Function at 0x100a91d
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x268], eax
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jge 0x100aef6
lea ecx, [ebp - 0x224]
call fcn.01008b5a
lea ecx, [ebp - 0x238]
call fcn.01009935
mov eax, esi
lea esp, [ebp - 0x274]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100be41
leave
ret 0x10
push 0x10013d4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
neg esi
sbb esi, esi
push 0x10013f8
inc esi
push edi
mov dword [ebp - 0x258], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100a9ea
cmp esi, ebx
je 0x100aa9c
mov ecx, dword [ebp - 0x210]
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
cmp dword [ebp + 0x10], ebx
je 0x100aa9c
push 0x5c
push edi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
call fcn.01008f6a
test eax, eax
jne 0x100af05
mov ecx, dword [ebp - 0x210]
push edi
call fcn.010091ae
test eax, eax
je 0x100aa55
mov eax, dword [ebp - 0x218]
push edi
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x230], eax
call fcn.01009b4f
mov dword [ebp - 0x230], ebx
cmp dword [ebp - 0x258], ebx
je 0x100aa91
mov ecx, dword [ebp - 0x210]
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100af1a
mov ecx, dword [ebp - 0x210]
push edi
call fcn.010092ab
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.01008b5a
jmp 0x100aeac
lea ecx, [ebp - 0x230]
call fcn.01008b5a
push 0x10013e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100aac8
mov ecx, dword [ebp - 0x210]
push edi
mov dword [ebp - 0x234], ebx
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001410
push edi
call esi
test eax, eax
jne 0x100abd6
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
mov ecx, dword [ebp - 0x210]
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
cmp word [edi], 0x3d
jne 0x100af10
cmp dword [ebp + 0x10], ebx
je 0x100ab63
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x210]
push ebx
mov dword [ebp - 0x254], eax
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
call fcn.0100a628
mov dword [ebp - 0x254], ebx
lea ecx, [ebp - 0x254]
jmp 0x100aa85
cmp dword [ebp + 0x14], ebx
jne 0x100abc5
push ebx
push 0x20006
push ebx
push dword [ebp - 0x218]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
call fcn.01008bcd
cmp eax, ebx
jne 0x100af24
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x100abba
cmp eax, 2
jne 0x100af22
lea ecx, [ebp - 0x248]
call fcn.01008b5a
mov ecx, dword [ebp - 0x210]
push edi
call fcn.010092ab
jmp 0x100a980
push 0x5c
push edi
call fcn.01008f6a
test eax, eax
jne 0x100af10
cmp dword [ebp + 0x10], ebx
je 0x100acb1
push ebx
push 0xf003f
push edi
push dword [ebp - 0x218]
lea ecx, [ebp - 0x224]
call fcn.01008bcd
test eax, eax
je 0x100ac4a
push ebx
push 0x20019
push edi
push dword [ebp - 0x218]
lea ecx, [ebp - 0x224]
call fcn.01008bcd
test eax, eax
je 0x100ac4a
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push edi
push dword [ebp - 0x218]
lea ecx, [ebp - 0x224]
call fcn.01008b78
test eax, eax
jne 0x100af10
movzx eax, word [edi]
mov byte [ebp - 0x23c], bl
cmp ax, 0x4c
je 0x100ac5f
cmp ax, 0x6c
jne 0x100ac72
push 0x10021c0
push edi
call esi
test eax, eax
jne 0x100ac72
mov byte [ebp - 0x23c], 1
mov ecx, dword [ebp - 0x210]
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
cmp word [edi], 0x3d
jne 0x100aeb4
push dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x210]
push edi
push ebx
lea eax, [ebp - 0x224]
push eax
call fcn.0100a628
jmp 0x100aeaa
cmp dword [ebp + 0x14], ebx
jne 0x100acd9
push ebx
push 0x20019
push edi
push dword [ebp - 0x218]
lea ecx, [ebp - 0x224]
call fcn.01008bcd
test eax, eax
je 0x100acd9
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0x214], ebx
jne 0x100ad1d
mov esi, 0x208
push esi
call fcn.0100890f
test al, al
je 0x100acff
mov eax, esi
call fcn.0100bef0
mov dword [ebp - 0x214], esp
jmp 0x100ad11
push esi
lea ecx, [ebp - 0x238]
call fcn.0100a375
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], ebx
je 0x100af42
push 0x104
push edi
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x14], ebx
jne 0x100ad62
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x210]
call fcn.010091e4
test eax, eax
jne 0x100ad62
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x210]
call fcn.01009220
test eax, eax
je 0x100ae33
mov ecx, dword [ebp - 0x210]
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
mov ecx, dword [ebp - 0x210]
push edi
call fcn.010092ab
mov esi, eax
cmp esi, ebx
jl 0x100a98a
cmp word [edi], 0x7b
jne 0x100addd
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x210]
push ebx
push dword [ebp - 0x224]
push edi
call fcn.0100a91d
mov esi, eax
cmp esi, ebx
jl 0x100a98a
cmp dword [ebp + 0x14], ebx
je 0x100ade6
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x210]
push edi
mov dword [ebp + 0x14], eax
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
jmp 0x100abc5
cmp dword [ebp + 0x14], ebx
jne 0x100aef6
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x210]
call fcn.010091e4
test eax, eax
je 0x100ae2a
push dword [ebp - 0x214]
mov ecx, dword [ebp - 0x210]
call fcn.010091ae
test eax, eax
je 0x100aeeb
push dword [ebp - 0x214]
lea ecx, [ebp - 0x224]
call fcn.01009b4f
jmp 0x100aeeb
cmp dword [ebp + 0x14], ebx
jne 0x100aef6
lea ecx, [ebp - 0x224]
call fcn.01008b5a
test eax, eax
jne 0x100af10
cmp dword [ebp - 0x234], ebx
je 0x100ae88
mov eax, dword [ebp - 0x218]
push dword [ebp - 0x214]
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x264], eax
call fcn.01008ad4
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x264], ebx
call fcn.01008b5a
mov ecx, dword [ebp - 0x210]
push edi
call fcn.0100908f
mov esi, eax
cmp esi, ebx
jl 0x100a98a
mov ecx, dword [ebp - 0x210]
push edi
call fcn.010092ab
mov esi, eax
cmp esi, ebx
jl 0x100a98a
cmp dword [ebp + 0x10], ebx
je 0x100aef6
cmp word [edi], 0x7b
jne 0x100aef6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x100aef6
mov ecx, dword [ebp - 0x210]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x224]
push edi
call fcn.0100a91d
mov esi, eax
cmp esi, ebx
jl 0x100a98a
mov ecx, dword [ebp - 0x210]
jmp 0x100a97a
cmp word [edi], 0x7d
jne 0x100a9b9
jmp 0x100a98a
lea ecx, [ebp - 0x230]
call fcn.01008b5a
mov esi, 0x80020009
jmp 0x100a98a
lea ecx, [ebp - 0x230]
jmp 0x100af38
cmp eax, ebx
jle 0x100af30
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x248]
call fcn.01008b5a
jmp 0x100a98a
mov esi, 0x8007000e
jmp 0x100a98a