Function at 0x10399ee
Capabilities:
Delete registry key
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x1099a38]
push ebx
push esi
push edi
and dword [ebp - 0x70], 0
push 0xd
pop ecx
push 0xd
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x94], eax
mov esi, 0x100cc6c
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x84]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x38]
push eax
mov ebx, SysStringLen
mov esi, 0x100af40
lea edi, [ebp - 0x6c]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x88], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1039a6e
push eax
lea eax, [ebp - 0x38]
push eax
push 0x100dadc
call fcn.01071ac0
add esp, 0xc
jmp 0x1039c6d
mov esi, dword [sym.imp.msvcrt.dll_malloc]
mov edi, 0x1001
push edi
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x74], eax
jne 0x1039a93
push 0x100da98
call fcn.01071aad
jmp 0x1039c61
push edi
call esi
mov esi, eax
xor eax, eax
cmp esi, eax
pop ecx
mov dword [ebp - 0x78], esi
jne 0x1039ab1
push 0x100da58
call fcn.01071aad
jmp 0x1039c57
lea ecx, [ebp - 0xa0]
push ecx
push eax
push eax
push eax
lea ecx, [ebp - 0x88]
push ecx
push dword [ebp - 0x74]
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1039c4d
mov dword [ebp - 0x80], esi
lea eax, [ebp - 0x38]
sub dword [ebp - 0x80], eax
lea eax, [ebp - 0x38]
mov cl, byte [eax]
mov edx, dword [ebp - 0x80]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1039ae6
mov edi, dword [ebp - 0x78]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1039af7
mov eax, dword [ebp - 0x74]
mov esi, 0x10094ec
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1039b0b
mov edi, dword [ebp - 0x78]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1039b18
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
push dword [ebp - 0x78]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
call esi
test eax, eax
jne 0x1039c13
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x100a3b8
push dword [ebp - 0x7c]
mov dword [ebp - 0x98], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 0x7c]
je 0x1039b91
inc dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1039c16
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
mov eax, dword [ebp + 8]
shr eax, 8
cmp dword [ebp - 0x90], eax
ja 0x1039c13
push dword [ebp - 0x78]
push ebx
call fcn.010334cd
test eax, eax
je 0x1039bb7
inc dword [ebp - 0x70]
lea eax, [ebp - 0x8c]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x6c]
push eax
push ebx
call esi
test eax, eax
jne 0x1039be7
push dword [ebp - 0x74]
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x8c]
call edi
push dword [ebp - 0x74]
mov esi, 0x1106960
push dword [ebp - 0x90]
push dword [ebp - 0x94]
push 0x100a564
push esi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
push esi
push ebx
call fcn.010334cd
jmp 0x1039c16
inc dword [ebp - 0x70]
lea eax, [ebp - 0xa0]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x88], 0x1000
push dword [ebp - 0x70]
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1039ae3
push dword [ebp - 0x78]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x74]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 8