Function at 0x10008175
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1108]
mov eax, 0x1108
call fcn.1000b740
push 0xffffffffffffffff
push 0x1000cbf2
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10016114]
xor eax, ebp
mov dword [ebp + 0x1104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x1114]
mov edi, dword [ebp + 0x1110]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push edi
mov dword [ebp - 4], eax
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
cmp byte [edi], 0x7d
je 0x1000865e
xor eax, eax
inc eax
push 0x1000e8d4
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
neg eax
push 0x1000e894
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
je 0x1000821c
test esi, esi
je 0x100082bb
push edi
mov ecx, ebx
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
xor esi, esi
cmp dword [ebp + 0x1118], esi
je 0x100082bd
push 0x5c
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.1000936f
pop ecx
pop ecx
test eax, eax
jne 0x10008651
push edi
mov ecx, ebx
call fcn.100042c1
test eax, eax
je 0x1000827b
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x30], eax
call fcn.10007ad6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x14], esi
je 0x100082b1
push edi
mov ecx, ebx
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000864c
push edi
mov ecx, ebx
call fcn.1000bb8b
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.100044c8
test esi, esi
js 0x1000865e
jmp 0x100085f4
lea ecx, [ebp - 0x30]
call fcn.100044c8
jmp 0x100082bd
xor esi, esi
push 0x1000e8b4
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x100082e2
push edi
mov ecx, ebx
mov dword [ebp - 0x18], esi
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
push 0x1000e87c
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x100083d5
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
push edi
mov ecx, ebx
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
cmp byte [edi], 0x3d
jne 0x10008659
cmp dword [ebp + 0x1118], 0
je 0x10008373
and dword [ebp - 0x3c], 0
xor eax, eax
and dword [ebp - 0x38], 0
inc eax
mov byte [ebp - 4], al
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp]
push edi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10003711
mov esi, eax
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
test esi, esi
js 0x10008699
mov byte [ebp - 4], al
jmp 0x100085ef
cmp dword [ebp + 0x111c], 0
jne 0x100083c8
cmp dword [ebp - 0x18], 0
je 0x100083c8
xor eax, eax
lea ecx, [ebp - 0x4c]
push 0x20006
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
call fcn.1000bb8b
test eax, eax
jne 0x1000868d
lea eax, [ebp]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x100083c0
cmp eax, 2
jne 0x1000868d
lea ecx, [ebp - 0x4c]
call fcn.100044c8
push edi
mov ecx, ebx
call fcn.1000bb8b
jmp 0x10008638
push 0x5c
push edi
call fcn.1000936f
pop ecx
pop ecx
test eax, eax
jne 0x10008659
cmp dword [ebp + 0x1118], eax
je 0x10008465
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
push 0x2001f
push edi
push esi
call fcn.1000bb8b
test eax, eax
je 0x10008435
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x24]
call fcn.1000bb8b
test eax, eax
je 0x10008435
xor eax, eax
lea ecx, [ebp - 0x24]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.1000bb8b
test eax, eax
jne 0x10008543
push edi
mov ecx, ebx
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
cmp byte [edi], 0x3d
jne 0x100085f4
push edi
push 0
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.10003711
mov esi, eax
jmp 0x100082a4
cmp dword [ebp + 0x111c], 0
jne 0x10008481
push 0x20019
push edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.1000bb8b
jmp 0x10008484
push 2
pop eax
mov ecx, dword [ebp + 0x111c]
test eax, eax
push 1
mov dword [ebp - 0x14], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp + 0x1000]
push edi
push 0x104
push eax
mov dword [ebp - 0x34], ecx
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
push eax
call fcn.10003d66
add esp, 0x14
mov ecx, ebx
push edi
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
push edi
mov ecx, ebx
call fcn.1000bb8b
mov esi, eax
test esi, esi
js 0x1000865e
cmp byte [edi], 0x7b
jne 0x10008526
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100084e4
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x10008526
push dword [ebp - 0x34]
mov ecx, ebx
push 0
push dword [ebp - 0x24]
push edi
call fcn.10008175
mov esi, eax
test esi, esi
jns 0x10008514
cmp dword [ebp - 0x34], 0
je 0x1000865e
push edi
mov ecx, ebx
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x1000863e
test eax, eax
je 0x10008551
cmp dword [ebp + 0x111c], 0
jne 0x1000863e
push eax
call fcn.10003e28
pop ecx
mov esi, eax
jmp 0x1000865e
cmp dword [ebp + 0x111c], 0
je 0x1000859c
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.1000bb8b
test eax, eax
je 0x1000859c
lea eax, [ebp + 0x1000]
mov ecx, ebx
push eax
call fcn.100042c1
test eax, eax
je 0x1000863e
cmp dword [ebp - 0x18], 0
je 0x1000863e
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x24]
call fcn.10007ad6
jmp 0x1000863e
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.1000bb8b
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
call fcn.100044c8
test eax, eax
jne 0x10008543
cmp dword [ebp - 0x18], eax
je 0x1000863e
cmp dword [ebp - 0x14], eax
jne 0x1000863e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x58]
and dword [ebp - 0x54], 0
and dword [ebp - 0x50], 0
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x1000]
push eax
call fcn.10005152
and dword [ebp - 0x58], 0
test eax, eax
jne 0x100086a0
lea ecx, [ebp - 0x58]
call fcn.100044c8
cmp dword [ebp + 0x1118], 0
je 0x1000863e
cmp byte [edi], 0x7b
jne 0x1000863e
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008607
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x10008641
push 0
push dword [ebp + 0x1118]
mov ecx, ebx
push dword [ebp - 0x24]
push edi
call fcn.10008175
mov esi, eax
test esi, esi
js 0x1000865e
push edi
mov ecx, ebx
call fcn.10006890
mov esi, eax
test esi, esi
js 0x1000865e
xor eax, eax
inc eax
cmp byte [edi], 0x7d
jne 0x100081ed
jmp 0x1000865e
lea ecx, [ebp - 0x30]
jmp 0x10008699
lea ecx, [ebp - 0x30]
call fcn.100044c8
mov esi, 0x80020009
lea ecx, [ebp - 0x24]
call fcn.100044c8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1104]
xor ecx, ebp
call fcn.1000b5fc
add ebp, 0x1108
leave
ret 0x10
push eax
call fcn.10003e28
pop ecx
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.100044c8
jmp 0x1000865e
push eax
call fcn.10003e28
pop ecx
lea ecx, [ebp - 0x58]
jmp 0x10008697