Function at 0x1055e12
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.01021462
mov edi, eax
mov ax, word [0x10deb04]
test ax, ax
jbe 0x1055e31
xor edx, edx
jmp 0x1055e34
movzx edx, ax
movzx ecx, word [0x10de844]
cmp edx, ecx
jle 0x1055e4d
test ax, ax
jbe 0x1055e48
xor eax, eax
jmp 0x1055e4f
movzx eax, ax
jmp 0x1055e4f
mov eax, ecx
mov ecx, dword [edi + 0xb90]
push 0
mov word [ecx + 4], ax
mov eax, dword [edi + 0xb90]
and word [eax + 0x6a], 0
push 0x100b9ec
mov esi, 0x100b9d0
push esi
call fcn.01021516
mov ecx, dword [edi + 0xb90]
push 9
mov ebx, 0x100b9a4
push ebx
push esi
mov word [ecx], ax
call fcn.01021516
mov ecx, dword [0x10deb02]
cmp ax, cx
jae 0x1055ea3
push 9
push ebx
push esi
call fcn.01021516
jmp 0x1055ea5
mov eax, ecx
mov edx, dword [0x10de842]
cmp ax, dx
jbe 0x1055ed3
push 9
push ebx
push esi
call fcn.01021516
mov ecx, dword [0x10deb02]
cmp ax, cx
jae 0x1055ecf
push 9
push ebx
push esi
call fcn.01021516
jmp 0x1055ed5
mov eax, ecx
jmp 0x1055ed5
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0x2400
mov word [ecx + 2], ax
movzx eax, word [0x10deb06]
mov ebx, 0x100b980
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01021516
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055f13
push 0x2400
push ebx
push esi
call fcn.01021516
movsx ecx, ax
jmp 0x1055f16
mov ecx, dword [ebp - 4]
movzx eax, word [0x10de846]
cmp ecx, eax
jle 0x1055f53
movzx eax, word [0x10deb06]
push 0x2400
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01021516
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055f50
push 0x2400
push ebx
push esi
call fcn.01021516
movsx eax, ax
jmp 0x1055f53
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0x20
mov word [ecx + 6], ax
movzx eax, word [0x10deb08]
mov ebx, 0x100b94c
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01021516
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055f8b
push 0x20
push ebx
push esi
call fcn.01021516
movsx ecx, ax
jmp 0x1055f8e
mov ecx, dword [ebp - 4]
movzx eax, word [0x10de848]
cmp ecx, eax
jle 0x1055fc5
movzx eax, word [0x10deb08]
push 0x20
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01021516
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055fc2
push 0x20
push ebx
push esi
call fcn.01021516
movsx eax, ax
jmp 0x1055fc5
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0x200
mov word [ecx + 8], ax
movzx eax, word [0x10deb0a]
mov ebx, 0x100b92c
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01021516
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1056003
push 0x200
push ebx
push esi
call fcn.01021516
movsx ecx, ax
jmp 0x1056006
mov ecx, dword [ebp - 4]
movzx eax, word [0x10de84a]
cmp ecx, eax
jle 0x1056043
movzx eax, word [0x10deb0a]
push 0x200
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01021516
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1056040
push 0x200
push ebx
push esi
call fcn.01021516
movsx eax, ax
jmp 0x1056043
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0
push 0x100b90c
mov ebx, 0x100b458
push ebx
mov word [ecx + 0xa], ax
call fcn.01021516
mov ecx, dword [0x10deb0c]
cmp ax, cx
jge 0x1056079
push 0
push 0x100b90c
push ebx
call fcn.01021516
jmp 0x105607b
mov eax, ecx
mov edx, dword [0x10de84c]
cmp ax, dx
jle 0x10560b1
push 0
push 0x100b90c
push ebx
call fcn.01021516
mov ecx, dword [0x10deb0c]
cmp ax, cx
jge 0x10560ad
push 0
push 0x100b90c
push ebx
call fcn.01021516
jmp 0x10560b3
mov eax, ecx
jmp 0x10560b3
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b8e4
push ebx
push esi
mov word [ecx + 0xc], ax
call fcn.01021516
