Function at 0x1058076
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.01022d6e
mov edi, eax
mov ax, word [0x10e6bac]
test ax, ax
jbe 0x1058095
xor edx, edx
jmp 0x1058098
movzx edx, ax
movzx ecx, word [0x10e68ec]
cmp edx, ecx
jle 0x10580b1
test ax, ax
jbe 0x10580ac
xor eax, eax
jmp 0x10580b3
movzx eax, ax
jmp 0x10580b3
mov eax, ecx
mov ecx, dword [edi + 0xb90]
push 0
mov word [ecx + 4], ax
mov eax, dword [edi + 0xb90]
and word [eax + 0x6a], 0
push 0x100be34
mov esi, 0x100be18
push esi
call fcn.01022e22
mov ecx, dword [edi + 0xb90]
push 9
mov ebx, 0x100bdec
push ebx
push esi
mov word [ecx], ax
call fcn.01022e22
mov ecx, dword [0x10e6baa]
cmp ax, cx
jae 0x1058107
push 9
push ebx
push esi
call fcn.01022e22
jmp 0x1058109
mov eax, ecx
mov edx, dword [0x10e68ea]
cmp ax, dx
jbe 0x1058137
push 9
push ebx
push esi
call fcn.01022e22
mov ecx, dword [0x10e6baa]
cmp ax, cx
jae 0x1058133
push 9
push ebx
push esi
call fcn.01022e22
jmp 0x1058139
mov eax, ecx
jmp 0x1058139
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0x2400
mov word [ecx + 2], ax
movzx eax, word [0x10e6bae]
mov ebx, 0x100bdc8
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01022e22
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1058177
push 0x2400
push ebx
push esi
call fcn.01022e22
movsx ecx, ax
jmp 0x105817a
mov ecx, dword [ebp - 4]
movzx eax, word [0x10e68ee]
cmp ecx, eax
jle 0x10581b7
movzx eax, word [0x10e6bae]
push 0x2400
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01022e22
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x10581b4
push 0x2400
push ebx
push esi
call fcn.01022e22
movsx eax, ax
jmp 0x10581b7
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0x20
mov word [ecx + 6], ax
movzx eax, word [0x10e6bb0]
mov ebx, 0x100bd94
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01022e22
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x10581ef
push 0x20
push ebx
push esi
call fcn.01022e22
movsx ecx, ax
jmp 0x10581f2
mov ecx, dword [ebp - 4]
movzx eax, word [0x10e68f0]
cmp ecx, eax
jle 0x1058229
movzx eax, word [0x10e6bb0]
push 0x20
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01022e22
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1058226
push 0x20
push ebx
push esi
call fcn.01022e22
movsx eax, ax
jmp 0x1058229
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0x200
mov word [ecx + 8], ax
movzx eax, word [0x10e6bb2]
mov ebx, 0x100bd74
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01022e22
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1058267
push 0x200
push ebx
push esi
call fcn.01022e22
movsx ecx, ax
jmp 0x105826a
mov ecx, dword [ebp - 4]
movzx eax, word [0x10e68f2]
cmp ecx, eax
jle 0x10582a7
movzx eax, word [0x10e6bb2]
push 0x200
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01022e22
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x10582a4
push 0x200
push ebx
push esi
call fcn.01022e22
movsx eax, ax
jmp 0x10582a7
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0
push 0x100bd54
mov ebx, 0x100b8a0
push ebx
mov word [ecx + 0xa], ax
call fcn.01022e22
mov ecx, dword [0x10e6bb4]
cmp ax, cx
jge 0x10582dd
push 0
push 0x100bd54
push ebx
call fcn.01022e22
jmp 0x10582df
mov eax, ecx
mov edx, dword [0x10e68f4]
cmp ax, dx
jle 0x1058315
push 0
push 0x100bd54
push ebx
call fcn.01022e22
mov ecx, dword [0x10e6bb4]
cmp ax, cx
jge 0x1058311
push 0
push 0x100bd54
push ebx
call fcn.01022e22
jmp 0x1058317
mov eax, ecx
jmp 0x1058317
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100bd2c
push ebx
push esi
mov word [ecx + 0xc], ax
call fcn.01022e22
mov ecx, dword [0x10e6bb6]
