Function at 0x10003560
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x10010136
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
mov eax, dword [0x10015180]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x228], eax
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x24c]
mov edi, dword [esp + 0x240]
push edi
mov dword [esp + 0x23c], ebx
mov dword [esp + 0x20], eax
call fcn.10001710
mov esi, eax
cmp esi, ebx
jge 0x100035be
jmp 0x10003b2d
cmp byte [edi], 0x7d
push ebp
je 0x10003b2a
jmp 0x100035d0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x100112dc
push edi
mov dword [esp + 0x18], 1
call esi
mov ebp, eax
neg ebp
push 0x100112f0
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x10003601
cmp ebp, ebx
je 0x100036f4
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
cmp dword [esp + 0x24c], ebx
je 0x100036f4
mov cl, byte [edi]
cmp cl, bl
mov dword [esp + 0x1c], ebx
mov eax, edi
je 0x1000364c
mov edi, edi
cmp cl, 0x5c
je 0x10003644
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
cmp cl, bl
jne 0x10003630
jmp 0x1000364c
cmp eax, ebx
jne 0x10003b53
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001850
test eax, eax
je 0x10003673
mov ecx, dword [esp + 0x248]
mov dword [esp + 0x1c], ecx
push edi
lea ecx, [esp + 0x20]
call fcn.100020b0
mov dword [esp + 0x1c], ebx
cmp ebp, ebx
je 0x100036f4
mov ebp, dword [esp + 0x18]
push edi
mov ecx, ebp
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b6c
push edi
mov ecx, ebp
call fcn.100018e0
mov esi, eax
cmp esi, ebx
jl 0x10003b6c
cmp byte [edi], 0x7b
jne 0x100036e6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x100036e6
mov eax, dword [esp + 0x24c]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
push ebx
push eax
push ecx
push edi
mov ecx, ebp
call fcn.10003560
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
push edi
mov ecx, ebp
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
cmp byte [edi], 0x7d
jne 0x100035d0
jmp 0x10003b1b
push 0x100112e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000371c
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], ebx
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
push 0x100112fc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10003821
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x12c]
push edx
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
cmp byte [edi], 0x3d
jne 0x10003b5c
cmp dword [esp + 0x24c], ebx
je 0x100037b5
mov eax, dword [esp + 0x248]
push edi
lea ecx, [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x248], 1
mov dword [esp + 0x1c], eax
call fcn.10003190
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x10], ebx
jl 0x10003b72
mov byte [esp + 0x23c], bl
jmp 0x1000369f
cmp dword [esp + 0x250], ebx
jne 0x10003812
cmp dword [esp + 0x10], ebx
je 0x10003812
mov eax, dword [esp + 0x248]
push 0x20006
push ebx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
call fcn.100013e0
cmp eax, ebx
jne 0x10003b07
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x12c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x10003807
cmp eax, 2
jne 0x10003b07
cmp esi, ebx
je 0x10003812
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018e0
jmp 0x100036dc
mov cl, byte [edi]
cmp cl, bl
mov eax, edi
je 0x10003848
mov esi, dword [sym.imp.USER32.dll_CharNextA]
nop
cmp cl, 0x5c
je 0x10003840
push eax
call esi
mov cl, byte [eax]
cmp cl, bl
jne 0x10003830
jmp 0x10003848
cmp eax, ebx
jne 0x10003b5c
cmp dword [esp + 0x24c], ebx
je 0x10003966
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x10]
push edx
push 0x2001f
push ebx
push edi
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10003898
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x10003888
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x1000392a
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push edi
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x100038d7
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x100038cb
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x1000392a
mov ecx, dword [esp + 0x248]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x10003b86
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x10003918
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov edx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 0x14], edx
jne 0x10003b86
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
cmp byte [edi], 0x3d
jne 0x1000369f
mov ecx, dword [esp + 0x18]
push edi
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.10003190
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
jmp 0x1000369f
cmp dword [esp + 0x250], ebx
jne 0x10003a6e
mov edx, dword [esp + 0x248]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push edi
push edx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x100039ae
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x100039a6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
cmp eax, ebx
mov ebp, eax
je 0x100039bf
mov dword [esp + 0x250], 1
push 0x104
push edi
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018e0
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
cmp byte [edi], 0x7b
jne 0x10003a3c
mov eax, dword [esp + 0x250]
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x24]
push edi
call fcn.10003560
mov esi, eax
cmp esi, ebx
jge 0x10003a28
cmp dword [esp + 0x250], ebx
je 0x10003b1b
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001710
mov esi, eax
cmp esi, ebx
jl 0x10003b1b
cmp ebp, 2
mov edx, dword [esp + 0x20]
mov dword [esp + 0x250], edx
je 0x100036e6
cmp ebp, ebx
mov eax, edx
je 0x10003a78
cmp eax, ebx
jne 0x100036e6
push ebp
call fcn.10001320
add esp, 4
mov esi, eax
jmp 0x10003b1b
mov ebp, 2
jmp 0x100039b4
cmp eax, ebx
je 0x10003ac1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
call fcn.10001890
test eax, eax
je 0x10003ac1
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.10001850
test eax, eax
je 0x100036e6
cmp dword [esp + 0x10], ebx
je 0x100036e6
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.100020b0
jmp 0x100036e6
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10003ade
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x14], ebx
jne 0x10003b9a
cmp dword [esp + 0x10], ebx
je 0x100036e6
mov edx, dword [esp + 0x248]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x100036e6
push eax
call fcn.10001320
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.10002090
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10003b2a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x230]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x224]
pop ebx
call fcn.100076be
add esp, 0x230
ret 0x10
lea ecx, [esp + 0x1c]
call fcn.10002090
lea ecx, [esp + 0x14]
call fcn.10002090
mov eax, 0x80020009
jmp 0x10003b2c
lea ecx, [esp + 0x1c]
jmp 0x10003b16
lea ecx, [esp + 0x10]
call fcn.10002090
lea ecx, [esp + 0x14]
call fcn.10002090
jmp 0x10003b2a
lea ecx, [esp + 0x14]
call fcn.10002090
push esi
call fcn.10001320
add esp, 4
jmp 0x10003b2c
lea ecx, [esp + 0x14]
call fcn.10002090
push ebp
call fcn.10001320
add esp, 4
jmp 0x10003b2c