Function at 0x100f398
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1029018]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov edi, 0x10023e4
je 0x100f3d8
test byte [eax + 0x1c], 0x20
je 0x100f3d8
cmp byte [eax + 0x19], 3
jb 0x100f3d8
push dword [ebp + 0xc]
push edi
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004409
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.01023557
test eax, eax
je 0x100f409
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100f443
test word [eax + 0x1c], 0x820
je 0x100f443
cmp byte [eax + 0x19], 3
jb 0x100f443
push 0x57
push dword [ebp + 0xc]
push edi
push 0x1a
jmp 0x100f438
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.01023557
test eax, eax
je 0x100f44b
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100f443
test word [eax + 0x1c], 0x820
je 0x100f443
cmp byte [eax + 0x19], 3
jb 0x100f443
push 0x57
push dword [ebp + 0xc]
push edi
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
push 0x57
pop eax
jmp 0x100f639
mov ecx, dword [ebp - 0xc]
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0100b8fb
mov edx, dword [0x1029018]
cmp edx, ebx
mov esi, eax
je 0x100f490
test byte [edx + 0x1c], 0x20
je 0x100f490
cmp byte [edx + 0x19], 3
jb 0x100f490
push esi
push dword [ebp - 4]
push edi
push 0x1c
push dword [edx + 0x14]
push dword [edx + 0x10]
call fcn.0100b411
mov edx, dword [0x1029018]
cmp esi, ebx
jne 0x100f5ee
cmp byte [ebp + 0x10], 0
je 0x100f4b5
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
push 0x10000
call dword [eax + 0x50]
mov esi, eax
cmp esi, ebx
jne 0x100f5e8
mov eax, dword [ebp - 4]
push dword [eax + 0x48]
call fcn.01006b5b
mov esi, eax
cmp esi, ebx
jne 0x100f5e8
mov eax, dword [ebp - 4]
or byte [eax + 0x55], 0x40
mov eax, dword [ebp - 4]
push dword [eax + 0x48]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x94]
cmp ecx, ebx
je 0x100f4f3
cmp word [ecx], bx
je 0x100f4f3
xor eax, eax
jmp 0x100f4f6
xor eax, eax
inc eax
dec eax
neg eax
sbb eax, eax
and eax, ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0
push 1
jne 0x100f529
push dword [0x10280a0]
push dword [ebp + 8]
call fcn.0100e195
mov esi, eax
test esi, esi
jne 0x100f5e8
push dword [0x10280a8]
jmp 0x100f53c
push dword [ebp + 8]
call fcn.0100e297
mov esi, eax
test esi, esi
jne 0x100f5e8
push ebx
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100f5e8
mov ecx, dword [ebp - 0xc]
push 1
push dword [ebp - 4]
call fcn.0100e4e9
mov edx, dword [0x1029018]
test edx, edx
je 0x100f5a4
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor ebx, ebx
dec ecx
inc ebx
and ecx, 0x1f
shl ebx, cl
or ebx, 0x20
test dword [edx + 0x1c], ebx
je 0x100f5a4
cmp byte [edx + 0x19], 3
jb 0x100f5a4
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
push 0x1d
push dword [edx + 0x14]
push dword [edx + 0x10]
call fcn.0100e6a5
mov ecx, dword [ebp - 4]
call fcn.01018ffa
mov edx, dword [0x1029018]
test edx, edx
je 0x100f5ee
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor ebx, ebx
dec ecx
inc ebx
and ecx, 0x1f
shl ebx, cl
or ebx, 0x20
test dword [edx + 0x1c], ebx
je 0x100f5ee
cmp byte [edx + 0x19], 3
jb 0x100f5ee
push eax
push dword [ebp + 0xc]
push edi
push 0x1e
push dword [edx + 0x14]
push dword [edx + 0x10]
call fcn.010091b7
mov edx, dword [0x1029018]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100f600
call fcn.01005a65
mov edx, dword [0x1029018]
test edx, edx
je 0x100f636
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor eax, eax
dec ecx
inc eax
and ecx, 0x1f
shl eax, cl
or eax, 0x20
test dword [edx + 0x1c], eax
je 0x100f636
cmp byte [edx + 0x19], 3
jb 0x100f636
push esi
push dword [ebp + 0xc]
push edi
push 0x1f
push dword [edx + 0x14]
push dword [edx + 0x10]
call fcn.010091b7
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 0xc