Function at 0x10008aa0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1150
call fcn.1000bed0
mov eax, dword [0x10028164]
xor eax, esp
mov dword [esp + 0x114c], eax
mov eax, dword [esp + 0x1158]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1160]
mov ebp, ecx
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009098
cmp byte [edi], 0x7d
push ebx
je 0x10009086
push str.Delete
push edi
mov dword [esp + 0x28], 1
call dword [sym.imp.kernel32.dll_lstrcmpiA]
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
je 0x10008b32
test ebx, ebx
je 0x10008c23
push edi
mov ecx, ebp
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
cmp dword [esp + 0x116c], 0
je 0x10008c23
mov al, byte [edi]
mov ecx, edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
test al, al
je 0x10008b8f
cmp al, 0x5c
je 0x10008b87
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x10008b72
jmp 0x10008b8f
test ecx, ecx
jne 0x1000904a
mov esi, 0x1001f9c8
push dword [esi]
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
je 0x10008be6
add esi, 4
cmp esi, 0x1001f9f8
jl 0x10008b94
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.100085d0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
test ebx, ebx
je 0x10008c1b
push edi
mov ecx, ebp
call fcn.10007110
mov esi, eax
test esi, esi
js 0x1000905a
push edi
mov ecx, ebp
call fcn.10009800
mov esi, eax
test esi, esi
js 0x1000905a
mov dword [esp + 0x28], 0
jmp 0x10008e47
mov dword [esp + 0x28], 0
push str.NoRemove
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x10008c4d
xor ebx, ebx
mov ecx, ebp
push edi
mov dword [esp + 0x24], ebx
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
jmp 0x10008c51
mov ebx, dword [esp + 0x20]
push 0x1001f4b4
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x10008d94
lea eax, [esp + 0x15c]
mov ecx, ebp
push eax
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
push edi
mov ecx, ebp
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
cmp byte [edi], 0x3d
jne 0x10009053
cmp dword [esp + 0x116c], 0
je 0x10008d00
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x15c]
push edi
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], ebx
push eax
mov ecx, ebp
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.10002ec0
mov esi, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
test esi, esi
jns 0x10008e47
lea ecx, [esp + 0x40]
call fcn.100025c0
jmp 0x10009086
cmp dword [esp + 0x1170], 0
jne 0x10008d7d
test ebx, ebx
je 0x10008d7d
push 0x20006
push 0
push dword [esp + 0x18]
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.10007520
test eax, eax
jne 0x10009065
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x15c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x10008d62
cmp eax, 2
jne 0x10009065
test esi, esi
je 0x10008d75
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
push edi
mov ecx, ebp
call fcn.10009800
mov esi, eax
test esi, esi
js 0x10009086
jmp 0x1000903f
mov al, byte [edi]
mov ecx, edi
test al, al
je 0x10008dbd
nop dword [eax]
cmp al, 0x5c
je 0x10008db5
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x10008da0
jmp 0x10008dbd
test ecx, ecx
jne 0x10009053
cmp dword [esp + 0x116c], 0
je 0x10008e9d
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0x2001f
push edi
push ebx
call fcn.10007520
test eax, eax
je 0x10008e17
push 0x20019
push edi
push ebx
lea ecx, [esp + 0x20]
call fcn.10007520
test eax, eax
je 0x10008e17
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push ebx
lea ecx, [esp + 0x30]
call fcn.10004cb0
test eax, eax
jne 0x1000907b
push edi
mov ecx, ebp
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
cmp byte [edi], 0x3d
jne 0x10008e47
push edi
push 0
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call fcn.10002ec0
mov esi, eax
test esi, esi
js 0x10009086
cmp byte [edi], 0x7b
jne 0x1000903f
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008e55
sub ecx, edx
cmp ecx, 1
jne 0x1000903f
push 0
push dword [esp + 0x1170]
mov ecx, ebp
push dword [esp + 0x1c]
push edi
call fcn.10008aa0
mov esi, eax
test esi, esi
js 0x10009086
push edi
mov ecx, ebp
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
jmp 0x1000903f
mov esi, dword [esp + 0x1170]
test esi, esi
jne 0x10008ebf
push 0x20019
push edi
push dword [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.10007520
mov ebx, eax
jmp 0x10008ec4
mov ebx, 2
test ebx, ebx
mov ecx, 1
push 0xffffffffffffffff
mov eax, esi
cmovne eax, ecx
push edi
mov dword [esp + 0x38], eax
lea eax, [esp + 0x60]
push 0x104
push eax
call fcn.10015c92
push eax
call fcn.10003880
add esp, 0x14
mov ecx, ebp
push edi
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
push edi
mov ecx, ebp
call fcn.10009800
mov esi, eax
test esi, esi
js 0x10009086
cmp byte [edi], 0x7b
jne 0x10008f63
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f20
sub ecx, edx
cmp ecx, 1
jne 0x10008f63
push dword [esp + 0x30]
mov ecx, ebp
push 0
push dword [esp + 0x1c]
push edi
call fcn.10008aa0
mov esi, eax
test esi, esi
jns 0x10008f51
cmp dword [esp + 0x30], 0
je 0x10009086
push edi
mov ecx, ebp
call fcn.10007110
mov esi, eax
test esi, esi
js 0x10009086
cmp ebx, 2
je 0x1000903f
test ebx, ebx
je 0x10008f84
cmp dword [esp + 0x1170], 0
jne 0x1000903f
push ebx
jmp 0x1000907c
cmp dword [esp + 0x1170], 0
je 0x10008fcc
push dword [esp + 0x14]
mov ecx, ebp
call fcn.100064b0
test eax, eax
je 0x10008fcc
lea eax, [esp + 0x58]
mov ecx, ebp
push eax
call fcn.100049f0
test eax, eax
je 0x1000903f
cmp dword [esp + 0x20], 0
je 0x1000903f
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
call fcn.100085d0
jmp 0x1000903f
push dword [esp + 0x14]
mov ecx, ebp
call fcn.100064b0
mov ecx, dword [esp + 0x14]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x10008ff0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
test eax, eax
jne 0x1000907b
cmp dword [esp + 0x20], eax
je 0x1000903f
test ebx, ebx
jne 0x1000903f
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.10004ed0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov ebx, eax
call fcn.100025c0
test ebx, ebx
jne 0x10008f7e
cmp byte [edi], 0x7d
jne 0x10008b01
jmp 0x10009086
lea ecx, [esp + 0x24]
call fcn.100025c0
mov esi, 0x80020009
jmp 0x10009086
lea ecx, [esp + 0x24]
call fcn.100025c0
jmp 0x10009086
push eax
call fcn.10003940
add esp, 4
lea ecx, [esp + 0x34]
mov esi, eax
call fcn.100025c0
jmp 0x10009086
push eax
call fcn.10003940
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x14]
pop ebx
test eax, eax
je 0x10009096
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x1158]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1000bc54
add esp, 0x1150
ret 0x10