Function at 0x1000c19b
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x100563b4
call fcn.10055910
sub esp, 0x94
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4c], edx
je 0x1000c629
push 3
lea ecx, [ebp - 0x44]
call fcn.100018bd
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1000c1e3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000c1d2
lea eax, [ebp - 0x20]
xor dl, dl
push eax
lea ecx, [ebp - 0x44]
call fcn.1000b77e
mov eax, dword [ebp - 0x44]
pop ecx
mov dword [eax + 4], 2
jmp 0x1000c211
mov eax, dword [ecx]
cmp dword [ebp + eax*4 - 0x94], ebx
jne 0x1000c21b
dec dword [ecx]
mov ecx, dword [ebp - 0x44]
add ecx, 4
cmp dword [ecx], ebx
jge 0x1000c204
lea ecx, [ebp - 0x44]
call fcn.10001940
xor eax, eax
mov dword [ebp - 0x64], 7
mov dword [ebp - 0x68], ebx
mov word [ebp - 0x78], ax
xor esi, esi
lea ecx, [ebp - 0x78]
inc esi
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
call fcn.100063b2
mov dword [ebp - 0x14], ebx
jmp 0x1000c256
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000c249
push 0x6cb1
xor dl, dl
mov ecx, 0x383
call fcn.1000b4cf
pop ecx
push esi
push ecx
mov ecx, 0x7490
call fcn.1000b0dc
mov eax, dword [0x1007436c]
pop ecx
pop ecx
test al, 1
jne 0x1000c2a5
or eax, esi
mov dword [0x1007436c], eax
push 0x4a04
mov byte [ebp - 4], 2
call fcn.1002f891
pop ecx
mov word [0x10072fc0], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0x202f
cmp dword [ebp - 0x14], 0x222c
jle 0x1000c2e6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc edi
cmp edi, 0x2e4d
jl 0x1000c2c1
inc esi
cmp esi, 0x3f1
jl 0x1000c2bf
push 3
lea ecx, [ebp - 0x84]
call fcn.100018bd
mov byte [ebp - 4], 3
mov dword [ebp - 0x50], 0xfffffff8
mov dword [ebp - 0x18], 0x56cc
cmp dword [ebp - 0x18], 0x59be
jle 0x1000c33b
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc edi
cmp edi, 0x8063
jl 0x1000c319
inc esi
cmp esi, 0x3983
jl 0x1000c317
mov dword [ebp - 0x1c], 0x696a485b
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0x563a
jge 0x1000c37c
mov edx, str.snkzyzwii_ktoljway_wpvcbll_ebsx_wwwtous_spmfrnbl_xcna_zjpomaex_pka_kkdkkzvt_xrjqhash_kgcabfcwi_hjqjcczcc_ldd
mov ecx, 0x10071e38
call fcn.10005f73
jmp 0x1000c37c
push ecx
lea eax, [ebp - 0x84]
mov dword [ebp - 4], 3
push eax
push 1
lea ecx, [ebp - 0x88]
call fcn.1000affa
add esp, 0xc
lea edx, [ebp - 0x50]
xor cl, cl
call fcn.1000c13e
lea ecx, [ebp - 0x84]
call fcn.10001940
mov byte [ebp - 4], 6
cmp dword [ebp - 0x14], 0x1fe9
jge 0x1000c3cc
mov edx, str.vypwipwsf_rucuhove_gekfxbok_ltygcipl_dkbehtt_agwn_opeco_sqbtmnirc_icxaexy_wfitcje_ddfnsx
mov ecx, 0x10071e38
call fcn.10005f73
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov eax, dword [0x1007436c]
test al, 2
jne 0x1000c3fe
or eax, 2
mov dword [0x1007436c], eax
push 0xe1e
mov byte [ebp - 4], 8
call fcn.1002f891
pop ecx
xor ecx, ecx
mov word [0x10072fc4], ax
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x14], 0x32bb
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], 0xf4da
mov dword [ebp - 0x18], ebx
jmp 0x1000c44d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000c443
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
neg eax
je 0x1000c461
cmp dword [ebp - 0x14], ebx
jne 0x1000c463
mov ecx, ebx
cmp ecx, dword [ebp - 0x14]
je 0x1000c46b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
je 0x1000c476
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, 0xfff7
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x14], eax
jl 0x1000c49e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], ebx
call fcn.1000b5c8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000c525
call fcn.1000afe3
push 0x34
pop ecx
xor edx, edx
mov dword [ebp - 0x1c], 0xcf5
div ecx
push 0x53e1
push 0x7475
push 0x6ff4
push 0x15a9
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x2d], bl
mov edi, edx
call fcn.1000b558
push 0x2396
push ebx
mov edx, 0x271f
xor cl, cl
call fcn.1000c19b
add esp, 0x18
push 0x1a
pop ecx
cmp edi, ecx
jge 0x1000c50b
movzx edx, word [0x10072fc0]
add edx, edi
jmp 0x1000c519
mov eax, edi
cdq
idiv ecx
movzx eax, word [0x10072fc4]
add edx, eax
push edx
lea ecx, [ebp - 0x78]
call fcn.1000cbee
dec esi
jne 0x1000c4b0
mov dword [ebp - 0x2c], 0xffffffff
xor eax, eax
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x2c], ebx
je 0x1000c55d
mov dword [ebp - 0x2c], ebx
jmp 0x1000c555
mov byte [ebp - 0x25], bl
lea edx, [ebp - 0x25]
xor cl, cl
call fcn.1000b72e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xc
jle 0x1000c545
jmp 0x1000c597
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], ebx
push eax
push ecx
mov dword [ebp - 0x24], 0x34678dc2
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x34]
call fcn.1000b12c
add esp, 0xc
mov dword [ebp - 0x24], ebx
jmp 0x1000c591
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x60], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1000c580
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x78]
cmp ecx, eax
je 0x1000c5aa
push 0xffffffffffffffff
push ebx
push eax
call fcn.1000426d
mov dword [ebp - 0x1c], 0xc6d
cmp dword [ebp - 0x1c], 0xcea
jle 0x1000c61c
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov eax, esi
mov dword [ebp - 0x18], 0x1796
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], ebx
mov ecx, eax
mov ebx, edi
mov edi, dword [ebp - 0x34]
sar ebx, cl
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc edi
cmp edi, 0x2562
jl 0x1000c5d9
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
dec eax
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x1c], eax
pop ebx
jne 0x1000c5cd
inc esi
cmp esi, 0x29e6
jl 0x1000c5c1
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x39de
jl 0x1000c5bf
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.10004734
jmp 0x1000c63e
mov byte [ebp - 0x2e], 0
cmp byte [ebp - 0x2e], 0
je 0x1000c63e
push 0xb2d
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret