Function at 0x101a6310
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push 0x2001f
mov dword [ebp - 0x83c], ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x838], ecx
lea ecx, [ebp - 0x81c]
push edx
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0xffffffff
call fcn.10058810
test eax, eax
jne 0x101a692c
xor esi, esi
mov dword [ebp - 0x808], 0x400
push ebx
mov ebx, dword [ebp - 0x81c]
push edi
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x828], esi
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x820], esi
jmp 0x101a63b0
mov eax, dword [ebp - 0x814]
cmp eax, 0xffffffff
je 0x101a641e
cmp esi, eax
jb 0x101a641e
test ebx, ebx
je 0x101a641e
mov edi, esi
sub edi, eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a63dd
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a640a
lea ecx, [ebp - 0x808]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push edi
push ebx
call eax
jmp 0x101a652d
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push edi
jmp 0x101a6526
cmp dword [ebp - 0x818], 0
mov edi, 0x103
mov dword [ebp - 0x814], 0xffffffff
je 0x101a64c1
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a6450
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a6485
lea ecx, [ebp - 0x808]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0x830]
mov ecx, dword [ebp - 0x818]
push ecx
call eax
jmp 0x101a64a6
mov ecx, dword [ebp - 0x818]
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x830]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test esi, esi
je 0x101a64b3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x103
jne 0x101a653a
mov esi, dword [ebp - 0x830]
test ebx, ebx
je 0x101a653a
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x808], 0x400
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a64eb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a6516
lea ecx, [ebp - 0x808]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push 0
push ebx
call eax
jmp 0x101a652d
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test esi, esi
je 0x101a653a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x101a6737
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x83c]
lea eax, [ebp - 0x804]
push dword [ebp - 0x838]
push eax
call fcn.101a6130
test al, al
je 0x101a6705
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
lea esi, [eax + 0x10]
lea eax, [ebp - 0x804]
mov dword [ebp - 0x82c], esi
test eax, 0xffff0000
jne 0x101a66a5
push edi
mov ecx, 0x1025bea0
call fcn.101beff4
mov edi, eax
mov ebx, 1
test edi, edi
je 0x101a6677
lea ecx, [ebp - 0x804]
movzx eax, cx
shr eax, 4
inc eax
mov dword [ebp - 0x80c], eax
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x101a65e0
lea edx, [ebp - 0x804]
movzx ecx, dx
push ecx
push eax
push edi
call fcn.10003980
add esp, 0xc
test eax, eax
jne 0x101a65fe
push ebx
mov ecx, 0x1025bea0
call fcn.101beff4
mov edi, eax
inc ebx
test edi, edi
je 0x101a6677
mov eax, dword [ebp - 0x80c]
jmp 0x101a65b8
test edi, edi
je 0x101a6677
push 6
push dword [ebp - 0x80c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x101a6677
lea edx, [ebp - 0x804]
movzx ecx, dx
push ecx
push eax
push edi
call fcn.10003980
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x101a6677
movzx ecx, word [ebx]
mov eax, dword [esi - 8]
mov edi, ecx
mov edx, ecx
sub eax, edi
mov ecx, 1
sub ecx, dword [esi - 4]
or ecx, eax
jge 0x101a665c
push edi
lea ecx, [ebp - 0x82c]
call fcn.10003310
movzx edx, word [ebx]
mov esi, dword [ebp - 0x82c]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.101eb860
add esp, 0x10
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov ebx, dword [ebp - 0x81c]
mov edi, dword [ebp - 0x824]
cmp dword [ebp - 0x820], edi
je 0x101a66da
lea eax, [esi - 0x10]
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [edi], eax
add dword [ebp - 0x824], 4
jmp 0x101a66ed
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x101a66b0
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x82c]
call fcn.10003740
mov esi, dword [ebp - 0x82c]
jmp 0x101a667d
lea eax, [ebp - 0x82c]
push eax
push edi
lea ecx, [ebp - 0x828]
call fcn.1001ddd0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x101a6705
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x830]
lea eax, [ebp - 0x804]
push 0x800
push 0
inc esi
mov dword [ebp - 0x808], 0x400
push eax
mov dword [ebp - 0x830], esi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x101a63b0
mov eax, dword [ebp - 0x824]
xor ebx, ebx
mov esi, dword [ebp - 0x828]
sub eax, esi
sar eax, 2
test eax, eax
je 0x101a68c6
mov edi, dword [ebp - 0x810]
jmp 0x101a6760
mov ecx, dword [ebp - 0x834]
test ecx, ecx
je 0x101a67aa
mov eax, dword [ecx]
push 0
push dword [esi + ebx*4]
push edi
push 0x10202940
push dword [ebp - 0x81c]
push ecx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x828]
mov esi, dword [ebp - 0x834]
push 0
push dword [eax + ebx*4]
mov ecx, dword [esi]
push edi
push 0x10202940
push dword [ebp - 0x818]
push esi
call dword [ecx + 0x14]
mov esi, dword [ebp - 0x828]
cmp dword [ebp - 0x81c], 0
mov edi, dword [esi + ebx*4]
je 0x101a6829
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a67cc
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x39
call fcn.10003680
add esp, 4
push edi
push dword [ebp - 0x81c]
test eax, eax
je 0x101a67e5
call eax
jmp 0x101a67eb
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x80c], eax
test esi, esi
je 0x101a67fc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x80c], 0
jne 0x101a6823
push dword [ebp - 0x810]
push edi
push 0x10202940
push dword [ebp - 0x81c]
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
mov esi, dword [ebp - 0x828]
cmp dword [ebp - 0x818], 0
je 0x101a68ac
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a6848
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x39
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x101a6862
mov ecx, dword [ebp - 0x818]
push ecx
call eax
jmp 0x101a686e
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x80c], eax
test esi, esi
je 0x101a687f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x80c], 0
jne 0x101a68a6
push dword [ebp - 0x810]
push edi
push 0x10202940
push dword [ebp - 0x818]
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
mov esi, dword [ebp - 0x828]
mov eax, dword [ebp - 0x824]
inc ebx
mov edi, dword [ebp - 0x810]
sub eax, esi
sar eax, 2
cmp ebx, eax
jb 0x101a6760
test esi, esi
je 0x101a692a
mov edi, dword [ebp - 0x824]
cmp esi, edi
je 0x101a68fb
mov edx, dword [esi]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101a68ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, edi
jne 0x101a68d4
mov esi, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x820]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x101a6920
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101a694a
push ecx
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
pop edi
pop ebx
lea ecx, [ebp - 0x81c]
call fcn.10008220
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x14
call fcn.101e6c40
int3