Function at 0x101afcf
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x1076536
call fcn.0101eabc
sub esp, 0x42c
mov eax, dword [0x108e558]
and dword [ebp - 0x42c], 0
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [ebp - 0x438], eax
jmp 0x101b49c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001508
push edi
mov dword [ebp - 0x430], 1
call esi
mov ebx, eax
neg ebx
push 0x100152c
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x101b048
test ebx, ebx
je 0x101b0f1
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b510
cmp dword [ebp + 0x10], 0
je 0x101b0f1
and dword [ebp - 0x428], 0
push 0x5c
push edi
call fcn.0101920b
test eax, eax
jne 0x101b4b4
mov ecx, dword [ebp - 0x424]
push edi
call fcn.010193a4
test eax, eax
je 0x101b0ae
mov eax, dword [ebp - 0x434]
push edi
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x428], eax
call fcn.01019a45
and dword [ebp - 0x428], 0
test ebx, ebx
je 0x101b0e6
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b4c6
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019416
lea ecx, [ebp - 0x428]
mov esi, eax
call fcn.01018eb9
jmp 0x101b2d8
lea ecx, [ebp - 0x428]
call fcn.01018eb9
push 0x1001518
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x101b11d
mov ecx, dword [ebp - 0x424]
and dword [ebp - 0x430], eax
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b510
push 0x1001544
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x101b22e
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x420]
push eax
call fcn.01019297
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x101b510
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
cmp esi, ebx
jl 0x101b510
cmp word [edi], 0x3d
jne 0x101b4bf
cmp dword [ebp + 0x10], ebx
je 0x101b1bc
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x430], eax
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x430]
push eax
mov byte [ebp - 4], 1
call fcn.0101ac9d
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x430], ebx
lea ecx, [ebp - 0x430]
jl 0x101b50b
mov byte [ebp - 4], bl
jmp 0x101b45c
cmp dword [ebp + 0x14], ebx
jne 0x101b219
cmp dword [ebp - 0x430], ebx
je 0x101b219
push 0x20006
push ebx
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x428], ebx
call fcn.01018f2c
cmp eax, ebx
jne 0x101b4ce
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x101b20e
cmp eax, 2
jne 0x101b4ce
lea ecx, [ebp - 0x428]
call fcn.01018eb9
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019416
mov esi, eax
cmp esi, ebx
jmp 0x101b4a6
push 0x5c
push edi
call fcn.0101920b
test eax, eax
jne 0x101b4bf
cmp dword [ebp + 0x10], eax
je 0x101b2e5
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x42c]
call fcn.01018f2c
test eax, eax
je 0x101b2a1
push 0x20019
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x42c]
call fcn.01018f2c
test eax, eax
je 0x101b2a1
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x42c]
call fcn.01018ed7
mov esi, eax
cmp esi, ebx
jne 0x101b4dc
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b510
cmp word [edi], 0x3d
jne 0x101b461
mov ecx, dword [ebp - 0x424]
push edi
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.0101ac9d
mov esi, eax
test esi, esi
jl 0x101b510
jmp 0x101b461
cmp dword [ebp + 0x14], 0
jne 0x101b306
push 0x20019
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x42c]
call fcn.01018f2c
mov ebx, eax
jmp 0x101b309
push 2
pop ebx
test ebx, ebx
je 0x101b314
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b510
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019416
mov esi, eax
test esi, esi
jl 0x101b510
cmp word [edi], 0x7b
jne 0x101b396
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x424]
push 0
push dword [ebp - 0x42c]
push edi
call fcn.0101afcf
mov esi, eax
test esi, esi
jge 0x101b380
cmp dword [ebp + 0x14], 0
je 0x101b510
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b510
cmp ebx, 2
mov eax, dword [ebp - 0x438]
mov dword [ebp + 0x14], eax
je 0x101b4a8
test ebx, ebx
je 0x101b3c1
test eax, eax
jne 0x101b4a8
push ebx
call fcn.0105d6b8
mov esi, eax
jmp 0x101b510
test eax, eax
je 0x101b418
push dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x424]
call fcn.010193da
test eax, eax
je 0x101b418
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x218]
push eax
call fcn.010193a4
test eax, eax
je 0x101b4a8
cmp dword [ebp - 0x430], 0
je 0x101b4a8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
call fcn.01019a45
jmp 0x101b4a8
lea ecx, [ebp - 0x42c]
call fcn.01018eb9
mov ebx, eax
test ebx, ebx
jne 0x101b4ea
cmp dword [ebp - 0x430], eax
je 0x101b4a8
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0x430], ebx
test eax, eax
jne 0x101b4fd
lea ecx, [ebp - 0x430]
call fcn.01018eb9
cmp dword [ebp + 0x10], 0
je 0x101b4a8
cmp word [edi], 0x7b
jne 0x101b4a8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x101b4a8
mov ecx, dword [ebp - 0x424]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push edi
call fcn.0101afcf
mov esi, eax
test esi, esi
jl 0x101b510
mov ecx, dword [ebp - 0x424]
push edi
call fcn.01019297
mov esi, eax
test esi, esi
jl 0x101b510
cmp word [edi], 0x7d
jne 0x101b015
jmp 0x101b510
lea ecx, [ebp - 0x428]
call fcn.01018eb9
mov esi, 0x80020009
jmp 0x101b510
lea ecx, [ebp - 0x428]
jmp 0x101b50b
push eax
call fcn.0105d6b8
lea ecx, [ebp - 0x428]
jmp 0x101b509
lea ecx, [ebp - 0x42c]
call fcn.01018eb9
push esi
jmp 0x101b4f6
lea ecx, [ebp - 0x42c]
call fcn.01018eb9
push ebx
call fcn.0105d6b8
jmp 0x101b51d
push eax
call fcn.0105d6b8
lea ecx, [ebp - 0x430]
mov esi, eax
call fcn.01018eb9
lea ecx, [ebp - 0x42c]
call fcn.01018eb9
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101d2f1
leave
ret 0x10