Function at 0x10005853
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001816f
mov eax, dword fs:[0]
push eax
mov eax, 0x2254
call fcn.10016da0
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2260], ecx
mov dword [ebp - 0x222c], ebx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e31
push 0x7d
pop eax
cmp word [edi], ax
je 0x10005e20
xor eax, eax
inc eax
push 0x10020750
push edi
mov dword [ebp - 0x2230], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x10020724
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10005908
test ebx, ebx
je 0x100059be
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x100059c0
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x2244], esi
mov dword [ebp - 0x223c], esi
call fcn.10004dae
test eax, eax
jne 0x10005e1b
push edi
call fcn.1000546a
test eax, eax
je 0x1000597b
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2244]
push edi
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], esi
call fcn.1000554c
mov dword [ebp - 0x2244], esi
mov dword [ebp - 0x223c], esi
test ebx, ebx
je 0x100059b6
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
push edi
mov ecx, ebx
call fcn.10005405
mov esi, eax
test esi, esi
js 0x10005e20
xor eax, eax
mov dword [ebp - 0x2240], eax
jmp 0x10005bd2
mov dword [ebp - 0x2240], esi
jmp 0x100059c0
xor esi, esi
push 0x1002073c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x221c]
test eax, eax
jne 0x100059ee
push edi
mov ecx, ebx
mov dword [ebp - 0x2230], esi
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
push 0x1002071c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10005b37
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
push edi
mov ecx, ebx
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10005e1b
cmp dword [ebp + 0x10], 0
je 0x10005aa0
xor eax, eax
mov ecx, ebx
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x225c], eax
xor eax, eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x225c]
push eax
call fcn.10004f8c
mov esi, eax
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
test esi, esi
js 0x10005e20
mov byte [ebp - 4], al
mov dword [ebp - 0x2258], eax
jmp 0x10005bd2
cmp dword [ebp + 0x14], 0
jne 0x10005b20
cmp dword [ebp - 0x2230], 0
je 0x10005b20
xor esi, esi
lea ecx, [ebp - 0x2250]
push 0x20006
push esi
push dword [ebp - 0x2220]
mov dword [ebp - 0x2250], esi
mov dword [ebp - 0x224c], esi
mov dword [ebp - 0x2248], esi
call fcn.100054fc
test eax, eax
jne 0x10005dfb
mov ebx, dword [ebp - 0x2250]
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10005b03
cmp eax, 2
jne 0x10005deb
test ebx, ebx
je 0x10005b14
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2250], esi
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x224c], esi
push edi
mov ecx, ebx
call fcn.10005405
mov esi, eax
test esi, esi
js 0x10005e20
jmp 0x10005dda
push 0x5c
pop edx
mov ecx, edi
call fcn.10004dae
test eax, eax
jne 0x10005e1b
cmp dword [ebp + 0x10], eax
je 0x10005c2c
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
push 0x2001f
push edi
push esi
call fcn.100054fc
test eax, eax
je 0x10005b9c
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.100054fc
test eax, eax
je 0x10005b9c
sub esp, 0x14
lea ecx, [ebp - 0x222c]
push edi
push esi
call fcn.10004e5b
test eax, eax
jne 0x10005d33
push edi
mov ecx, ebx
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10005bd2
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x222c]
push eax
call fcn.10004f8c
mov esi, eax
test esi, esi
js 0x10005e20
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10005dda
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2260]
jne 0x10005be3
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x10005ddd
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x222c]
push edi
call fcn.10005853
mov esi, eax
test esi, esi
js 0x10005e20
push edi
mov ecx, ebx
call fcn.100056f8
jmp 0x10005b28
cmp dword [ebp + 0x14], 0
jne 0x10005c4b
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
call fcn.100054fc
jmp 0x10005c4e
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [ebp - 0x2234], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp - 0x218]
push edi
push 0x104
push eax
mov dword [ebp - 0x2238], ecx
call fcn.1000bb8a
push eax
call fcn.100053ca
add esp, 0x14
mov ecx, ebx
push edi
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
push edi
mov ecx, ebx
call fcn.10005405
mov esi, eax
test esi, esi
js 0x10005e20
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10005d10
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10005cb5
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x10005d10
push dword [ebp - 0x2238]
mov ecx, dword [ebp - 0x221c]
push ebx
mov ebx, dword [ebp - 0x222c]
push ebx
push edi
call fcn.10005853
mov esi, eax
test esi, esi
jns 0x10005cf8
cmp dword [ebp - 0x2238], 0
je 0x10005e20
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.100056f8
mov esi, eax
test esi, esi
js 0x10005e20
jmp 0x10005d16
mov ebx, dword [ebp - 0x222c]
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x10005dda
test eax, eax
je 0x10005d41
cmp dword [ebp + 0x14], 0
jne 0x10005dda
mov ecx, eax
call fcn.100056ea
mov esi, eax
jmp 0x10005e20
cmp dword [ebp + 0x14], 0
je 0x10005d7e
push ebx
call fcn.10005621
test eax, eax
je 0x10005d7e
lea eax, [ebp - 0x218]
push eax
call fcn.1000546a
test eax, eax
je 0x10005dda
cmp dword [ebp - 0x2230], 0
je 0x10005dda
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x222c]
call fcn.1000554c
jmp 0x10005dda
push ebx
call fcn.10005621
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2234], ecx
test ebx, ebx
je 0x10005da7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x222c], ecx
mov ecx, dword [ebp - 0x2234]
xor edx, edx
mov dword [ebp - 0x2228], edx
test eax, eax
jne 0x10005d33
cmp dword [ebp - 0x2230], edx
je 0x10005dda
test ecx, ecx
jne 0x10005dda
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x10005d33
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [edi], cx
jne 0x100058d9
jmp 0x10005e20
mov ecx, eax
call fcn.100056ea
mov esi, eax
test ebx, ebx
je 0x10005e20
push ebx
jmp 0x10005e13
mov ecx, eax
call fcn.100056ea
cmp dword [ebp - 0x2250], 0
mov esi, eax
je 0x10005e20
push dword [ebp - 0x2250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005e20
mov esi, 0x80020009
mov eax, dword [ebp - 0x222c]
test eax, eax
je 0x10005e31
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000679e
leave
ret 0x10