Function at 0x100c1a3
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1016f41
call fcn.0100af48
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0x8007000e
jne 0x100c1d0
mov dword [ebp - 0x14], 0x80070057
jmp 0x100c3b7
mov eax, 0x1001658
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], eax
push dword [0x101f7f4]
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventW]
push edi
push 2
mov byte [ebp - 4], 1
call esi
push dword [0x101f7f8]
mov dword [ebp - 0x28], eax
push edi
push 0x100000
call esi
cmp dword [ebp - 0x28], edi
mov dword [ebp - 0x30], eax
je 0x100c22a
cmp eax, edi
je 0x100c22a
push dword [ebp - 0x28]
xor esi, esi
inc esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, esi
jne 0x100c3a0
cmp dword [ebp + 0xc], edi
mov dword [ebp + 0xc], edi
je 0x100c323
push 0x10002
push dword [0x101f860]
lea ecx, [ebp + 0xc]
push 0x80000002
mov byte [ebp - 4], 2
call fcn.0100b21c
test eax, eax
jne 0x100c27f
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1001570
push ebx
call esi
push 0x1001558
push ebx
call esi
push 0x100153c
push ebx
call esi
push 0x1001528
push ebx
call esi
lea ecx, [ebp + 0xc]
call fcn.0100b1a9
call fcn.0100b4a0
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x24], ebx
je 0x100c319
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 3
call esi
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call esi
mov ecx, dword [ebp - 0x1c]
add ecx, eax
lea eax, [ecx + ecx + 0x10]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, edi
pop ecx
je 0x100c310
push dword [ebp + 8]
push ebx
push 0x10021c4
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 1
push esi
call dword [sym.imp.loadperf.dll_LoadPerfCounterTextStringsW]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x100c305
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100c305
cmp esi, edi
je 0x100c310
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp + 0xc]
call fcn.0100b1a9
jmp 0x100c389
push dword [ebp + 8]
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 8]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, edi
pop ecx
je 0x100c389
push dword [ebp + 8]
push 0x10021b8
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 1
push esi
call dword [sym.imp.loadperf.dll_UnloadPerfCounterTextStringsW]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x100c37e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100c37e
cmp esi, edi
je 0x100c389
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x18], edi
je 0x100c3a7
push 0xbb8
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100c3a7
mov dword [ebp - 0x14], 0x80004005
lea ecx, [ebp - 0x34]
call fcn.01006652
lea ecx, [ebp - 0x2c]
call fcn.01006652
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8