Function at 0x10016f60
Capabilities:
Delete registry key
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x100757b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3e4
mov eax, dword [0x1008c54c]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c54c]
xor eax, esp
push eax
lea eax, [esp + 0x3f8]
mov dword fs:[0], eax
mov al, byte [0x1008d8bb]
mov cl, 0x51
imul cl
sub al, 0x7e
add al, al
add al, al
add al, 0x19
mov byte [0x1008d8bb], al
mov edx, 0x55
mov word [esp + 0x6c], dx
mov ecx, 0xa2
mov word [esp + 0x70], cx
mov edx, 0x54
mov word [esp + 0x72], dx
mov eax, 0xd1
mov word [esp + 0x6e], ax
mov ecx, 0x95
mov word [esp + 0x76], cx
mov edx, 0xe2
mov word [esp + 0x78], dx
mov eax, 7
mov word [esp + 0x74], ax
mov ecx, 0xcc
mov word [esp + 0x7c], cx
mov edx, 0xda
mov word [esp + 0x7e], dx
mov eax, 0x72
mov word [esp + 0x7a], ax
mov ecx, 0xf1
mov word [esp + 0x82], cx
mov edx, 0x2a
mov word [esp + 0x84], dx
mov eax, 0x20
mov word [esp + 0x80], ax
mov ecx, 0x81
mov word [esp + 0x88], cx
mov edx, 0x7c
mov word [esp + 0x8a], dx
mov eax, 0x98
mov word [esp + 0x86], ax
mov ecx, 0x7f
mov word [esp + 0x8e], cx
mov edx, 0x43
mov word [esp + 0x90], dx
mov eax, 0x73
mov word [esp + 0x8c], ax
mov ecx, 0xb4
mov word [esp + 0x96], cx
mov edx, 0xc3
mov word [esp + 0x98], dx
mov eax, 0x26
mov word [esp + 0x94], ax
mov word [esp + 0x9a], ax
mov ecx, 0x64
mov word [esp + 0x9c], cx
mov edx, 0xfd
mov word [esp + 0x9e], dx
xor ecx, ecx
mov eax, 0x87
mov edx, 0xbf
mov word [esp + 0xa0], ax
mov word [esp + 0xa2], cx
mov word [esp + 0xa4], dx
mov eax, 0xb7
mov ecx, 0x41
mov edx, 0x83
mov word [esp + 0xa6], ax
mov word [esp + 0xa8], cx
mov word [esp + 0xaa], dx
mov eax, 0x5e
mov ecx, 0xb8
mov edx, 0xed
mov word [esp + 0xac], ax
mov word [esp + 0xae], cx
mov word [esp + 0xb0], dx
mov eax, 0x13
mov ecx, 0x14
mov edx, 0x16
mov word [esp + 0xb2], ax
mov word [esp + 0xb4], cx
mov word [esp + 0xb6], dx
mov eax, 0x20
or edi, 0xffffffff
test byte [0x100909a0], 1
mov word [esp + 0xb8], ax
jne 0x100171bc
or dword [0x100909a0], 1
lea ecx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x98]
mov dword [esp + 0x404], 0
call fcn.10043080
push 0x10077e90
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x400], edi
mov eax, dword [0x100906bc]
xor edx, edx
mov ecx, eax
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], dx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100171e0
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x44]
call fcn.1000aed0
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x404], 1
call fcn.1000d200
add esp, 4
test al, al
mov dword [esp + 0x400], edi
mov edi, 8
sete bl
cmp dword [esp + 0x58], edi
jb 0x10017237
mov ecx, dword [esp + 0x44]
push ecx
call fcn.1004408a
add esp, 4
test bl, bl
je 0x10017245
mov eax, 0x80004005
jmp 0x10017c2d
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x34]
call fcn.10017da0
add esp, 4
mov dword [esp + 0x400], 2
mov cl, byte [0x1008d8bb]
mov ebp, dword [esp + 0x18]
mov al, cl
