Function at 0x100de4c
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x4c4
push ebx
lea eax, [ebp + 0x6c]
push eax
push 0x2000000
xor ebx, ebx
push ebx
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100dfda
test byte [ebp + 0x74], 0x10
push esi
push edi
jne 0x100e935
cmp dword [0x103e7fc], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x58], ebx
jne 0x100dfcf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x104
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp + 0x5c]
push eax
push 0
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x58]
mov dword [ebp + 0x50], 0x50
push dword [ebp + 0x6c]
mov dword [ebp + 0x54], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x100df53
test eax, eax
jne 0x100df63
cmp dword [ebp + 0x5c], 1
jne 0x100f922
cmp dword [ebp + 0x5c], 2
je 0x100f94e
cmp dword [0x103e7f8], 0
jne 0x100f931
push 0x618
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x100df53
push dword [ebp + 0x70]
push edi
call esi
lea eax, [ebp - 0x50]
push eax
lea eax, [edi + 0x208]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
lea eax, [edi + 0x410]
push eax
call esi
cmp dword [ebp + 0x60], 0
je 0x100e207
push edi
push 0x7fffffff
push dword [ebp + 0x60]
call dword [fcn.01016648]
inc dword [ebp + 0x58]
cmp dword [0x103e7fc], 0
je 0x100dea1
mov eax, dword [ebp + 0x60]
test eax, eax
je 0x100dfcd
mov eax, dword [eax]
and dword [ebp + 0x70], 0
test eax, eax
mov dword [ebp + 0x54], eax
jle 0x100dfc4
mov edi, dword [ebp + 0x74]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
and edi, 1
push dword [ebp + 0x70]
push dword [ebp + 0x60]
call dword [fcn.01016644]
test edi, edi
mov esi, eax
jne 0x101fe08
push dword [ebp + 0x7c]
lea eax, [esi + 0x410]
push dword [ebp + 0x74]
push eax
push esi
call dword [ebp + 0x78]
test edi, edi
jne 0x101fe23
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x54]
jl 0x100df83
push dword [ebp + 0x60]
call dword [0x1017e24]
xor ebx, ebx
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [0x103e7fc], ebx
jne 0x101fe3e
xor eax, eax
pop ebx
add ebp, 0x64
leave
ret 0x14
push 5
call dword [fcn.01016760]
test eax, eax
mov dword [ebp + 0x60], eax
jne 0x100df44
jmp 0x101fdfc
mov esi, dword [ebp + 0x74]
and esi, 0xffffffef
xor edi, edi
jmp 0x100e981
push 0x50
pop eax
push eax
mov dword [ebp + 0x50], eax
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0xea
je 0x100e980
cmp eax, ebx
jne 0x100dfcf
push dword [ebp + 0x7c]
lea eax, [ebp - 0x50]
push dword [ebp + 0x78]
push esi
push eax
push dword [ebp + 0x6c]
call fcn.0100de4c
test byte [ebp + 0x74], 1
jne 0x101fde1
inc edi
cmp dword [0x103e7fc], ebx
je 0x100e93f
jmp 0x100dfcf
cmp dword [ebp + 0x5c], 2
jne 0x100df53
jmp 0x100deed
cmp word [ebp - 0x50], 0x2a
jne 0x100df53
jmp 0x100df04
test eax, eax
jne 0x100dfb2
jmp 0x100df99
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call esi
push ebx
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
je 0x100df53
cmp eax, ebx
ja 0x100df53
jmp 0x100def7
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
test eax, eax
jne 0x100e980
dec edi
jmp 0x100e980
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100df53
lea eax, [esi + 0x208]
cmp word [eax], 0x21
je 0x100df99
push eax
push dword [ebp + 0x6c]
call ebx
jmp 0x100f941
lea eax, [esi + 0x208]
cmp word [eax], 0x21
jne 0x100dfb2
push eax
push dword [ebp + 0x6c]
call ebx
jmp 0x100dfb2
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]