cmp ax, cx
jge 0x1058345
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x1058347
mov eax, ecx
mov edx, dword [0x10e68f6]
cmp ax, dx
jle 0x1058375
push 0
push ebx
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bb6]
cmp ax, cx
jge 0x1058371
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x1058377
mov eax, ecx
jmp 0x1058377
mov eax, edx
mov ecx, dword [edi + 0xb90]
xor ebx, ebx
inc ebx
push ebx
push 0x100bcfc
push esi
mov word [ecx + 0xe], ax
call fcn.01022e22
mov ecx, dword [0x10e6bb8]
cmp ax, cx
jge 0x10583a9
push ebx
push 0x100bcfc
push esi
call fcn.01022e22
jmp 0x10583ab
mov eax, ecx
mov edx, dword [0x10e68f8]
cmp ax, dx
jle 0x10583df
push ebx
push 0x100bcfc
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bb8]
cmp ax, cx
jge 0x10583db
push ebx
push 0x100bcfc
push esi
call fcn.01022e22
jmp 0x10583e1
mov eax, ecx
jmp 0x10583e1
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100bcd0
push esi
mov word [ecx + 0x10], ax
call fcn.01022e22
mov ecx, dword [0x10e6bba]
cmp ax, cx
jge 0x1058410
push ebx
push 0x100bcd0
push esi
call fcn.01022e22
jmp 0x1058412
mov eax, ecx
mov edx, dword [0x10e68fa]
cmp ax, dx
jle 0x1058446
push ebx
push 0x100bcd0
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bba]
cmp ax, cx
jge 0x1058442
push ebx
push 0x100bcd0
push esi
call fcn.01022e22
jmp 0x1058448
mov eax, ecx
jmp 0x1058448
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100bcb4
push esi
mov word [ecx + 0x12], ax
call fcn.01022e22
mov ecx, dword [0x10e6bbc]
cmp ax, cx
jge 0x1058477
push ebx
push 0x100bcb4
push esi
call fcn.01022e22
jmp 0x1058479
mov eax, ecx
mov edx, dword [0x10e68fc]
cmp ax, dx
jle 0x10584ad
push ebx
push 0x100bcb4
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bbc]
cmp ax, cx
jge 0x10584a9
push ebx
push 0x100bcb4
push esi
call fcn.01022e22
jmp 0x10584af
mov eax, ecx
jmp 0x10584af
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100bc98
push esi
mov word [ecx + 0x14], ax
call fcn.01022e22
mov ecx, dword [0x10e6bbe]
cmp ax, cx
jge 0x10584de
push ebx
push 0x100bc98
push esi
call fcn.01022e22
jmp 0x10584e0
mov eax, ecx
mov edx, dword [0x10e68fe]
cmp ax, dx
jle 0x1058514
push ebx
push 0x100bc98
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bbe]
cmp ax, cx
jge 0x1058510
push ebx
push 0x100bc98
push esi
call fcn.01022e22
jmp 0x1058516
mov eax, ecx
jmp 0x1058516
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100bc80
push esi
mov word [ecx + 0x16], ax
call fcn.01022e22
mov ecx, dword [0x10e6bc0]
cmp ax, cx
jge 0x1058545
push ebx
push 0x100bc80
push esi
call fcn.01022e22
jmp 0x1058547
mov eax, ecx
mov edx, dword [0x10e6900]
cmp ax, dx
jle 0x105857b
push ebx
push 0x100bc80
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bc0]
cmp ax, cx
jge 0x1058577
push ebx
push 0x100bc80
push esi
call fcn.01022e22
jmp 0x105857d
mov eax, ecx
jmp 0x105857d
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100bc58
push esi
mov word [ecx + 0x18], ax
call fcn.01022e22
mov ecx, dword [0x10e6bc4]
cmp ax, cx
jge 0x10585ac
push ebx
push 0x100bc58
push esi
call fcn.01022e22
jmp 0x10585ae
mov eax, ecx
mov edx, dword [0x10e6904]
cmp ax, dx
jle 0x10585e2
push ebx
push 0x100bc58
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bc4]
cmp ax, cx
jge 0x10585de
push ebx
push 0x100bc58
push esi
call fcn.01022e22
jmp 0x10585e4
mov eax, ecx
jmp 0x10585e4
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b7e0
push esi
mov word [ecx + 0x1c], ax
call fcn.01022e22
mov ecx, dword [0x10e6bc6]
cmp ax, cx
jge 0x1058613
push ebx
push 0x100b7e0
push esi
call fcn.01022e22
jmp 0x1058615
mov eax, ecx
