Function at 0xa95a10
Capabilities:
Delete registry value

Disassembly:
push 0xf0
mov eax, 0xafeb3b
call fcn.00af8e2b
mov edi, dword [ebp + 8]
test byte [edi + 0x6c], 0x80
je 0xb3d2aa
push 0x9f291c
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov esi, 0x9d3fb4
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xe0], 0x9d3fb4
mov dword [ebp - 4], edi
cmp dword [ebp - 0xdc], edi
setne bl
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0xb3d268
js 0xa95a7b
mov eax, 0x80004005
mov ecx, dword [ebp + 4]
test bl, bl
je 0xb3d277
mov eax, dword [ebp - 0xdc]
xor ebx, ebx
mov dword [ebp - 0xe4], eax
inc ebx
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xe4]
push eax
push ebx
push 0xffffffffffffffff
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoWaitForMultipleHandles]
mov esi, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0x9d3fb4
call fcn.00a95ad5
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00af8dd5
ret 8
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xa95a74
push eax
push 0x9f6984
mov edx, 0x855
call fcn.00ab606d
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xe0], esi
call fcn.00a95ad5
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0xa95acd
push ecx
push 0x9f2b88
lea ecx, [ebp - 0xd0]
call fcn.00a7d3fc
mov dword [ebp - 0xd0], 0x9d403c
lea eax, [edi + 0x104]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0xd0]
call fcn.00a9859a
lea ecx, [ebp - 0xd0]
call fcn.00a7d7c2
call fcn.00a93f45
test dword [edi + 0x68], 0x4000
mov esi, eax
je 0xb3d302
lea ecx, [esi - 0xd]
neg ecx
sbb ecx, ecx
and esi, ecx
lea eax, [ebp - 0xf8]
mov ebx, reloc.SHCORE.dll_Ordinal_1
push eax
push 0x9f2b54
mov edx, 0x9f2ad8
mov ecx, ebx
call fcn.00a7d8ab
test eax, eax
jns 0xb3d370
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
push ecx
push 8
lea eax, [ebp - 0xf8]
mov edx, 0x9f2ad8
push eax
push 3
push 0x9f2b54
mov ecx, ebx
call fcn.00b6073b
test eax, eax
jle 0xb3d359
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb3d370
push eax
push 0x9f6984
mov edx, 0x7f8
call fcn.00ab606d
xor ebx, ebx
mov dword [ebp - 0xd4], 0xc
inc ebx
push 4
pop ecx
cmp esi, 0xd
jae 0xb3d40e
mov eax, esi
mov dword [ebp - 0xd4], 0x4c
sub eax, ecx
je 0xb3d3de
sub eax, ebx
je 0xb3d3bd
sub eax, ebx
jne 0xb3d438
mov dword [ebp - 0xd4], 0x44c
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], ebx
jmp 0xb3d3d3
mov dword [ebp - 0xd4], 0x24c
lea eax, [ebp - 0xec]
mov dword [ebp - 0xec], ebx
push ecx
push ecx
push eax
push ecx
push 0x9f2a28
jmp 0xb3d3fd
push ecx
push ecx
lea eax, [ebp - 0xf0]
mov dword [ebp - 0xd4], 0x6c
push eax
push ecx
mov dword [ebp - 0xf0], ebx
push 0x9f2a80
mov edx, 0x9f05b0
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00b6073b
jmp 0xb3d438
push 0x9f2a80
push 0x9f05b0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
push 0x9f2a28
push 0x9f05b0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
test byte [edi + 0x68], 2
je 0xb3d448
cmp esi, 0xb
ja 0xb3d448
call fcn.00c4da96
xor edi, edi
mov dword [ebp - 0xd8], edi
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 4
call fcn.00a39d42
lea eax, [ebp - 0xd8]
push eax
push 0x9f43c8
push 3
push edi
push 0x9f02cc
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov ecx, dword [ebp + 4]
mov esi, eax
test esi, esi
jns 0xb3d489
mov edx, 0x826
jmp 0xb3d4b3
mov eax, dword [ebp - 0xd8]
push dword [ebp - 0xd4]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp + 4]
mov esi, eax
test esi, esi
jns 0xb3d4be
mov edx, 0x829
push esi
push 0x9f6984
call fcn.00ab606d
push esi
lea ecx, [ebp - 0xd0]
call fcn.00a968d4
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 3
call fcn.00a39d42
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], 0x9d403c
call fcn.00a7d880
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0xb3d519
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0xb3d516
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0xb3d516
push ecx
call fcn.00c19973
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.00a48c27
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 6
call fcn.00a7d7ad
cmp dword [ebp - 0xb4], ebx
jne 0xb3d559
mov dword [ebp - 0xb4], 2
call fcn.00a7d820
lea edx, [ebp - 0xac]
mov ecx, dword [eax + 4]
call fcn.00b5d2a9
mov dword [ebp - 0xb4], 3
mov byte [ebp - 4], 5
cmp dword [ebp - 0xc0], 0
je 0xa95ac7
lea ecx, [ebp - 0xcc]
call fcn.00a59db6
jmp 0xa95ac7