Function at 0x100b7810
Capabilities:
Delete registry value
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017b815
mov eax, dword fs:[0]
push eax
sub esp, 0x9a0
mov eax, dword [0x101e8118]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push 0x208
lea eax, [ebp - 0x724]
push eax
mov ecx, 0x101ea630
call fcn.10086950
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x724]
push ecx
call fcn.100abd90
add esp, 8
mov dword [ebp - 0x984], eax
cmp dword [ebp - 0x984], 0
je 0x100b788a
mov edx, dword [ebp - 0x984]
mov word [edx], 0
push 0x1019938c
lea eax, [ebp - 0x724]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x724]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10199390
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x97c]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 0xffffffff
je 0x100b79b1
lea eax, [ebp - 0x724]
push eax
lea ecx, [ebp - 0x51c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x51c]
push ecx
call fcn.10090c40
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
je 0x100b7988
push str.PlugInvoke
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100b797b
mov dword [ebp - 0x988], 1
lea eax, [ebp - 0x988]
push eax
push str.UnRegistration
call dword [ebp - 0x10]
cmp dword [ebp - 0x988], 0
jne 0x100b797b
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100b7ba4
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x97c]
push eax
mov ecx, dword [ebp - 0x980]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100b78e9
mov edx, dword [ebp - 0x980]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.100cfa10
movzx eax, al
test eax, eax
jne 0x100b79c2
jmp 0x100b7ba4
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
push 0x101993c8
lea ecx, [ebp - 0x30c]
push ecx
call fcn.1013b37a
add esp, 0xc
mov dword [ebp - 0x23c], 0
push 0
lea edx, [ebp - 0x23c]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x30c]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x238]
call fcn.100a84e0
mov dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x238]
call fcn.100a8540
lea ecx, [ebp - 0x238]
call fcn.100a8db0
push 0
push 1
mov ecx, 0x101ea630
call fcn.100bb900
call fcn.100187b0
mov dword [ebp - 0x314], eax
push 0
push 0x10199434
push 1
lea eax, [ebp - 0x98c]
push eax
call fcn.100addf0
add esp, 8
mov dword [ebp - 0x994], eax
mov ecx, dword [ebp - 0x994]
mov dword [ebp - 0x998], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x998]
push edx
lea eax, [ebp - 0x990]
push eax
call fcn.10019630
mov dword [ebp - 0x99c], eax
mov ecx, dword [ebp - 0x99c]
mov dword [ebp - 0x9a0], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x9a0]
call fcn.10005f10
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x100b7af6
mov dword [ebp - 0x9a4], 0
jmp 0x100b7b60
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x100b7b1e
mov dword [ebp - 0x9a8], 0
jmp 0x100b7b54
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.1013ecc0
mov dword [ebp - 0x9ac], esp
mov eax, dword [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x9ac]
push eax
call fcn.10028520
mov dword [ebp - 0x9a8], eax
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp - 0x9a4], ecx
push str.un2.bat
mov edx, dword [ebp - 0x9a4]
push edx
call fcn.1008f230
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x990]
call fcn.10006030
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98c]
call fcn.10006030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.100a8520
lea esp, [ebp - 0x9b0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1013a297
mov esp, ebp
pop ebp
ret