Function at 0x1002d175
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e573
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x118
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002d366
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa0], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xe4]
movzx eax, byte [eax]
test eax, eax
je 0x1002d1e8
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1002d361
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x8c], 0x478c
mov dword [ebp - 0xe0], 0x10009c58
cmp dword [ebp - 0x8c], 0x4819
jle 0x1002d2db
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
and dword [ebp - 0x2c], 0
jmp 0x1002d247
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1f4f
jge 0x1002d2db
and dword [ebp - 0x24], 0
jmp 0x1002d261
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x763d
jge 0x1002d2d6
and dword [ebp - 0x3c], 0
jmp 0x1002d277
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x42a1
jge 0x1002d2d4
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x3c]
cdq
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], edx
push dword [ebp - 0x100]
push dword [ebp - 0x104]
lea ecx, [ebp - 0x128]
call fcn.1000d330
pop ecx
pop ecx
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
call fcn.1000e78f
push eax
call fcn.10048556
pop ecx
lea ecx, [ebp - 0x128]
call fcn.1000e785
jmp 0x1002d270
jmp 0x1002d25a
jmp 0x1002d240
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xc8], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x8c], 0x450b
jge 0x1002d303
push dword [ebp - 0xe0]
call fcn.10048556
pop ecx
jmp 0x1002d31f
or dword [ebp - 4], 0xffffffff
jmp 0x1002d329
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xf8]
mov esi, dword [ecx]
imul esi, dword [eax]
push 0
mov ecx, dword [ebp - 0xc8]
call fcn.1000e93c
mov dword [eax], esi
jmp 0x1002d7de
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb4], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xfc]
movzx eax, byte [eax]
test eax, eax
je 0x1002d4fe
mov dword [ebp - 0x20], 0x2fe22364
mov dword [ebp - 0x50], 0xfff9
mov dword [ebp - 0x34], 0
jmp 0x1002d3c2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1002d3d8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xf4], 0x55bb
jmp 0x1002d3bb
mov dword [ebp - 0x20], 0
jmp 0x1002d3e8
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1002d4f9
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x108], 0x72a8358b
mov dword [ebp - 0x70], 0x4b8a
mov dword [ebp - 0xd0], 0x10009ca0
cmp dword [ebp - 0x70], 0x4f5a
jle 0x1002d476
and dword [ebp - 0x28], 0
jmp 0x1002d42a
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x523e
jge 0x1002d476
and dword [ebp - 0x30], 0
jmp 0x1002d440
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x7187
jge 0x1002d474
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x30]
cdq
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], edx
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
mov ecx, 0x10607538
call fcn.1000e7af
jmp 0x1002d439
jmp 0x1002d423
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [ebp - 0x70], 0x47cd
jge 0x1002d4a0
mov edx, dword [ebp - 0xd0]
mov ecx, 0x10607538
call fcn.1001021f
jmp 0x1002d4bc
or dword [ebp - 4], 0xffffffff
jmp 0x1002d4c6
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xf4], 0
je 0x1002d4d5
jmp 0x1002d4f9
mov dword [ebp - 0x38], 0
jmp 0x1002d4e5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x1002d4f4
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
jmp 0x1002d4de
jmp 0x1002d3e1
jmp 0x1002d7de
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x10
jmp 0x1002d56b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0xffffffe3
jne 0x1002d7de
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x40], 0xbc8f9611
mov dword [ebp - 0x14], 0
jmp 0x1002d595
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1002d7d9
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0xdc], 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10c], eax
push 0
mov ecx, dword [ebp - 0x90]
call fcn.1000e93c
mov dword [eax], 0xdd63
mov eax, 0xdd63
test eax, eax
je 0x1002d623
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 0x151
jg 0x1002d5f2
push 0
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
cmp dword [eax], 0
jne 0x1002d60a
push 0
mov ecx, dword [ebp - 0x90]
call fcn.1000e93c
cmp dword [eax], 0
jne 0x1002d60a
and dword [ebp - 0x58], 0
jmp 0x1002d611
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0x930f
je 0x1002d623
mov dword [ebp - 0x78], 1
jmp 0x1002d627
and dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0x2092
jg 0x1002d639
mov dword [ebp - 0x60], 1
jmp 0x1002d63d
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0x40fff069
jge 0x1002d65f
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
cmp dword [eax], 0
jne 0x1002d65f
and dword [ebp - 0x88], 0
jmp 0x1002d669
mov dword [ebp - 0x88], 1
push 0
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
mov ecx, dword [ebp - 0x88]
sub ecx, dword [eax]
cmp ecx, 0xedc8
jl 0x1002d68c
mov dword [ebp - 0x68], 1
jmp 0x1002d690
and dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
jne 0x1002d69f
mov dword [ebp - 0x80], 1
jmp 0x1002d6a3
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x80]
sub esi, dword [eax]
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
sub esi, dword [eax]
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14]
jl 0x1002d6d6
mov dword [ebp - 0x4c], 1
jmp 0x1002d6da
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4c], eax
jle 0x1002d6eb
mov dword [ebp - 0x54], 1
jmp 0x1002d6ef
and dword [ebp - 0x54], 0
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [eax]
jle 0x1002d70a
mov dword [ebp - 0x5c], 1
jmp 0x1002d70e
and dword [ebp - 0x5c], 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [eax]
jle 0x1002d728
mov dword [ebp - 0x64], 1
jmp 0x1002d72c
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [ebp - 0x64], eax
jge 0x1002d742
cmp dword [ebp - 0x40], 0
jne 0x1002d742
and dword [ebp - 0x6c], 0
jmp 0x1002d749
mov dword [ebp - 0x6c], 1
mov eax, dword [ebp - 0x6c]
dec eax
cmp eax, 0x72c2
je 0x1002d75d
mov dword [ebp - 0x74], 1
jmp 0x1002d761
and dword [ebp - 0x74], 0
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x74]
jg 0x1002d77c
mov dword [ebp - 0x7c], 1
jmp 0x1002d780
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x7c]
sub ecx, dword [eax]
jne 0x1002d796
mov dword [ebp - 0x84], 1
jmp 0x1002d79d
and dword [ebp - 0x84], 0
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.1000e93c
mov ecx, dword [ebp - 0x84]
cmp ecx, dword [eax]
je 0x1002d7bb
mov dword [ebp - 0x44], 1
jmp 0x1002d7bf
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xdc], eax
jmp 0x1002d58e
jmp 0x1002d560
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret