Function at 0xbbdae0
Capabilities:
Delete registry value

Disassembly:
push 0xec
mov eax, 0xbcc25a
call fcn.00bc132b
mov edi, dword [ebp + 8]
test byte [edi + 0x60], 0x80
je 0xc1963e
push 0xb2d818
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
xor ecx, ecx
mov dword [ebp - 0xdc], eax
test eax, eax
mov dword [ebp - 0xe0], 0xb12b24
setne cl
mov dword [ebp - 0xd8], ecx
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xbbdb40
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xbbdb94
cmp byte [ebp - 0xd8], bl
je 0xc1960f
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xd4]
push eax
push 1
push 0xffffffffffffffff
push ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoWaitForMultipleHandles]
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0xb12b24
mov esi, eax
call fcn.00b83f88
mov eax, esi
call fcn.00bc12da
ret 8
mov eax, 0x80004005
jmp 0xbbdb42
mov ecx, dword [ebp + 4]
mov edx, 0x7a9
push eax
push 0xb27854
call fcn.00b913f8
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0xb12b24
call fcn.00b83f88
xor eax, eax
jmp 0xbbdb8c
push ecx
push 0xb2b9f0
lea ecx, [ebp - 0xd0]
call fcn.00b805bc
mov dword [ebp - 0xd0], 0xb15470
lea eax, [edi + 0xac]
xor ebx, ebx
push eax
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], ebx
call fcn.00b8b20e
lea ecx, [ebp - 0xd0]
call fcn.00b804c4
call fcn.00bab638
test dword [edi + 0x5c], 0x4000
mov esi, eax
je 0xc19694
lea ecx, [esi - 0xd]
neg ecx
sbb ecx, ecx
and esi, ecx
lea eax, [ebp - 0xf4]
mov edx, 0xb2b908
push eax
push 0xb2b984
call fcn.00b9282c
test eax, eax
jns 0xc196fd
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0xf4]
mov edx, 0xb2b908
push eax
push 3
push 0xb2b984
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00c26185
test eax, eax
jle 0xc196e6
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xc196fd
push eax
push 0xb27854
mov edx, 0x74c
call fcn.00b913f8
xor ecx, ecx
mov dword [ebp - 0xd4], 0xc
inc ecx
cmp esi, 0xd
jae 0xc19799
push 4
mov eax, esi
mov dword [ebp - 0xd4], 0x4c
pop edx
sub eax, edx
je 0xc1976a
sub eax, ecx
je 0xc1974a
sub eax, ecx
jne 0xc197c3
mov dword [ebp - 0xd4], 0x44c
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xe4], ecx
jmp 0xc19760
mov dword [ebp - 0xd4], 0x24c
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], ecx
push edx
push eax
push edx
push 0xb2b858
jmp 0xc19788
push edx
lea eax, [ebp - 0xec]
mov dword [ebp - 0xd4], 0x6c
push eax
push edx
mov dword [ebp - 0xec], ecx
push 0xb2b8b0
mov edx, 0xb288f0
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00c26185
jmp 0xc197c3
push 0xb2b8b0
push 0xb288f0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
push 0xb2b858
push 0xb288f0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
test byte [edi + 0x5c], 2
je 0xc197d3
cmp esi, 0xb
ja 0xc197d3
call fcn.00cd421c
mov dword [ebp - 0xd8], ebx
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 1
call fcn.00b82546
lea eax, [ebp - 0xd8]
push eax
push 0xb2b844
push 3
push ebx
push 0xb28b90
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0xc1980f
mov edx, 0x77a
jmp 0xc19836
mov eax, dword [ebp - 0xd8]
push dword [ebp - 0xd4]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, eax
test edi, edi
jns 0xc19844
mov edx, 0x77d
mov ecx, dword [ebp + 4]
push edi
push 0xb27854
call fcn.00b913f8
push edi
lea ecx, [ebp - 0xd0]
call fcn.00b8ae37
lea ecx, [ebp - 0xd8]
call fcn.00b82546
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], 0xb15470
call fcn.00b80675
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0xc198d5
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0xc198d2
mov esi, dword [ebp - 0x18]
test esi, esi
je 0xc198d2
lea ecx, [esi + 0x94]
call fcn.00b845a1
lea ecx, [esi + 0x2c]
call fcn.00b8458c
cmp dword [esi + 4], 1
jne 0xc198bc
push 0xcbd230
mov dword [esi + 4], 2
call fcn.00b8b3e7
lea edx, [esi + 0xc]
mov ecx, dword [eax + 4]
call fcn.00c22b6a
push esi
push ebx
mov dword [esi + 4], 3
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x24]
call fcn.00b845a1
lea ecx, [ebp - 0x8c]
call fcn.00b8458c
cmp dword [ebp - 0xb4], 1
jne 0xc19913
push 0xcbd230
mov dword [ebp - 0xb4], 2
call fcn.00b8b3e7
lea edx, [ebp - 0xac]
mov ecx, dword [eax + 4]
call fcn.00c22b6a
cmp dword [ebp - 0xc0], 0
mov dword [ebp - 0xb4], 3
je 0xc19931
lea ecx, [ebp - 0xcc]
call fcn.00b54a44
mov eax, edi
jmp 0xbbdb8c