mov dl, 0x30
imul dl
sub al, 2
imul cl
mov cl, 0xbd
sub cl, al
mov byte [0x1008d8bb], cl
cmp dword [esp + 0x2c], edi
jae 0x10017289
lea ebp, [esp + 0x18]
test byte [0x10090988], 1
mov edx, 0xb7
mov word [esp + 0x40], dx
mov ecx, 0x3f
mov word [esp + 0x44], cx
mov edx, 0xaf
mov word [esp + 0x46], dx
mov eax, 0x3b
mov ecx, 0x9a
mov edx, 0xcc
mov word [esp + 0x42], ax
mov word [esp + 0x4a], cx
mov word [esp + 0x4c], dx
mov eax, 0xdd
mov ecx, 0xf4
mov edx, 0x77
mov word [esp + 0x48], ax
mov word [esp + 0x4e], ax
mov word [esp + 0x5c], cx
mov word [esp + 0x5e], dx
mov eax, 0x6c
mov ecx, 0xe6
mov edx, 0x99
mov word [esp + 0x60], ax
mov word [esp + 0x62], cx
mov word [esp + 0x64], dx
mov eax, 0xc6
mov ecx, 0xe9
mov edx, 0xae
mov word [esp + 0x66], ax
mov word [esp + 0x68], cx
mov word [esp + 0x6a], dx
jne 0x10017368
or dword [0x10090988], 1
lea edi, [esp + 0x5c]
lea ebx, [esp + 0x40]
mov esi, 0x10090984
mov byte [esp + 0x400], 3
call fcn.10043370
push 0x10077ee0
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x400], 2
mov edi, 8
mov eax, dword [0x10090984]
push ebp
push eax
mov eax, 0x208
lea ebx, [esp + 0x1f4]
call fcn.1000b110
mov cl, byte [0x1008d8bb]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov al, cl
add al, 0x5e
imul cl
mov cl, 0xf9
imul cl
add esp, 8
mov edx, ebx
push edx
push SysReAllocString
mov byte [0x1008d8bb], al
call esi
mov al, byte [0x1008d8bb]
mov ebx, dword [esp + 0x18]
shl al, 6
sub al, 0x40
mov byte [0x1008d8bb], al
cmp dword [esp + 0x2c], edi
jae 0x100173c5
lea ebx, [esp + 0x18]
mov ecx, 0x4e
mov word [esp + 0x154], cx
mov edx, 0x3e
mov word [esp + 0x156], dx
mov eax, 0xf6
mov word [esp + 0x158], ax
mov ecx, 0xbb
mov word [esp + 0x15a], cx
mov edx, 0xbf
mov word [esp + 0x15c], dx
mov eax, 0x45
mov word [esp + 0x15e], ax
mov ecx, 0xee
mov word [esp + 0x160], cx
mov edx, 0x36
mov word [esp + 0x162], dx
mov eax, 0xcc
mov word [esp + 0x164], ax
mov ecx, 0xdc
mov word [esp + 0x166], cx
mov edx, 0x46
mov word [esp + 0x168], dx
mov eax, 0x2e
mov word [esp + 0x16a], ax
mov ecx, 4
mov word [esp + 0x16c], cx
mov edx, 0x8d
mov word [esp + 0x16e], dx
mov eax, 0xd5
mov word [esp + 0x170], ax
mov ecx, 0xa2
mov word [esp + 0x172], cx
mov edx, 0x4c
mov word [esp + 0x174], dx
mov eax, 0x5f
mov word [esp + 0x176], ax
mov ecx, 0xb6
mov word [esp + 0x178], cx
mov edx, 0x5d
mov word [esp + 0x17a], dx
mov eax, 0xa0
mov word [esp + 0x17c], ax
mov ecx, 0x4e
mov word [esp + 0x17e], cx
mov edx, 0xe1
mov word [esp + 0x180], dx
mov eax, 0x6b
mov word [esp + 0x182], ax
mov ecx, 0x26
mov word [esp + 0x184], cx
mov edx, 0x80
mov word [esp + 0x186], dx
mov eax, 0x10
mov word [esp + 0x188], ax
mov ecx, 0x12
mov word [esp + 0x18a], cx
mov edx, 0x45
mov word [esp + 0x18c], dx
mov eax, 0x3c
mov ecx, 4
mov word [esp + 0x18e], ax
mov word [esp + 0x190], cx
mov edx, 0xee
mov word [esp + 0x192], dx
mov eax, 0xe2
mov ecx, 0x55
mov word [esp + 0x194], ax
mov word [esp + 0x196], cx
mov edx, 0xa4
mov eax, 0x69
mov ecx, 0x97
mov word [esp + 0x198], dx
