Function at 0x1ab18
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x1fb28]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ExInitializeRundownProtection]
push 0x18
push 0
lea eax, [ebp - 0x20]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x70
push 0
lea eax, [ebp - 0x90]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeMutant]
push 0x18
push 0
lea eax, [ebp - 0xc8]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [0x1cba8], 3
push 0x1b4ee
push 0x1b4e4
push 0xa44b
call dword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
push 0
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.ntoskrnl.exe_MmAddVerifierThunks]
and eax, 0xc00000ab
mov dword [ebp - 0xd0], eax
mov dword [0x1f7c8], 0xa
mov eax, dword [0x1fb64]
add eax, 0x1650
mov dword [ebp - 0xd4], eax
push 0x1b4a4
push 0xb75b
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
xor eax, eax
mov word [ebp - 0xd8], ax
jmp 0x1ac0c
movzx eax, word [ebp - 0xd8]
add eax, 4
mov word [ebp - 0xd8], ax
movzx eax, word [ebp - 0xd8]
cmp eax, 0x110
jge 0x1ac79
push 0xc0000029
call dword [sym.imp.ntoskrnl.exe_RtlNtStatusToDosErrorNoTeb]
mov eax, dword [0x1c800]
mov eax, dword [eax]
mov dword [0x1fb30], eax
xor eax, eax
cmp dword [ebp - 0xd0], 0xc00000ab
setne al
dec eax
and eax, 0x1cee3ca5
add eax, 0xd60e
mov ecx, dword [0x1fb30]
sub ecx, eax
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
add eax, 4
mov dword [ebp - 0xd4], eax
mov eax, dword [0x1c800]
add eax, 4
mov dword [0x1c800], eax
jmp 0x1abfb
lea ecx, [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ExWaitForRundownProtectionRelease]
mov eax, dword [0x1fb64]
add eax, 0x1760
mov dword [ebp - 0xdc], eax
xor eax, eax
mov word [ebp - 0xd8], ax
jmp 0x1acae
movzx eax, word [ebp - 0xd8]
add eax, 4
mov word [ebp - 0xd8], ax
movzx eax, word [ebp - 0xd8]
cmp eax, 0x1c4
jge 0x1ad35
mov eax, dword [ebx + 8]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [ebx + 8]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
xor eax, eax
cmp dword [ebp - 0xd0], 0xc00000ab
setne al
dec eax
and eax, 0x1e2dbe
add eax, 0x79d8
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], eax
push 0
push 0x60
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireRemoveLockEx]
mov eax, dword [ebp - 0xdc]
add eax, 4
mov dword [ebp - 0xdc], eax
mov eax, dword [ebx + 8]
add eax, 8
mov dword [ebx + 8], eax
jmp 0x1ac9d
mov eax, dword [0x1fb64]
add eax, 0x1924
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.ntoskrnl.exe_IoSetHardErrorOrVerifyDevice]
xor eax, eax
mov word [ebp - 0xd8], ax
jmp 0x1ad75
movzx eax, word [ebp - 0xd8]
add eax, 4
mov word [ebp - 0xd8], ax
movzx eax, word [ebp - 0xd8]
cmp eax, 0x15c
jge 0x1adef
mov eax, dword [0x1c804]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [0x1c804]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
call dword [sym.imp.ntoskrnl.exe_KeQueryActiveProcessors]
mov eax, dword [ebp - 0xd0]
xor eax, 0xae3d49c6
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx], eax
mov eax, dword [ebp - 0xe0]
add eax, 4
mov dword [ebp - 0xe0], eax
call dword [sym.imp.ntoskrnl.exe_KeQueryActiveProcessors]
mov eax, dword [0x1c804]
add eax, 8
mov dword [0x1c804], eax
jmp 0x1ad64
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.ntoskrnl.exe_KeReadStateMutant]
mov eax, dword [0x1fb64]
add eax, 0x1a80
mov dword [ebp - 0x19c], eax
push 0
push 0
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoReleaseRemoveLockEx]
xor eax, eax
mov word [ebp - 0xd8], ax
jmp 0x1ae39
movzx eax, word [ebp - 0xd8]
add eax, 4
mov word [ebp - 0xd8], ax
movzx eax, word [ebp - 0xd8]
cmp eax, 0x1d0
jge 0x1aeb6
mov eax, dword [0x1c808]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [0x1c808]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
xor eax, eax
cmp dword [ebp - 0xd0], 0xc00000ab
setne al
dec eax
and eax, 0xfc338985
add eax, 0x2dfc
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x19c]
add eax, 4
mov dword [ebp - 0x19c], eax
mov eax, dword [0x1c808]
add eax, 8
mov dword [0x1c808], eax
jmp 0x1ae28
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0001b452
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4