Function at 0x10006911
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100191e9
mov eax, dword fs:[0]
push eax
mov eax, 0x1150
call fcn.10019030
mov eax, dword [0x1001e2c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x111c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1120], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x1130], ecx
mov dword [ebp - 0x1134], ebx
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f59
jmp 0x10006f17
push 0x10001cd4
push edi
mov dword [ebp - 0x1124], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
push 0x10001cbc
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x1118], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100069c2
test esi, esi
je 0x10006a5c
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
cmp dword [ebp + 0x10], 0
je 0x10006a5c
xor eax, eax
mov dl, 0x5c
mov ecx, edi
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], eax
mov dword [ebp - 0x1138], eax
call fcn.10005f5b
test eax, eax
jne 0x10006f49
push edi
call fcn.100065b4
test eax, eax
je 0x10006a2c
mov eax, dword [ebp - 0x1120]
lea ecx, [ebp - 0x1140]
push edi
mov dword [ebp - 0x1140], eax
call fcn.1000530b
and dword [ebp - 0x1140], 0
cmp dword [ebp - 0x1118], 0
je 0x10006a5c
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.1000661c
jmp 0x10006cd4
push 0x10001cc8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10006a88
mov ecx, dword [ebp - 0x111c]
and dword [ebp - 0x1124], eax
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
push 0x10001cb8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10006bb5
mov ecx, dword [ebp - 0x111c]
lea eax, [ebp - 0x1114]
push eax
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
cmp byte [edi], 0x3d
jne 0x10006f49
cmp dword [ebp + 0x10], 0
je 0x10006b2f
and dword [ebp - 0x1148], 0
and dword [ebp - 0x1144], 0
mov eax, dword [ebp - 0x1120]
mov ecx, dword [ebp - 0x111c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x114c], eax
lea eax, [ebp - 0x1114]
push edi
push eax
lea eax, [ebp - 0x114c]
push eax
call fcn.100060c5
and dword [ebp - 0x114c], 0
mov esi, eax
test esi, esi
js 0x10006f4e
mov byte [ebp - 4], 0
jmp 0x10006cde
cmp dword [ebp + 0x14], 0
jne 0x10006b9a
cmp dword [ebp - 0x1124], 0
je 0x10006b9a
lea eax, [ebp - 0x1118]
xor ecx, ecx
push eax
push 0x20006
push ecx
push ecx
push dword [ebp - 0x1120]
mov dword [ebp - 0x1118], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006f3e
mov esi, dword [ebp - 0x1118]
lea eax, [ebp - 0x1114]
push eax
push esi
mov dword [ebp - 0x1124], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x10006b8f
cmp eax, 2
jne 0x10006f22
test esi, esi
je 0x10006b9a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.1000661c
mov esi, eax
test esi, esi
js 0x10006f4e
jmp 0x10006f17
mov dl, 0x5c
mov ecx, edi
call fcn.10005f5b
test eax, eax
jne 0x10006f49
cmp dword [ebp + 0x10], eax
je 0x10006d2b
and dword [ebp - 0x1118], eax
lea eax, [ebp - 0x1118]
mov esi, dword [ebp - 0x1120]
push eax
push 0x2001f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006c14
test ebx, ebx
je 0x10006c00
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x1118]
mov dword [ebp - 0x1134], ebx
test eax, eax
je 0x10006c9e
and dword [ebp - 0x1118], 0
lea eax, [ebp - 0x1118]
push eax
push 0x20019
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006c50
test ebx, ebx
je 0x10006c40
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x1118]
mov dword [ebp - 0x1134], ebx
test eax, eax
je 0x10006c9e
lea eax, [ebp - 0x115c]
xor ecx, ecx
push eax
