Function at 0x1009a49
Capabilities:
Delete registry value
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x4c8
push edi
lea eax, [ebp + 0x60]
push eax
push 0x2000000
xor edi, edi
push edi
push dword [ebp + 0x70]
mov dword [ebp + 0x58], 1
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1009c51
cmp dword [0x103d78c], edi
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x54], edi
jne 0x1009c46
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x104
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp + 0x50]
push eax
push edi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x54]
mov dword [ebp + 0x4c], 0x50
push dword [ebp + 0x60]
mov dword [ebp + 0x5c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x1009b9a
cmp eax, edi
jne 0x1009bab
cmp dword [ebp + 0x50], 1
je 0x1009af0
cmp dword [ebp + 0x50], 2
jne 0x1009b9a
cmp dword [ebp + 0x50], 2
jne 0x1009b23
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call esi
push ebx
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
cmp eax, edi
je 0x1009b9a
cmp eax, ebx
ja 0x1009b9a
cmp dword [0x103d7d0], edi
je 0x1009b32
cmp word [ebp - 0x54], 0x2a
jne 0x1009b9a
push 0x618
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x1009b98
push dword [ebp + 0x70]
push edi
call esi
lea eax, [ebp - 0x54]
push eax
lea eax, [edi + 0x208]
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [edi + 0x410]
push eax
call esi
cmp dword [ebp + 0x6c], 0
jne 0x1009b7d
push 5
call dword [fcn.01008698]
test eax, eax
mov dword [ebp + 0x6c], eax
je 0x1009b91
push edi
push SysReAllocString
push dword [ebp + 0x6c]
call dword [fcn.01008694]
cmp eax, 0xffffffff
jne 0x1009b98
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
inc dword [ebp + 0x54]
cmp dword [0x103d78c], edi
je 0x1009a9b
jmp 0x1009bb5
cmp eax, 0x103
je 0x1009bb5
mov dword [ebp + 0x58], edi
mov eax, dword [ebp + 0x6c]
cmp eax, edi
je 0x1009c44
mov eax, dword [eax]
cmp eax, edi
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x70], edi
jle 0x1009c3b
mov edi, dword [ebp + 0x74]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
and edi, 1
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call dword [fcn.01008690]
test edi, edi
mov esi, eax
je 0x1009c00
lea eax, [esi + 0x208]
cmp word [eax], 0x21
je 0x1009c00
push eax
push dword [ebp + 0x60]
call ebx
test eax, eax
jne 0x1009c27
push dword [ebp + 0x7c]
lea eax, [esi + 0x410]
push dword [ebp + 0x74]
push eax
push esi
call dword [ebp + 0x78]
test edi, edi
je 0x1009c27
lea eax, [esi + 0x208]
cmp word [eax], 0x21
jne 0x1009c27
push eax
push dword [ebp + 0x60]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x5c]
jl 0x1009bd8
xor edi, edi
push dword [ebp + 0x6c]
call dword [0x100868c]
pop esi
pop ebx
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1009c54
mov dword [ebp + 0x58], edi
cmp dword [0x103d78c], edi
je 0x1009c63
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x58]
pop edi
add ebp, 0x64
leave
ret 0x14