Function at 0x100f151
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102aeb6
mov eax, dword fs:[0]
push eax
mov eax, 0x103c
call fcn.010171f0
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x102f23c]
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x814], esi
je 0x100f1a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x102f23c], ebx
push ebx
push 0x17ef
push esi
call fcn.0100df2b
call fcn.0100dce7
mov esi, eax
mov edi, 0xbc2
cmp esi, edi
jne 0x100f3b2
mov byte [0x102f228], 1
push 1
push 0x17d6
push dword [ebp - 0x814]
call fcn.0100df2b
cmp byte [0x102e004], bl
mov esi, 0x400
je 0x100f236
push 0x10052b8
push esi
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x818], 0x643
call fcn.0100e2f6
test eax, eax
jl 0x100f41d
push 0x643
lea eax, [ebp - 0x810]
push eax
call fcn.0100d1bc
cmp eax, edi
mov dword [ebp - 0x818], eax
jne 0x100f411
mov byte [0x102f228], 1
cmp byte [0x102e005], bl
je 0x100f284
push 0x1005260
push esi
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x818], 0x643
call fcn.0100e2f6
test eax, eax
jl 0x100f482
push 0x643
lea eax, [ebp - 0x810]
push eax
call fcn.0100d1bc
mov esi, eax
cmp esi, edi
jne 0x100f478
mov byte [0x102f228], 1
mov esi, dword [ebp - 0x814]
push 1
push 0x17d9
push esi
call fcn.0100df2b
call fcn.0101106b
call fcn.0101378e
call fcn.010284f2
call fcn.0100e5fd
call fcn.01028817
push 1
push 0x17d7
push esi
call fcn.0100df2b
or eax, 0xffffffff
lea edi, [ebp - 0x1048]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x102f244]
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x100f2e6
cmp dword [eax], 3
jne 0x100f2e6
lea ecx, [ebp - 0x1048]
call fcn.0100e33a
call fcn.0100d23e
mov edi, eax
cmp edi, ebx
jne 0x100f868
push 1
call fcn.0100eb19
mov edi, eax
cmp edi, ebx
jne 0x100f868
call fcn.0100dfe9
test al, al
je 0x100f868
push ebx
call fcn.0100eb19
mov edi, eax
cmp edi, ebx
jne 0x100f868
call fcn.01010afa
call fcn.010295fb
test eax, eax
je 0x100f4c6
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f387
push 0x1005200
push 2
push eax
call fcn.01015821
mov eax, dword [0x102f248]
add esp, 0xc
cmp eax, ebx
je 0x100f387
push 0x1001638
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f381
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
call fcn.0100df1c
push 2
push 0x17da
push esi
call fcn.0100df2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.0100cea2
mov eax, 0x643
jmp 0x100f886
cmp esi, ebx
je 0x100f1cd
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x100f3e9
push 0x1001638
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f3e3
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
mov dword [0x102f238], 5
call fcn.0100df1c
push 2
push 0x17da
push dword [ebp - 0x814]
call fcn.0100df2b
mov eax, esi
jmp 0x100f886
cmp dword [ebp - 0x818], ebx
je 0x100f236
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x100f44c
push 0x1001638
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f446
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
mov dword [0x102f238], 1
call fcn.0100df1c
push 2
push 0x17da
push dword [ebp - 0x814]
call fcn.0100df2b
mov eax, dword [ebp - 0x818]
jmp 0x100f886
cmp esi, ebx
je 0x100f284
jmp 0x100f488
mov esi, dword [ebp - 0x818]
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x100f4b7
push 0x1001638
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f4b1
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
mov dword [0x102f238], 3
jmp 0x100f3f3
call fcn.010296d6
test eax, eax
mov eax, dword [0x102f248]
je 0x100f551
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x10051a0
push 2
push eax
call fcn.01015821
mov eax, dword [0x102f248]
add esp, 0xc
cmp eax, ebx
je 0x100f521
push 0x1001638
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f51b
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
mov esi, 0x643
call fcn.0100df1c
push 2
push 0x17da
push dword [ebp - 0x814]
call fcn.0100df2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.0100cea2
jmp 0x100f40a
cmp eax, ebx
mov esi, 0x1001638
je 0x100f57c
push esi
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f576
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
push 1
push 0x17d8
push dword [ebp - 0x814]
call fcn.0100df2b
push 0x1005158
push 0x400
lea eax, [ebp - 0x810]
push eax
mov edi, 0x643
call fcn.0100e2f6
test eax, eax
jl 0x100f602
push edi
lea eax, [ebp - 0x810]
push eax
call fcn.0100d1bc
mov edi, eax
cmp edi, 0xbc2
jne 0x100f5fe
mov byte [0x102f228], 1
xor edi, edi
inc edi
push edi
push 0x17f4
push dword [ebp - 0x814]
call fcn.0100df2b
push 0xc
call fcn.010161d8
pop ecx
mov dword [ebp - 0x818], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x100f63e
mov ecx, eax
call fcn.0101564a
jmp 0x100f640
cmp edi, ebx
je 0x100f5cb
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x100f62d
push esi
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f627
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
mov dword [0x102f238], 5
mov esi, edi
jmp 0x100f526
xor eax, eax
cmp eax, ebx
mov byte [ebp - 4], bl
mov dword [0x102f248], eax
je 0x100f673
push ebx
push 0x10049c8
mov ecx, eax
call fcn.010158f9
test eax, eax
je 0x100f673
mov ecx, dword [0x102f248]
cmp ecx, ebx
je 0x100f66d
push edi
call fcn.0100ca32
mov dword [0x102f248], ebx
call fcn.0100e2cf
test al, al
jne 0x100f6cf
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x1005108
push 2
push eax
call fcn.01015821
mov eax, dword [0x102f248]
add esp, 0xc
cmp eax, ebx
je 0x100f521
push esi
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f51b
push edi
jmp 0x100f516
lea ecx, [ebp - 0x1048]
call fcn.0100cea2
call fcn.01011452
call fcn.0100ee91
mov eax, dword [0x102f244]
cmp eax, ebx
je 0x100f717
cmp dword [eax], 3
jae 0x100f717
push 0x10050a0
mov edi, 0x80000002
push edi
push 0x1005030
push edi
call fcn.0102846a
push 0x10047b8
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor edi, edi
inc edi
call fcn.01013b67
call fcn.010116bb
cmp byte [0x1037838], bl
je 0x100f753
call fcn.0102990d
test al, al
jne 0x100f77d
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x1004f40
jmp 0x100f698
call fcn.010299a7
test al, al
jne 0x100f77d
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x1004e88
jmp 0x100f698
call fcn.01029a99
test al, al
jne 0x100f7a7
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x1004dd8
jmp 0x100f698
call fcn.010296e3
test al, al
jne 0x100f7d1
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x1004d20
jmp 0x100f698
cmp byte [0x102f228], bl
jne 0x100f803
call fcn.010297fe
test al, al
jne 0x100f803
mov eax, dword [0x102f248]
cmp eax, ebx
mov dword [0x102f238], 5
je 0x100f521
push 0x1004c70
jmp 0x100f698
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x100f82d
push esi
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100f827
push edi
call fcn.0100ca32
mov dword [0x102f248], ebx
push edi
push 0x17f0
push dword [ebp - 0x814]
call fcn.0100df2b
call fcn.0100df1c
push 2
push 0x17da
push dword [ebp - 0x814]
call fcn.0100df2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.0100cea2
xor eax, eax
jmp 0x100f886
push 2
push 0x17da
push esi
call fcn.0100df2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.0100cea2
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010171cf
leave
ret 4