lea eax, [ebp - 0x1118]
mov dword [ebp - 0x1118], ecx
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10006f3e
test ebx, ebx
je 0x10006c8a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x1118]
mov dword [ebp - 0x1134], ebx
test eax, eax
jne 0x10006f3e
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
cmp byte [edi], 0x3d
jne 0x10006cde
mov ecx, dword [ebp - 0x111c]
lea eax, [ebp - 0x1134]
push edi
push 0
push eax
call fcn.100060c5
mov ebx, dword [ebp - 0x1134]
mov esi, eax
test esi, esi
js 0x10006f4e
cmp byte [edi], 0x7b
jne 0x10006f17
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006cec
sub ecx, edx
cmp ecx, 1
jne 0x10006f17
mov ecx, dword [ebp - 0x111c]
push 0
push dword [ebp + 0x10]
push ebx
push edi
call fcn.10006911
mov esi, eax
test esi, esi
js 0x10006f4e
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
jmp 0x10006ba6
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x10006d81
and dword [ebp - 0x1118], esi
lea eax, [ebp - 0x1118]
push eax
push 0x20019
push esi
push edi
push dword [ebp - 0x1120]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1128], eax
test eax, eax
jne 0x10006d8a
mov dword [ebp - 0x1128], eax
test ebx, ebx
je 0x10006d73
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1128], eax
mov ebx, dword [ebp - 0x1118]
mov dword [ebp - 0x1134], ebx
jmp 0x10006d8a
push 2
pop eax
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1118], esi
test eax, eax
je 0x10006d9e
mov dword [ebp - 0x1118], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_strncpy_s]
add esp, 0x10
mov ecx, eax
call fcn.10004fa3
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.1000661c
mov esi, eax
test esi, esi
js 0x10006f4e
cmp byte [edi], 0x7b
jne 0x10006e3f
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006df3
sub ecx, edx
cmp ecx, 1
jne 0x10006e3f
push dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
push 0
push ebx
push edi
call fcn.10006911
mov esi, eax
test esi, esi
jns 0x10006e29
cmp dword [ebp - 0x1118], 0
je 0x10006f4e
mov ecx, dword [ebp - 0x111c]
push edi
call fcn.10005fab
mov esi, eax
test esi, esi
js 0x10006f4e
mov ecx, dword [ebp - 0x1128]
cmp ecx, 2
je 0x10006f17
test ecx, ecx
je 0x10006e61
cmp dword [ebp + 0x14], 0
je 0x10006f40
jmp 0x10006f17
cmp dword [ebp + 0x14], 0
je 0x10006eac
push ebx
call fcn.100065e5
test eax, eax
je 0x10006eac
lea eax, [ebp - 0x114]
push eax
call fcn.100065b4
test eax, eax
je 0x10006f17
cmp dword [ebp - 0x1124], 0
je 0x10006f17
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1134]
call fcn.1000530b
mov ebx, dword [ebp - 0x1134]
jmp 0x10006f17
push ebx
call fcn.100065e5
mov dword [ebp - 0x1118], eax
test ebx, ebx
je 0x10006ed5
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x1134], ebx
test eax, eax
jne 0x10006f3e
mov eax, dword [ebp - 0x1118]
cmp dword [ebp - 0x1124], 0
je 0x10006f17
test eax, eax
jne 0x10006f17
and dword [ebp - 0x1154], eax
lea ecx, [ebp - 0x1158]
and dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x1120]
mov dword [ebp - 0x1158], eax
lea eax, [ebp - 0x114]
push eax
call fcn.1000521f
and dword [ebp - 0x1158], 0
test eax, eax
jne 0x10006f3e
cmp byte [edi], 0x7d
jne 0x10006989
jmp 0x10006f4e
mov ecx, eax
call fcn.1000503a
mov esi, eax
mov eax, dword [ebp - 0x1124]
test eax, eax
je 0x10006f4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006f4e
mov ecx, eax
call fcn.1000503a
mov esi, eax
jmp 0x10006f4e
mov esi, 0x80020009
test ebx, ebx
je 0x10006f59
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018600
leave
ret 0x10