d6
add esp, 0x18
test al, al
jne 0x100b280
mov bl, byte [ebp - 0x6b5]
lea ecx, [ebp - 0x6bc]
call fcn.01008676
lea ecx, [ebp - 0x6c8]
call fcn.01008676
lea ecx, [ebp - 0x6c0]
call fcn.01008676
lea ecx, [ebp - 0x6ec]
call fcn.01008676
mov al, bl
jmp 0x100b616
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6d4]
push eax
lea eax, [ebp - 0x6b4]
push eax
mov dword [ebp - 0x6e0], 0x20a
mov dword [ebp - 0x6d0], 0x28
mov dword [ebp - 0x6cc], esi
mov dword [ebp - 0x6dc], esi
push esi
jmp 0x100b5b7
mov edi, dword [ebp - 0x6bc]
call fcn.01008658
push eax
push 0x20019
push esi
lea eax, [ebp - 0x6b4]
push eax
push edi
call fcn.01008692
add esp, 0x14
cmp eax, esi
jne 0x100b57d
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x6f0]
push eax
push esi
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x6e4], esi
push esi
jmp 0x100b553
inc dword [ebp - 0x6e4]
cmp dword [ebp - 0x6f4], esi
je 0x100b337
push dword [ebp - 0x6f4]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100b518
cmp word [ebp - 0x2cc], si
je 0x100b518
cmp word [ebp - 0x2ca], 0x3f
jne 0x100b518
cmp byte [0x1018811], 0
mov word [ebp - 0x2ca], 0x3a
mov dword [ebp - 0x6e8], esi
je 0x100b3bc
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.0100877f
cmp eax, 1
pop ecx
pop ecx
mov dword [ebp - 0x6e8], eax
jne 0x100b3a1
cmp dword [ebp - 0x6fc], esi
jne 0x100b3a1
lea eax, [ebp - 0x2cc]
push esi
push eax
call fcn.0100a430
pop ecx
pop ecx
cmp byte [0x1018811], 0
je 0x100b3bc
cmp dword [ebp - 0x6e8], esi
mov dword [ebp - 0x6d8], 2
je 0x100b3c6
mov dword [ebp - 0x6d8], 1
xor ebx, ebx
cmp dword [ebp - 0x6d8], esi
jle 0x100b518
cmp byte [0x1018811], 0
je 0x100b3f2
cmp ebx, esi
je 0x100b3ea
cmp dword [ebp - 0x6e8], 1
jne 0x100b3f2
mov edi, dword [ebp - 0x6c8]
jmp 0x100b3f8
mov edi, dword [ebp - 0x6c0]
cmp edi, esi
je 0x100b50b
lea eax, [ebp - 0x6f8]
push eax
lea eax, [ebp - 0x6c4]
push eax
lea eax, [ebp - 0x6f0]
push eax
push esi
lea eax, [ebp - 0x2cc]
push eax
push edi
mov dword [ebp - 0x6f8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100b4e7
cmp dword [ebp - 0x6c4], 1
jne 0x100b485
lea eax, [ebp - 0x2cc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x100b470
lea eax, [ebp - 0x2cc]
push eax
push 0x10042d0
mov byte [0x101881c], 1
call fcn.0100f591
pop ecx
pop ecx
jmp 0x100b50b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0x1004240
jmp 0x100b4e0
push dword [ebp - 0x6f8]
dec dword [ebp - 0x6c4]
lea eax, [ebp - 0x6c4]
push eax
push 4
push esi
lea eax, [ebp - 0x2cc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100b4cd
lea eax, [ebp - 0x2cc]
push eax
push dword [ebp - 0x6c4]
push 0x10041e8
call fcn.0100f591
mov byte [0x101881c], 1
jmp 0x100b508
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0x1004150
call fcn.0100f591
jmp 0x100b508
cmp eax, 2
je 0x100b50b
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x10040d8
call fcn.0100f591
mov byte [ebp - 0x6b6], 1
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x6d8]
jl 0x100b3d4
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x6f0]
push eax
push esi
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x6e4]
mov dword [ebp - 0x6d0], 0x28
mov dword [ebp - 0x6e0], 0x20a
push dword [ebp - 0x6cc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
je 0x100b311
cmp eax, 0x103
je 0x100b599
push eax
lea eax, [ebp - 0x6b4]
push eax
push 0x1004060
jmp 0x100b58a
push eax
lea eax, [ebp - 0x6b4]
push eax
push 0x1003ff8
call fcn.0100f591
add esp, 0xc
mov byte [ebp - 0x6b6], 1
inc dword [ebp - 0x6dc]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6d4]
push eax
lea eax, [ebp - 0x6b4]
push eax
push dword [ebp - 0x6dc]
push dword [ebp - 0x6bc]
mov dword [ebp - 0x6d4], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
lea ecx, [ebp - 0x6cc]
je 0x100b2ba
call fcn.01008676
lea ecx, [ebp - 0x6bc]
call fcn.01008676
lea ecx, [ebp - 0x6c8]
call fcn.01008676
lea ecx, [ebp - 0x6c0]
call fcn.01008676
lea ecx, [ebp - 0x6ec]
call fcn.01008676
cmp byte [ebp - 0x6b6], 0
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100f0dc
leave
ret