Function at 0x100b5f8
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x254
mov eax, 0x103964b
call fcn.01037352
xor eax, eax
xor edi, edi
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x22c], edi
call fcn.01014810
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x244], edi
call fcn.01009bc8
mov esi, eax
cmp esi, edi
jge 0x100b6af
mov eax, dword [section..data]
cmp eax, section..data
je 0x100b97f
test byte [eax + 0x1c], 1
je 0x100b97f
push esi
push 0x10017f0
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x100b97f
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x23c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, edi
je 0x100b70f
mov eax, dword [section..data]
cmp eax, section..data
je 0x100b6f6
test byte [eax + 0x1c], 1
je 0x100b6f6
push 0x10017f0
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
cmp esi, edi
jle 0x100b97f
and esi, 0xffff
or esi, 0x80070000
jmp 0x100b97f
mov eax, dword [ebp - 0x23c]
cmp eax, edi
jne 0x100b747
mov eax, dword [section..data]
cmp eax, section..data
je 0x100b73d
test byte [eax + 0x1c], 1
je 0x100b73d
push 0x10017f0
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
mov esi, 0x80004005
jmp 0x100b97f
mov dword [ebp - 0x228], eax
cmp eax, edi
jbe 0x100b97d
mov ebx, section..data
mov esi, 0x10017f0
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x228]
dec eax
push eax
push dword [ebp - 0x220]
mov dword [ebp - 0x230], 0x104
mov dword [ebp - 0x22c], 8
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
call dword [sym.imp.KERNEL32.dll_RegEnumValueW]
cmp eax, edi
jne 0x100b971
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
test eax, eax
je 0x100b7fe
mov eax, dword [section..data]
cmp eax, ebx
je 0x100b971
test byte [eax + 0x1c], 1
je 0x100b971
push esi
push 0x1f
jmp 0x100b966
cmp dword [ebp - 0x240], 3
jne 0x100b954
cmp dword [ebp - 0x230], 0x105
ja 0x100b954
cmp dword [ebp - 0x22c], 8
jne 0x100b954
lea eax, [ebp - 0x21c]
push eax
call fcn.010108ed
test eax, eax
jne 0x100b869
mov eax, dword [section..data]
cmp eax, ebx
je 0x100b971
test byte [eax + 0x1c], 1
je 0x100b971
lea ecx, [ebp - 0x21c]
push ecx
push esi
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008bcd
jmp 0x100b971
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x260]
call fcn.01014c4a
cmp eax, edi
jge 0x100b8c3
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x100b971
test byte [ecx + 0x1c], 1
je 0x100b971
push eax
push esi
push 0x22
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01008600
jmp 0x100b971
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x244]
jb 0x100b91f
mov ecx, dword [ebp - 0x238]
ja 0x100b8e1
cmp ecx, dword [ebp - 0x248]
jbe 0x100b91f
mov dword [ebp - 0x248], ecx
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x260]
push eax
add ecx, 0x290
call fcn.0100b5a4
cmp eax, edi
jge 0x100b971
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x100b971
test byte [ecx + 0x1c], 1
je 0x100b971
push eax
push esi
push 0x23
jmp 0x100b8b3
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x260]
push eax
add ecx, 0x290
call fcn.0100b54f
cmp eax, edi
jge 0x100b971
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x100b971
test byte [ecx + 0x1c], 1
je 0x100b971
push eax
push esi
push 0x24
jmp 0x100b8b3
mov eax, dword [section..data]
cmp eax, ebx
je 0x100b971
test byte [eax + 0x1c], 1
je 0x100b971
push esi
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
dec dword [ebp - 0x228]
jne 0x100b75f
xor esi, esi
cmp dword [ebp - 0x220], edi
je 0x100b999
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov dword [ebp - 0x220], edi
push 0x1001cf0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.01014822
mov eax, esi
call fcn.010373e4
ret