mov edx, dword [0x10e6906]
cmp ax, dx
jle 0x1058649
push ebx
push 0x100b7e0
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bc6]
cmp ax, cx
jge 0x1058645
push ebx
push 0x100b7e0
push esi
call fcn.01022e22
jmp 0x105864b
mov eax, ecx
jmp 0x105864b
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100bc40
push ebx
push esi
mov word [ecx + 0x1e], ax
call fcn.01022e22
mov ecx, dword [0x10e6bc8]
cmp ax, cx
jge 0x1058679
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x105867b
mov eax, ecx
mov edx, dword [0x10e6908]
cmp ax, dx
jle 0x10586a9
push 0
push ebx
push esi
call fcn.01022e22
mov ecx, dword [0x10e6bc8]
cmp ax, cx
jge 0x10586a5
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x10586ab
mov eax, ecx
jmp 0x10586ab
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100bc28
push ebx
push esi
mov word [ecx + 0x20], ax
call fcn.01022e22
mov ecx, dword [0x10e6c06]
cmp ax, cx
jge 0x10586d9
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x10586db
mov eax, ecx
mov edx, dword [0x10e6946]
cmp ax, dx
jle 0x1058709
push 0
push ebx
push esi
call fcn.01022e22
mov ecx, dword [0x10e6c06]
cmp ax, cx
jge 0x1058705
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x105870b
mov eax, ecx
jmp 0x105870b
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 1
push 0x100bc0c
push esi
mov word [ecx + 0x5e], ax
call fcn.01022e22
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100bbe4
push ebx
push esi
mov word [ecx + 0x6c], ax
call fcn.01022e22
mov ecx, dword [0x10e6c08]
cmp ax, cx
jge 0x1058750
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x1058752
mov eax, ecx
mov edx, dword [0x10e6948]
cmp ax, dx
jle 0x1058780
push 0
push ebx
push esi
call fcn.01022e22
mov ecx, dword [0x10e6c08]
cmp ax, cx
jge 0x105877c
push 0
push ebx
push esi
call fcn.01022e22
jmp 0x1058782
mov eax, ecx
jmp 0x1058782
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 1
mov ebx, 0x100bbb8
push ebx
push esi
mov word [ecx + 0x60], ax
call fcn.01022e22
mov ecx, dword [0x10e6c0a]
cmp ax, cx
jge 0x10587b0
push 1
push ebx
push esi
call fcn.01022e22
jmp 0x10587b2
mov eax, ecx
mov edx, dword [0x10e694a]
cmp ax, dx
jle 0x10587e0
push 1
push ebx
push esi
call fcn.01022e22
mov ecx, dword [0x10e6c0a]
cmp ax, cx
jge 0x10587dc
push 1
push ebx
push esi
call fcn.01022e22
jmp 0x10587e2
mov eax, ecx
jmp 0x10587e2
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 2
push 0x100bb90
push 0x100bb78
mov word [ecx + 0x62], ax
call fcn.01022e22
mov ecx, dword [edi + 0xb90]
movsx eax, ax
add ecx, 0x9c
shl eax, 5
xor eax, dword [ecx]
push 2
mov ebx, 0x100bb64
push ebx
and eax, 0x60
xor dword [ecx], eax
push esi
call fcn.01022e22
push 2
push ebx
push esi
call fcn.01022e22
push 1
push 0x100bb18
push esi
call fcn.01022e22
mov ecx, dword [edi + 0xb90]
movzx eax, ax
add ecx, 0x9c
shl eax, 0x11
xor eax, dword [ecx]
and eax, 0x20000
xor dword [ecx], eax
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0x2000000
push eax
push eax
push eax
push 0x100ba58
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1058890
push 0x100ba18
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.010233b6
push 0
push 0x100bae0
push esi
call fcn.01022e22
mov ecx, dword [edi + 0xb90]
add ecx, 0x9c
xor edx, edx
test ax, ax
setne dl
push 1
push 0x100baac
push esi
movsx eax, dx
shl eax, 0x13
xor eax, dword [ecx]
and eax, 0x80000
xor dword [ecx], eax
call fcn.01022e22
mov edi, dword [edi + 0xb90]
xor edx, edx
test ax, ax
setne dl
lea ecx, [edi + 0x9c]
pop edi
pop esi
pop ebx
movsx eax, dx
shl eax, 0x12
xor eax, dword [ecx]
and eax, 0x40000
xor dword [ecx], eax
leave
ret