Function at 0x100ef2e
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x1028084]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push esi
mov dword [ebp - 0x70], eax
mov eax, dword [0x1029018]
cmp eax, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
je 0x100ef9b
test byte [eax + 0x1c], 0x20
je 0x100ef9b
cmp byte [eax + 0x19], 3
jb 0x100ef9b
push edi
mov esi, 0x10023e4
push esi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004409
jmp 0x100efa0
mov esi, 0x10023e4
push dword [ebp - 0x84]
lea eax, [ebp - 0x9c]
push eax
call fcn.01023557
test eax, eax
je 0x100efe5
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100efde
test word [eax + 0x1c], 0x820
je 0x100efde
cmp byte [eax + 0x19], 3
jb 0x100efde
push 0x57
push edi
push esi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
push 0x57
jmp 0x100f0a4
push edi
lea eax, [ebp - 0x94]
push eax
call fcn.01023557
test eax, eax
je 0x100f015
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100efde
test word [eax + 0x1c], 0x820
je 0x100efde
cmp byte [eax + 0x19], 3
jb 0x100efde
push 0x57
push edi
push esi
push 0x13
jmp 0x100efd3
push 0x18
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
push eax
call fcn.0101668e
test al, al
je 0x100f050
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100efde
test word [eax + 0x1c], 0x820
je 0x100efde
cmp byte [eax + 0x19], 3
jb 0x100efde
push 0x57
push dword [ebp - 0x7c]
push esi
push 0x14
jmp 0x100efd3
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0100b8fb
mov edi, eax
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100f096
test byte [eax + 0x1c], 0x20
je 0x100f096
cmp byte [eax + 0x19], 3
jb 0x100f096
push edi
push dword [ebp - 0x68]
push esi
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b411
cmp edi, ebx
jne 0x100f0aa
mov ecx, dword [ebp - 0x68]
call fcn.01005a65
push 0x50
pop eax
jmp 0x100f384
lea eax, [ebp - 0x6c]
push eax
push ebx
push 1
push dword [ebp - 0x84]
call fcn.0100e297
mov esi, eax
cmp esi, ebx
jne 0x100f343
cmp byte [ebp + 0x14], bl
je 0x100f15e
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x6c]
call fcn.0102457e
mov esi, eax
cmp esi, ebx
je 0x100f105
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100f150
test word [eax + 0x1c], 0x840
je 0x100f150
cmp byte [eax + 0x19], 1
jb 0x100f150
push esi
push 0x10023e4
push 0x16
jmp 0x100f145
push dword [ebp - 0x8c]
push 0x10000000
call fcn.010245de
push dword [ebp - 0x8c]
mov esi, eax
call fcn.01025796
cmp esi, ebx
je 0x100f15e
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100f150
test word [eax + 0x1c], 0x840
je 0x100f150
cmp byte [eax + 0x19], 1
jb 0x100f150
push esi
push 0x10023e4
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010174e5
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100f382
mov edi, dword [ebp - 0x7c]
push edi
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push dword [ebp - 0x70]
mov ecx, dword [ebp - 0x88]
push ebx
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0100e523
mov eax, dword [ebp - 0x84]
or byte [ebp - 0x38], 0x80
cmp eax, ebx
jne 0x100f19c
mov eax, 0x1001a1c
mov ecx, dword [ebp - 0x88]
push edi
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.0100e58b
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push 0x2001f
push ebx
push 0x1001a10
push ebx
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x100f33a
lea eax, [ebp - 0x70]
push eax
push 0xffff
push edi
mov dword [ebp - 0x70], ebx
call fcn.010239c1
mov esi, eax
cmp esi, ebx
jne 0x100f321
inc dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
add eax, eax
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push ebx
push dword [0x10280cc]
push dword [ebp - 0x74]
call edi
mov esi, eax
cmp esi, ebx
jne 0x100f321
mov eax, dword [ebp - 0x70]
add eax, eax
push eax
push dword [ebp - 0x7c]
push 1
push ebx
push dword [0x10280d4]
push dword [ebp - 0x74]
call edi
mov esi, eax
cmp esi, ebx
jne 0x100f321
mov edi, dword [ebp - 0x88]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, edi
call fcn.0100c619
mov esi, eax
cmp esi, ebx
jne 0x100f321
push dword [ebp - 0x80]
mov ecx, edi
push dword [ebp - 0x78]
push dword [0x1028220]
push ebx
push dword [ebp - 0x74]
call fcn.0100ecc1
push dword [ebp - 0x78]
mov ecx, edi
mov esi, eax
call fcn.0102247b
cmp esi, ebx
jne 0x100f321
mov eax, dword [edi]
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov esi, eax
cmp esi, ebx
jne 0x100f321
push dword [ebp - 0x80]
mov ecx, edi
push dword [ebp - 0x78]
push dword [0x1028228]
push ebx
push dword [ebp - 0x74]
call fcn.0100ecc1
push dword [ebp - 0x78]
mov ecx, edi
mov esi, eax
call fcn.0102247b
cmp esi, ebx
jne 0x100f321
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x94]
push eax
push eax
push dword [ebp - 0x7c]
mov ecx, edi
push dword [ebp - 0x84]
call fcn.0100ba95
mov esi, eax
cmp esi, ebx
jne 0x100f321
mov ecx, dword [ebp - 0x68]
call fcn.01018ba3
mov esi, eax
cmp esi, ebx
je 0x100f311
push 1
push dword [ebp - 0x68]
mov ecx, edi
call fcn.0100e4e9
jmp 0x100f319
mov ecx, dword [ebp - 0x68]
call fcn.0100e16c
mov ecx, dword [ebp - 0x68]
call fcn.01005a65
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x100f33a
push dword [ebp - 0x7c]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1029018]
cmp eax, ebx
je 0x100f382
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor edx, edx
dec ecx
inc edx
and ecx, 0x1f
shl edx, cl
or edx, 0x20
test dword [eax + 0x1c], edx
je 0x100f382
cmp byte [eax + 0x19], 3
jb 0x100f382
push esi
push dword [ebp - 0x7c]
push 0x10023e4
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005634
leave
ret 0x10