Function at 0x1009cb3
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x1016c2d
call fcn.01015ff8
sub esp, 0x430
mov eax, dword [0x101af30]
and dword [ebp - 0x428], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
push edi
mov dword [ebp - 0x438], eax
call fcn.0100985d
mov esi, eax
test esi, esi
jge 0x1009d11
lea ecx, [ebp - 0x428]
call fcn.0100a36e
mov eax, esi
jmp 0x100a29c
push ebx
jmp 0x1009e6f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001608
push edi
mov dword [ebp - 0x430], 1
call esi
mov ebx, eax
neg ebx
push 0x100162c
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x1009d4a
test ebx, ebx
je 0x1009e97
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
cmp dword [ebp + 0x10], 0
je 0x1009e97
and dword [ebp - 0x424], 0
xor ecx, ecx
mov cx, word [edi]
mov byte [ebp - 4], 1
mov eax, edi
jmp 0x1009d8e
cmp cx, 0x5c
je 0x1009d95
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
test cx, cx
jne 0x1009d7e
jmp 0x1009d9d
test eax, eax
jne 0x100a2b4
mov esi, 0x10014dc
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1009dd9
add esi, 4
cmp esi, 0x100150c
jl 0x1009da2
mov eax, dword [ebp - 0x434]
push edi
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], eax
call fcn.0100a476
and dword [ebp - 0x424], 0
test ebx, ebx
je 0x1009e7e
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100985d
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x100a2fc
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100a404
mov esi, eax
cmp esi, ebx
jl 0x100a2fc
cmp dword [ebp - 0x424], ebx
mov byte [ebp - 4], bl
je 0x1009e26
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [edi], 0x7b
jne 0x1009e6f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1009e6f
mov ecx, dword [ebp - 0x42c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x428]
push edi
call fcn.01009cb3
mov esi, eax
test esi, esi
jl 0x100a284
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
cmp word [edi], 0x7d
jne 0x1009d17
jmp 0x100a284
cmp dword [ebp - 0x424], 0
mov byte [ebp - 4], 0
je 0x1009e97
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1001618
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009ec3
mov ecx, dword [ebp - 0x42c]
and dword [ebp - 0x430], eax
push edi
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
push 0x1001644
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009fd7
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x420]
push eax
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
cmp word [edi], 0x3d
jne 0x100a2eb
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x1009f5c
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], eax
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x430]
push eax
mov byte [ebp - 4], 2
call fcn.0100a539
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x430], ebx
jl 0x100a31d
mov byte [ebp - 4], bl
jmp 0x1009e26
cmp dword [ebp + 0x14], ebx
jne 0x1009fc2
cmp dword [ebp - 0x430], ebx
je 0x1009fc2
push 0x20006
push ebx
push dword [ebp - 0x434]
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], ebx
call fcn.0100a38c
cmp eax, ebx
jne 0x100a2f4
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x1009fae
cmp eax, 2
jne 0x100a2f4
cmp dword [ebp - 0x424], ebx
je 0x1009fc2
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100a404
mov esi, eax
cmp esi, ebx
jmp 0x1009e69
xor ecx, ecx
mov cx, word [edi]
mov eax, edi
xor esi, esi
jmp 0x1009ff2
cmp cx, 0x5c
je 0x1009ff9
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
cmp cx, si
jne 0x1009fe2
jmp 0x100a001
cmp eax, esi
jne 0x100a2d0
cmp dword [ebp + 0x10], esi
je 0x100a0df
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
call fcn.0100a38c
test eax, eax
je 0x100a09b
push 0x20019
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
call fcn.0100a38c
test eax, eax
je 0x100a09b
lea eax, [ebp - 0x43c]
push eax
xor ebx, ebx
lea eax, [ebp - 0x430]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x434]
mov dword [ebp - 0x430], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x100a315
xor eax, eax
cmp dword [ebp - 0x428], ebx
je 0x100a087
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [ebp - 0x430]
mov dword [ebp - 0x428], ecx
jne 0x100a315
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
cmp word [edi], 0x3d
jne 0x1009e26
mov ecx, dword [ebp - 0x42c]
push edi
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.0100a539
mov esi, eax
test esi, esi
jl 0x100a284
jmp 0x1009e26
cmp dword [ebp + 0x14], esi
jne 0x100a103
push 0x20019
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
call fcn.0100a38c
mov dword [ebp - 0x424], eax
jmp 0x100a10d
mov dword [ebp - 0x424], 2
cmp dword [ebp - 0x424], esi
je 0x100a11c
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ebx, dword [ebp - 0x42c]
push edi
mov ecx, ebx
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
push edi
mov ecx, ebx
call fcn.0100a404
mov esi, eax
test esi, esi
jl 0x100a284
cmp word [edi], 0x7b
jne 0x100a194
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x428]
push edi
call fcn.01009cb3
mov esi, eax
test esi, esi
jge 0x100a182
cmp dword [ebp + 0x14], 0
je 0x100a284
push edi
mov ecx, ebx
call fcn.0100985d
mov esi, eax
test esi, esi
jl 0x100a284
cmp dword [ebp - 0x424], 2
mov eax, dword [ebp - 0x438]
mov dword [ebp + 0x14], eax
je 0x1009e6f
xor ebx, ebx
cmp dword [ebp - 0x424], ebx
je 0x100a1c7
cmp eax, ebx
jne 0x1009e6f
push dword [ebp - 0x424]
jmp 0x100a27d
cmp dword [ebp - 0x438], ebx
je 0x100a22f
push dword [ebp - 0x428]
mov ecx, dword [ebp - 0x42c]
call fcn.0100a3c8
test eax, eax
je 0x100a22f
mov ebx, 0x10014dc
push dword [ebx]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1009e6f
add ebx, 4
cmp ebx, 0x100150c
jl 0x100a1e9
cmp dword [ebp - 0x430], 0
je 0x1009e6f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.0100a476
jmp 0x1009e6f
cmp dword [ebp - 0x428], ebx
je 0x100a254
push dword [ebp - 0x428]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
and dword [ebp - 0x428], 0
test eax, eax
jne 0x100a328
cmp dword [ebp - 0x430], 0
je 0x1009e6f
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1009e6f
push eax
call fcn.0100a34f
mov esi, eax
cmp dword [ebp - 0x428], 0
je 0x100a299
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.01015af2
leave
ret 0x10
xor esi, esi
cmp dword [ebp - 0x424], esi
je 0x100a2d0
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x424], esi
cmp dword [ebp - 0x428], esi
je 0x100a2e4
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x100a29b
cmp dword [ebp - 0x428], 0
jmp 0x100a2d6
push eax
call fcn.0100a34f
mov esi, eax
cmp dword [ebp - 0x424], ebx
je 0x100a284
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a284
push eax
call fcn.0100a34f
mov esi, eax
cmp dword [ebp - 0x428], ebx
jmp 0x100a28b
push eax
call fcn.0100a34f
cmp dword [ebp - 0x428], 0
mov esi, eax
je 0x100a299
push dword [ebp - 0x428]
call ebx
jmp 0x100a299