mov ecx, dword [0x10deb0e]
cmp ax, cx
jge 0x10560e1
push 0
push ebx
push esi
call fcn.01021516
jmp 0x10560e3
mov eax, ecx
mov edx, dword [0x10de84e]
cmp ax, dx
jle 0x1056111
push 0
push ebx
push esi
call fcn.01021516
mov ecx, dword [0x10deb0e]
cmp ax, cx
jge 0x105610d
push 0
push ebx
push esi
call fcn.01021516
jmp 0x1056113
mov eax, ecx
jmp 0x1056113
mov eax, edx
mov ecx, dword [edi + 0xb90]
xor ebx, ebx
inc ebx
push ebx
push 0x100b8b4
push esi
mov word [ecx + 0xe], ax
call fcn.01021516
mov ecx, dword [0x10deb10]
cmp ax, cx
jge 0x1056145
push ebx
push 0x100b8b4
push esi
call fcn.01021516
jmp 0x1056147
mov eax, ecx
mov edx, dword [0x10de850]
cmp ax, dx
jle 0x105617b
push ebx
push 0x100b8b4
push esi
call fcn.01021516
mov ecx, dword [0x10deb10]
cmp ax, cx
jge 0x1056177
push ebx
push 0x100b8b4
push esi
call fcn.01021516
jmp 0x105617d
mov eax, ecx
jmp 0x105617d
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b888
push esi
mov word [ecx + 0x10], ax
call fcn.01021516
mov ecx, dword [0x10deb12]
cmp ax, cx
jge 0x10561ac
push ebx
push 0x100b888
push esi
call fcn.01021516
jmp 0x10561ae
mov eax, ecx
mov edx, dword [0x10de852]
cmp ax, dx
jle 0x10561e2
push ebx
push 0x100b888
push esi
call fcn.01021516
mov ecx, dword [0x10deb12]
cmp ax, cx
jge 0x10561de
push ebx
push 0x100b888
push esi
call fcn.01021516
jmp 0x10561e4
mov eax, ecx
jmp 0x10561e4
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b86c
push esi
mov word [ecx + 0x12], ax
call fcn.01021516
mov ecx, dword [0x10deb14]
cmp ax, cx
jge 0x1056213
push ebx
push 0x100b86c
push esi
call fcn.01021516
jmp 0x1056215
mov eax, ecx
mov edx, dword [0x10de854]
cmp ax, dx
jle 0x1056249
push ebx
push 0x100b86c
push esi
call fcn.01021516
mov ecx, dword [0x10deb14]
cmp ax, cx
jge 0x1056245
push ebx
push 0x100b86c
push esi
call fcn.01021516
jmp 0x105624b
mov eax, ecx
jmp 0x105624b
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b850
push esi
mov word [ecx + 0x14], ax
call fcn.01021516
mov ecx, dword [0x10deb16]
cmp ax, cx
jge 0x105627a
push ebx
push 0x100b850
push esi
call fcn.01021516
jmp 0x105627c
mov eax, ecx
mov edx, dword [0x10de856]
cmp ax, dx
jle 0x10562b0
push ebx
push 0x100b850
push esi
call fcn.01021516
mov ecx, dword [0x10deb16]
cmp ax, cx
jge 0x10562ac
push ebx
push 0x100b850
push esi
call fcn.01021516
jmp 0x10562b2
mov eax, ecx
jmp 0x10562b2
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b838
push esi
mov word [ecx + 0x16], ax
call fcn.01021516
mov ecx, dword [0x10deb18]
cmp ax, cx
jge 0x10562e1
push ebx
push 0x100b838
push esi
call fcn.01021516
jmp 0x10562e3
mov eax, ecx
mov edx, dword [0x10de858]
cmp ax, dx
jle 0x1056317
push ebx
push 0x100b838
push esi
call fcn.01021516
mov ecx, dword [0x10deb18]
cmp ax, cx
jge 0x1056313
push ebx
push 0x100b838
push esi
call fcn.01021516
jmp 0x1056319
mov eax, ecx
jmp 0x1056319
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b810
push esi
mov word [ecx + 0x18], ax
call fcn.01021516
mov ecx, dword [0x10deb1c]
cmp ax, cx
jge 0x1056348
push ebx
push 0x100b810
push esi
call fcn.01021516
jmp 0x105634a
mov eax, ecx
mov edx, dword [0x10de85c]
cmp ax, dx
jle 0x105637e
push ebx
push 0x100b810
push esi
call fcn.01021516
mov ecx, dword [0x10deb1c]
cmp ax, cx
jge 0x105637a
push ebx
push 0x100b810
push esi
call fcn.01021516
jmp 0x1056380
mov eax, ecx
jmp 0x1056380
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b398
push esi
mov word [ecx + 0x1c], ax
call fcn.01021516
mov ecx, dword [0x10deb1e]
cmp ax, cx
jge 0x10563af
push ebx
push 0x100b398
push esi
call fcn.01021516
jmp 0x10563b1
