Function at 0x103e6ca
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x10723e4]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x2a0], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x103e738
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
jmp 0x103e94c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push esi
call ebx
test eax, eax
jne 0x103e757
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
jmp 0x103e94b
lea eax, [ebp - 0x294]
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov dword [ebp - 0x290], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x290], edi
jne 0x103e94b
push dword [ebp - 0x298]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x28c]
push 0x1014f00
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
lea eax, [ebp - 0x28c]
push 0x1014e78
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
lea eax, [ebp - 0x28c]
push 0x1014e38
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
lea eax, [ebp - 0x28c]
push 0x1014e10
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x294]
call edi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x103e891
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x29c]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x294]
call fcn.0103ddbd
cmp eax, esi
mov dword [ebp - 0x290], eax
jne 0x103e949
push dword [ebp - 0x2b0]
push dword [ebp - 0x29c]
push dword [ebp + 0xc]
push dword [ebp - 0x298]
push dword [ebp - 0x294]
push dword [ebp - 0x2a4]
call fcn.0103e46f
cmp eax, esi
mov dword [ebp - 0x290], eax
jne 0x103e949
push dword [ebp - 0x2a4]
call ebx
test eax, eax
jne 0x103e8ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
jmp 0x103e949
test byte [ebp + 0x14], 2
jne 0x103e8d2
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
add eax, 6
push eax
push esi
call dword [sym.imp.USER32.dll_UpdatePerUserSystemParameters]
test eax, eax
jne 0x103e8d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x103e93d
test byte [ebp + 0x14], 1
jne 0x103e8e7
call fcn.0103e0f2
cmp eax, esi
mov dword [ebp - 0x290], eax
jne 0x103e943
test byte [ebp + 0x14], 4
jne 0x103e943
lea eax, [ebp - 0x2a8]
push eax
push 0x101515c
push 0x17
push esi
push 0x101514c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jne 0x103e938
mov eax, dword [ebp - 0x2a8]
or word [ebp - 0x2b8], 0xffff
lea edx, [ebp - 0x2c0]
push edx
push 0x10150d4
mov word [ebp - 0x2c0], 0xb
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
cmp eax, esi
je 0x103e943
and eax, 0xffff
mov dword [ebp - 0x290], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor edi, edi
pop ebx
mov eax, dword [ebp - 0x2a8]
cmp eax, edi
je 0x103e95c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x29c], edi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x103e972
push dword [ebp - 0x29c]
call esi
cmp dword [ebp - 0x294], edi
je 0x103e986
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2a0], edi
je 0x103e996
push dword [ebp - 0x2a0]
call esi
cmp dword [ebp - 0x290], edi
je 0x103e9af
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x2a4]
call fcn.0103e4b2
cmp dword [ebp - 0x2ac], edi
pop edi
pop esi
je 0x103e9c2
cmp dword [ebp - 0x2ac], 1
jne 0x103e9c8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x290]
call fcn.0103d24a
leave
ret 0x10