Function at 0x10003d43
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1108]
mov eax, 0x1108
call fcn.10007db0
push 0xffffffffffffffff
push 0x1001228a
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100184c0]
xor eax, ebp
mov dword [ebp + 0x1104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1114]
mov edi, dword [ebp + 0x1110]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0x111c]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], eax
call fcn.100018ce
mov esi, eax
cmp esi, ebx
jmp 0x100041e0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [ebp - 0x28], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x10003de5
test ebx, ebx
je 0x10003e7f
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x1000423a
cmp dword [ebp + 0x1118], 0
je 0x10003e7f
xor esi, esi
push 0x5c
push edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.10001866
pop ecx
pop ecx
test eax, eax
jne 0x100041ed
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100019b8
test eax, eax
je 0x10003e40
mov eax, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
call fcn.1000237e
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
cmp ebx, esi
je 0x10003e77
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x100041fc
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10001a19
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.1000153a
test esi, esi
jl 0x1000423a
jmp 0x1000419f
lea ecx, [ebp - 0x24]
call fcn.1000153a
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10003ea5
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x28], eax
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x1000423a
push 0x100132f8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10003f8a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.100018ce
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x1000423a
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100018ce
mov esi, eax
cmp esi, ebx
jl 0x1000423a
cmp byte [edi], 0x3d
jne 0x100041f5
cmp dword [ebp + 0x1118], ebx
je 0x10003f2e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
push edi
lea eax, [ebp]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], ebx
call fcn.100039d6
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x38]
jl 0x10004235
mov byte [ebp - 4], bl
jmp 0x1000419a
cmp dword [ebp + 0x111c], ebx
jne 0x10003f7c
cmp dword [ebp - 0x28], ebx
je 0x10003f7c
push 0x20006
push ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.100015a3
cmp eax, ebx
jne 0x10004201
lea eax, [ebp]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x10003f74
cmp eax, 2
jne 0x10004201
lea ecx, [ebp - 0x30]
call fcn.1000153a
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10001a19
jmp 0x10003dac
push 0x5c
push edi
call fcn.10001866
pop ecx
pop ecx
test eax, eax
jne 0x100041f5
cmp dword [ebp + 0x1118], eax
je 0x1000401e
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.100015a3
test eax, eax
je 0x10003fec
push 0x20019
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.100015a3
test eax, eax
je 0x10003fec
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.10001555
mov esi, eax
cmp esi, ebx
jne 0x1000420d
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x1000423a
cmp byte [edi], 0x3d
jne 0x1000419f
mov ecx, dword [ebp - 0x10]
push edi
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.100039d6
mov esi, eax
jmp 0x10003e6a
cmp dword [ebp + 0x111c], 0
jne 0x1000403c
push 0x20019
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.100015a3
mov ebx, eax
jmp 0x1000403f
push 2
pop ebx
test ebx, ebx
je 0x1000404d
mov dword [ebp + 0x111c], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x1000]
push 0x104
push eax
call fcn.100074c9
push eax
call fcn.100013b8
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x1000423a
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10001a19
mov esi, eax
test esi, esi
jl 0x1000423a
cmp byte [edi], 0x7b
jne 0x100040db
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x100040db
push dword [ebp + 0x111c]
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x1c]
push edi
call fcn.10003d43
mov esi, eax
test esi, esi
jge 0x100040c8
cmp dword [ebp + 0x111c], 0
je 0x1000423a
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x1000423a
mov eax, dword [ebp - 0x44]
mov dword [ebp + 0x111c], eax
cmp ebx, 2
je 0x100041e2
test ebx, ebx
je 0x10004107
test eax, eax
jne 0x100041e2
push ebx
call fcn.100014d9
pop ecx
mov esi, eax
jmp 0x1000423a
test eax, eax
je 0x1000414f
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
call fcn.100019e4
test eax, eax
je 0x1000414f
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x1000]
push eax
call fcn.100019b8
test eax, eax
je 0x100041e2
cmp dword [ebp - 0x28], 0
je 0x100041e2
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000237e
jmp 0x100041e2
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
call fcn.100019e4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x48], eax
call fcn.1000153a
mov ebx, eax
test ebx, ebx
jne 0x1000421e
cmp dword [ebp - 0x28], eax
je 0x100041e2
cmp dword [ebp - 0x48], eax
jne 0x100041e2
lea eax, [ebp + 0x1000]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp - 0x40], ebx
and dword [ebp - 0x3c], ebx
test eax, eax
jne 0x10004229
lea ecx, [ebp - 0x40]
call fcn.1000153a
cmp dword [ebp + 0x1118], 0
je 0x100041e2
cmp byte [edi], 0x7b
jne 0x100041e2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x100041e2
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x1118]
push dword [ebp - 0x1c]
push edi
call fcn.10003d43
mov esi, eax
test esi, esi
jl 0x1000423a
mov ecx, dword [ebp - 0x10]
push edi
call fcn.100018ce
mov esi, eax
test esi, esi
jl 0x1000423a
cmp byte [edi], 0x7d
jne 0x10003db5
jmp 0x1000423a
lea ecx, [ebp - 0x24]
call fcn.1000153a
mov esi, 0x80020009
jmp 0x1000423a
lea ecx, [ebp - 0x24]
jmp 0x10004235
push eax
call fcn.100014d9
pop ecx
lea ecx, [ebp - 0x30]
jmp 0x10004233
lea ecx, [ebp - 0x1c]
call fcn.1000153a
push esi
call fcn.100014d9
pop ecx
jmp 0x10004244
lea ecx, [ebp - 0x1c]
call fcn.1000153a
push ebx
jmp 0x10004216
push eax
call fcn.100014d9
pop ecx
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.1000153a
lea ecx, [ebp - 0x1c]
call fcn.1000153a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1104]
xor ecx, ebp
call fcn.10005c1b
add ebp, 0x1108
leave
ret 0x10