mov eax, ecx
mov edx, dword [0x10de85e]
cmp ax, dx
jle 0x10563e5
push ebx
push 0x100b398
push esi
call fcn.01021516
mov ecx, dword [0x10deb1e]
cmp ax, cx
jge 0x10563e1
push ebx
push 0x100b398
push esi
call fcn.01021516
jmp 0x10563e7
mov eax, ecx
jmp 0x10563e7
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b7f8
push ebx
push esi
mov word [ecx + 0x1e], ax
call fcn.01021516
mov ecx, dword [0x10deb20]
cmp ax, cx
jge 0x1056415
push 0
push ebx
push esi
call fcn.01021516
jmp 0x1056417
mov eax, ecx
mov edx, dword [0x10de860]
cmp ax, dx
jle 0x1056445
push 0
push ebx
push esi
call fcn.01021516
mov ecx, dword [0x10deb20]
cmp ax, cx
jge 0x1056441
push 0
push ebx
push esi
call fcn.01021516
jmp 0x1056447
mov eax, ecx
jmp 0x1056447
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b7e0
push ebx
push esi
mov word [ecx + 0x20], ax
call fcn.01021516
mov ecx, dword [0x10deb5e]
cmp ax, cx
jge 0x1056475
push 0
push ebx
push esi
call fcn.01021516
jmp 0x1056477
mov eax, ecx
mov edx, dword [0x10de89e]
cmp ax, dx
jle 0x10564a5
push 0
push ebx
push esi
call fcn.01021516
mov ecx, dword [0x10deb5e]
cmp ax, cx
jge 0x10564a1
push 0
push ebx
push esi
call fcn.01021516
jmp 0x10564a7
mov eax, ecx
jmp 0x10564a7
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 1
push 0x100b7c4
push esi
mov word [ecx + 0x5e], ax
call fcn.01021516
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b79c
push ebx
push esi
mov word [ecx + 0x6c], ax
call fcn.01021516
mov ecx, dword [0x10deb60]
cmp ax, cx
jge 0x10564ec
push 0
push ebx
push esi
call fcn.01021516
jmp 0x10564ee
mov eax, ecx
mov edx, dword [0x10de8a0]
cmp ax, dx
jle 0x105651c
push 0
push ebx
push esi
call fcn.01021516
mov ecx, dword [0x10deb60]
cmp ax, cx
jge 0x1056518
push 0
push ebx
push esi
call fcn.01021516
jmp 0x105651e
mov eax, ecx
jmp 0x105651e
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 1
mov ebx, 0x100b770
push ebx
push esi
mov word [ecx + 0x60], ax
call fcn.01021516
mov ecx, dword [0x10deb62]
cmp ax, cx
jge 0x105654c
push 1
push ebx
push esi
call fcn.01021516
jmp 0x105654e
mov eax, ecx
mov edx, dword [0x10de8a2]
cmp ax, dx
jle 0x105657c
push 1
push ebx
push esi
call fcn.01021516
mov ecx, dword [0x10deb62]
cmp ax, cx
jge 0x1056578
push 1
push ebx
push esi
call fcn.01021516
jmp 0x105657e
mov eax, ecx
jmp 0x105657e
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 2
push 0x100b748
push 0x100b730
mov word [ecx + 0x62], ax
call fcn.01021516
mov ecx, dword [edi + 0xb90]
movsx eax, ax
add ecx, 0x9c
shl eax, 5
xor eax, dword [ecx]
push 2
mov ebx, 0x100b71c
push ebx
and eax, 0x60
xor dword [ecx], eax
push esi
call fcn.01021516
push 2
push ebx
push esi
call fcn.01021516
push 1
push 0x100b6d0
push esi
call fcn.01021516
mov ecx, dword [edi + 0xb90]
movzx eax, ax
add ecx, 0x9c
shl eax, 0x11
xor eax, dword [ecx]
and eax, 0x20000
xor dword [ecx], eax
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0x2000000
push eax
push eax
push eax
push 0x100b610
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105662c
push 0x100b5d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.01021a96
push 0
push 0x100b698
push esi
call fcn.01021516
mov ecx, dword [edi + 0xb90]
add ecx, 0x9c
xor edx, edx
test ax, ax
setne dl
push 1
push 0x100b664
push esi
movsx eax, dx
shl eax, 0x13
xor eax, dword [ecx]
and eax, 0x80000
xor dword [ecx], eax
call fcn.01021516
mov edi, dword [edi + 0xb90]
xor edx, edx
test ax, ax
setne dl
lea ecx, [edi + 0x9c]
pop edi
pop esi
pop ebx
movsx eax, dx
shl eax, 0x12
xor eax, dword [ecx]
and eax, 0x40000
xor dword [ecx], eax
leave
ret