Function at 0x8fcac0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push 0x207
mov esi, ecx
lea ecx, [ebp - 0x317]
push ebx
push ecx
mov dword [ebp - 0x534], eax
mov byte [ebp - 0x318], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x51f]
push ebx
push edx
mov byte [ebp - 0x520], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
push esi
lea ecx, [ebp - 0x110]
push str._sSoftwareMicrosoftWindowsCurrentVersionRun
push ecx
call fcn.00a78f30
add esp, 0xc
cmp dword [ebp + 8], ebx
jne 0x8fcb6f
lea edx, [ebp - 0x524]
push edx
push 0xf003f
push ebx
lea eax, [ebp - 0x110]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x8fcbb6
call fcn.00968110
test eax, eax
jne 0x8fcb99
lea ecx, [ebp - 0x524]
push ecx
push 0xf003f
push ebx
lea edx, [ebp - 0x110]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x8fcbb6
lea eax, [ebp - 0x524]
push eax
push 0xf013f
lea ecx, [ebp - 0x110]
push ecx
push 0x80000003
call fcn.0097eda0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8fcdc1
mov eax, 0x208
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x530], eax
lea edx, [ebp - 0x530]
push edx
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x538]
push ecx
mov ecx, dword [ebp - 0x524]
push ebx
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x318]
push eax
push ebx
push ecx
mov dword [ebp - 0x528], ebx
xor edi, edi
mov byte [ebp - 0x520], bl
mov byte [ebp - 0x318], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x8fcdb4
jmp 0x8fcc30
cmp byte [ebp - 0x520], bl
je 0x8fcd4f
test byte [0xc0ea64], 1
jne 0x8fcc60
or dword [0xc0ea64], 1
mov eax, str.F119BFAB_D0C9_4E62_9DCF_7923777499B1
inc eax
cmp byte [eax], bl
jne 0x8fcc51
sub eax, str.F119BFAB_D0C9_4E62_9DCF_7923777499B1
mov dword [0xc0ea60], eax
push ebx
lea edx, [ebp - 0x520]
push str.powershell
push edx
call fcn.0095c8c0
add esp, 0xc
cmp byte [ebp - 0x318], 0x7b
mov esi, eax
jne 0x8fcc9b
lea eax, [ebp - 0x318]
inc eax
cmp byte [eax], bl
jne 0x8fcc86
lea ecx, [ebp - 0x318]
sub eax, ecx
cmp eax, dword [0xc0ea60]
je 0x8fccba
cmp esi, 0xffffffff
je 0x8fccbf
push ebx
lea edx, [ebp - 0x520]
push str.bypass
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fccbf
mov edi, 1
mov eax, dword [ebp - 0x534]
cmp eax, ebx
je 0x8fccd4
cmp esi, 0xffffffff
je 0x8fccd4
mov dword [eax], 1
cmp edi, ebx
je 0x8fcd4f
mov ecx, dword [ebp - 0x524]
lea eax, [ebp - 0x318]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x8fcd26
inc dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x520]
push edx
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x110]
push ecx
push str._Locky__Failed_to_Delete_in__s:___s___s_._Error:_u
push 0xb54ce8
call fcn.0096a780
add esp, 0x18
jmp 0x8fcd55
lea edx, [ebp - 0x520]
push edx
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x110]
push ecx
push str._Locky__Deleted_in__s:___s___s_
push 0xb54ce8
call fcn.0096a780
add esp, 0x14
jmp 0x8fcd55
inc dword [ebp - 0x528]
mov eax, 0x208
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x530], eax
lea edx, [ebp - 0x530]
push edx
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x538]
push ecx
mov ecx, dword [ebp - 0x528]
push ebx
lea edx, [ebp - 0x52c]
push edx
mov edx, dword [ebp - 0x524]
lea eax, [ebp - 0x318]
push eax
push ecx
push edx
xor edi, edi
mov byte [ebp - 0x520], bl
mov byte [ebp - 0x318], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x8fcc30
mov eax, dword [ebp - 0x524]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret