Function at 0x101e0e4
Capabilities:
Delete registry key

Disassembly:
push 0xb0
mov eax, 0x1025cdc
call fcn.010021e6
mov ebx, dword [ebp + 0x18]
lea esi, [ebp + 8]
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x10083bc
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.0101d61e
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101e54a
cmp dword [ebp + 0x1c], 8
jbe 0x101e177
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x101e14f
test byte [eax + 0x1c], 1
je 0x101e14f
cmp byte [eax + 0x19], 2
jb 0x101e14f
push 0xd
push 0x1008834
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x357
push 0x1008848
push 0xd
lea ecx, [ebp - 0xbc]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0xbc]
push eax
call sub.msvcrt.dll__CxxThrowException
lea eax, [ebx + 0xe8]
cmp dword [eax + 0x18], 8
jb 0x101e188
mov eax, dword [eax + 4]
jmp 0x101e18b
add eax, 4
lea esi, [ebx + 0x48]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x90], eax
push 4
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
lea esi, [ebp - 0x74]
repe cmpsd dword [esi], dword es:[edi]
sete al
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x7c], eax
call fcn.010039b9
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x74]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.01015e70
lea ecx, [ebp - 0x64]
call fcn.010039b9
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x90]
mov ecx, 0x1029090
mov byte [ebp - 4], 1
call fcn.0101dac1
mov dword [ebp - 0x84], esi
cmp dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 2
jae 0x101e1fe
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x84]
push ecx
mov edi, 0x2001f
push edi
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
mov dword [ebp - 0x94], ecx
cmp ecx, 2
je 0x101e529
cmp ecx, esi
je 0x101e26d
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x101e258
test byte [eax + 0x1c], 1
je 0x101e258
cmp byte [eax + 0x19], 2
jb 0x101e258
push ecx
push 0x1008834
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x372
push 0x1008848
push dword [ebp - 0x94]
jmp 0x101e15b
mov dword [ebp - 0x78], esi
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 3
jae 0x101e280
lea eax, [ebp - 0x44]
push esi
lea ecx, [ebp - 0x78]
push ecx
push esi
push edi
push esi
push esi
push esi
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
je 0x101e2d8
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x101e2c8
test byte [eax + 0x1c], 1
je 0x101e2c8
cmp byte [eax + 0x19], 2
jb 0x101e2c8
push edi
push 0x1008834
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x37f
push 0x1008848
push edi
jmp 0x101e15b
xor edi, edi
inc edi
push edi
push 0x1008074
push dword [ebp - 0x78]
call fcn.01020b9a
push dword [ebx + 0x38]
push 0x101e5e4
push dword [ebp - 0x78]
call fcn.01020b9a
push dword [ebp - 0x90]
lea ecx, [ebp - 0x2c]
call fcn.0100159c
lea eax, [ebp - 0x2c]
push eax
push 0x101e5cc
push dword [ebp - 0x78]
mov byte [ebp - 4], 4
call fcn.0102104b
push esi
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.01001b47
cmp dword [ebp - 0x7c], esi
je 0x101e344
push dword [ebx + 0x40]
push 0x101e5b4
push dword [ebp - 0x78]
call fcn.01020b9a
jmp 0x101e521
push dword [ebx + 0x9c]
call fcn.01012b41
test al, al
jne 0x101e362
cmp dword [ebx + 0x98], 2
mov dword [ebp - 0x94], esi
jne 0x101e368
mov dword [ebp - 0x94], edi
push 0x3f
pop ecx
sub ecx, dword [ebp + 0x1c]
mov eax, edi
xor edx, edx
call fcn.01005989
mov edi, eax
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
cmp dword [ebp - 0x94], esi
je 0x101e3dc
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax]
test al, al
je 0x101e430
cmp byte [ebp + 0x20], 0
je 0x101e430
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x88], eax
jmp 0x101e430
lea eax, [ebp - 0x80]
push eax
push 0x101e594
push dword [ebp - 0x78]
call fcn.01020acd
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
call dword [eax]
test al, al
je 0x101e417
cmp byte [ebp + 0x20], 0
je 0x101e417
mov eax, dword [ebp - 0x80]
or eax, edi
mov eax, dword [ebp - 0x14]
or dword [ebp - 0x7c], eax
jmp 0x101e426
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x80]
not edi
not eax
and ecx, edi
and dword [ebp - 0x7c], eax
and dword [ebp - 0x7c], 0xff000000
mov dword [ebp - 0x80], esi
mov eax, dword [ebp - 0x80]
or eax, dword [ebp - 0x7c]
jne 0x101e4b1
mov eax, dword [ebp - 0x8c]
or eax, dword [ebp - 0x88]
jne 0x101e4b1
lea ecx, [ebp - 0x78]
call fcn.01012ad0
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x101e45a
lea eax, [ebp - 0x44]
push esi
push esi
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
cmp edi, esi
je 0x101e521
cmp edi, 2
je 0x101e521
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x101e4a7
test byte [eax + 0x1c], 1
je 0x101e4a7
cmp byte [eax + 0x19], 2
jb 0x101e4a7
push edi
push 0x1008834
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x3c2
jmp 0x101e2cd
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push 0x101e594
push dword [ebp - 0x78]
call fcn.01020c15
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push 0x101e574
push dword [ebp - 0x78]
call fcn.01020c15
xor eax, eax
cmp dword [ebx + 0x34], esi
je 0x101e4e5
inc eax
push eax
push 0x101e554
push dword [ebp - 0x78]
call fcn.01020b9a
push dword [ebp - 0x90]
lea ecx, [ebp - 0x2c]
call fcn.0100159c
lea eax, [ebp - 0x2c]
push eax
push 0x101e5cc
push dword [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.0102104b
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.01001b47
lea ecx, [ebp - 0x78]
call fcn.01012ad0
lea ecx, [ebp - 0x84]
call fcn.01012ad0
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.01001b47
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.01001b47
call fcn.01002043
ret 0x1c