Function at 0x10071fca
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x220c]
mov eax, 0x220c
call fcn.100b4600
push 0xffffffffffffffff
push 0x101096fc
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x2208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x2218]
mov edi, dword [ebp + 0x2214]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0x2220]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], eax
call fcn.10070791
mov esi, eax
cmp esi, ebx
jmp 0x10072477
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x102864cc
push edi
mov dword [ebp - 0x28], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x1007206c
test ebx, ebx
je 0x10072106
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x100724d2
cmp dword [ebp + 0x221c], 0
je 0x10072106
xor esi, esi
push 0x5c
push edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.10070721
pop ecx
pop ecx
test eax, eax
jne 0x10072485
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1007089f
test eax, eax
je 0x100720c7
mov eax, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
call fcn.10070a96
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
cmp ebx, esi
je 0x100720fe
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x10072494
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070900
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.10068245
test esi, esi
jl 0x100724d2
jmp 0x10072435
lea ecx, [ebp - 0x24]
call fcn.10068245
push 0x102864dc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007212c
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x28], eax
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x100724d2
push 0x10286508
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10072212
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.10070791
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x100724d2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070791
mov esi, eax
cmp esi, ebx
jl 0x100724d2
cmp word [edi], 0x3d
jne 0x1007248d
cmp dword [ebp + 0x221c], ebx
je 0x100721b6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
push edi
lea eax, [ebp]
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], ebx
call fcn.10071ce6
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x40]
jl 0x100724cd
mov byte [ebp - 4], bl
jmp 0x10072430
cmp dword [ebp + 0x2220], ebx
jne 0x10072204
cmp dword [ebp - 0x28], ebx
je 0x10072204
push 0x20006
push ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.10068260
cmp eax, ebx
jne 0x10072499
lea eax, [ebp]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x100721fc
cmp eax, 2
jne 0x10072499
lea ecx, [ebp - 0x30]
call fcn.10068245
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070900
jmp 0x10072033
push 0x5c
push edi
call fcn.10070721
pop ecx
pop ecx
test eax, eax
jne 0x1007248d
cmp dword [ebp + 0x221c], eax
je 0x100722a7
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.10068260
test eax, eax
je 0x10072274
push 0x20019
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.10068260
test eax, eax
je 0x10072274
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.10070446
mov esi, eax
cmp esi, ebx
jne 0x100724a5
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x100724d2
cmp word [edi], 0x3d
jne 0x10072435
mov ecx, dword [ebp - 0x10]
push edi
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.10071ce6
mov esi, eax
jmp 0x100720f1
cmp dword [ebp + 0x2220], 0
jne 0x100722c5
push 0x20019
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.10068260
mov ebx, eax
jmp 0x100722c8
push 2
pop ebx
test ebx, ebx
je 0x100722d6
mov dword [ebp + 0x2220], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2000]
push 0x104
push eax
call fcn.100b452c
push eax
call fcn.100050f0
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x100724d2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070900
mov esi, eax
test esi, esi
jl 0x100724d2
cmp word [edi], 0x7b
jne 0x10072365
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10072365
push dword [ebp + 0x2220]
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x1c]
push edi
call fcn.10071fca
mov esi, eax
test esi, esi
jge 0x10072352
cmp dword [ebp + 0x2220], 0
je 0x100724d2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x100724d2
mov eax, dword [ebp - 0x44]
mov dword [ebp + 0x2220], eax
cmp ebx, 2
je 0x10072479
test ebx, ebx
je 0x10072391
test eax, eax
jne 0x10072479
push ebx
call fcn.10070323
pop ecx
mov esi, eax
jmp 0x100724d2
test eax, eax
je 0x100723d9
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
call fcn.100708cb
test eax, eax
je 0x100723d9
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x2000]
push eax
call fcn.1007089f
test eax, eax
je 0x10072479
cmp dword [ebp - 0x28], 0
je 0x10072479
lea eax, [ebp + 0x2000]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10070a96
jmp 0x10072479
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
call fcn.100708cb
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x48], eax
call fcn.10068245
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x100724b6
cmp dword [ebp - 0x28], eax
je 0x10072479
cmp dword [ebp - 0x48], eax
jne 0x10072479
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x2000]
mov dword [ebp - 0x38], ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.100703eb
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
test eax, eax
jne 0x100724c1
lea ecx, [ebp - 0x38]
call fcn.10068245
cmp dword [ebp + 0x221c], 0
je 0x10072479
cmp word [edi], 0x7b
jne 0x10072479
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10072479
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x221c]
push dword [ebp - 0x1c]
push edi
call fcn.10071fca
mov esi, eax
test esi, esi
jl 0x100724d2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10070791
mov esi, eax
test esi, esi
jl 0x100724d2
cmp word [edi], 0x7d
jne 0x1007203c
jmp 0x100724d2
lea ecx, [ebp - 0x24]
call fcn.10068245
mov esi, 0x80020009
jmp 0x100724d2
lea ecx, [ebp - 0x24]
jmp 0x100724cd
push eax
call fcn.10070323
pop ecx
lea ecx, [ebp - 0x30]
jmp 0x100724cb
lea ecx, [ebp - 0x1c]
call fcn.10068245
push esi
call fcn.10070323
pop ecx
jmp 0x100724dc
lea ecx, [ebp - 0x1c]
call fcn.10068245
push ebx
jmp 0x100724ae
push eax
call fcn.10070323
pop ecx
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.10068245
lea ecx, [ebp - 0x1c]
call fcn.10068245
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2208]
xor ecx, ebp
call fcn.100b2738
add ebp, 0x220c
leave
ret 0x10