mov edx, 0x2a
mov word [esp + 0x19a], ax
mov word [esp + 0x19c], cx
mov eax, 0xe6
mov ecx, 0x16
mov word [esp + 0x19e], dx
mov word [esp + 0x1a0], ax
mov word [esp + 0x1a2], cx
mov edx, 0x1b
mov eax, edx
mov word [esp + 0x1a4], dx
mov word [esp + 0x1a6], ax
mov edx, 0xd1
mov word [esp + 0x1aa], dx
mov ecx, 0x4c
mov word [esp + 0x1a8], cx
mov eax, 0xa5
mov word [esp + 0x1ac], ax
mov edx, 0x9b
mov word [esp + 0x1b0], dx
mov ecx, 0x5b
mov word [esp + 0x1ae], cx
mov eax, 0x50
mov word [esp + 0x1b2], ax
mov edx, 0x28
mov word [esp + 0x1b6], dx
mov ecx, 0xd3
mov word [esp + 0x1b4], cx
mov eax, 0x71
mov word [esp + 0x1b8], ax
mov edx, 0x69
mov word [esp + 0x1bc], dx
mov ecx, 0xe2
mov word [esp + 0x1ba], cx
mov eax, 0xd9
mov word [esp + 0x1be], ax
mov edx, 0xe5
mov word [esp + 0x1c2], dx
mov ecx, 0x63
mov word [esp + 0x1c0], cx
mov eax, 0xa3
mov word [esp + 0x1c4], ax
mov edx, 0xc0
mov word [esp + 0x1c8], dx
mov ecx, 0xe9
mov word [esp + 0x1c6], cx
mov eax, 0x53
mov word [esp + 0x1ca], ax
mov edx, 0xc2
mov word [esp + 0x1ce], dx
mov ecx, 0xed
mov word [esp + 0x1cc], cx
mov eax, 0x4f
mov word [esp + 0x1d0], ax
mov edx, 0xe7
mov word [esp + 0x1d4], dx
mov ecx, 0x49
mov word [esp + 0x1d2], cx
mov eax, 0x14
mov word [esp + 0x1d6], ax
mov edx, 0xa2
mov word [esp + 0x1da], dx
mov ecx, 0xd7
mov word [esp + 0x1d8], cx
mov eax, 0x26
mov word [esp + 0x1dc], ax
mov edx, 4
mov eax, edx
mov ecx, 0x7f
mov word [esp + 0x1de], cx
mov word [esp + 0x1e0], dx
mov word [esp + 0x1e2], ax
mov ecx, 0xbd
mov edx, 0x42
mov eax, 0xf6
mov word [esp + 0x1e4], cx
mov word [esp + 0x1e6], dx
mov word [esp + 0x1e8], ax
mov ecx, 0x1c
mov edx, 0x1d
mov eax, 0x71
mov word [esp + 0x1ea], cx
mov word [esp + 0xbc], dx
mov word [esp + 0xbe], ax
mov ecx, 0xb0
mov edx, 0xef
mov eax, 0xe8
mov word [esp + 0xc0], cx
mov word [esp + 0xc2], dx
mov word [esp + 0xc4], ax
mov ecx, 4
mov word [esp + 0xc6], cx
mov edx, 0xbc
mov word [esp + 0xc8], dx
mov eax, 0x73
mov word [esp + 0xca], ax
mov ecx, 0x90
mov word [esp + 0xcc], cx
mov edx, 0x91
mov word [esp + 0xce], dx
mov eax, 0x2f
mov word [esp + 0xd0], ax
mov ecx, 0x4d
mov word [esp + 0xd2], cx
mov edx, 0x76
mov word [esp + 0xd4], dx
mov eax, 0xe2
mov word [esp + 0xd6], ax
mov ecx, 0xa6
mov word [esp + 0xd8], cx
mov edx, 0xcd
mov word [esp + 0xda], dx
mov eax, 0x2a
mov word [esp + 0xdc], ax
mov ecx, 0x2b
mov word [esp + 0xde], cx
mov edx, 0xea
mov word [esp + 0xe0], dx
mov eax, 0xa
mov word [esp + 0xe2], ax
mov ecx, 0xc9
mov word [esp + 0xe4], cx
mov edx, 0x20
mov word [esp + 0xe6], dx
mov eax, 0x85
mov word [esp + 0xe8], ax
mov ecx, 4
mov word [esp + 0xea], cx
mov edx, 0x51
mov word [esp + 0xec], dx
mov word [esp + 0xf2], dx
mov eax, 0xf3
mov word [esp + 0xee], ax
mov ecx, 0x4c
mov word [esp + 0xf0], cx
mov eax, 0x30
mov word [esp + 0xf4], ax
mov ecx, 0x4e
mov word [esp + 0xf6], cx
mov edx, 0x76
mov word [esp + 0xf8], dx
mov eax, 0x8b
mov word [esp + 0xfa], ax
mov ecx, 0x8c
mov word [esp + 0xfc], cx
mov edx, 0x21
mov word [esp + 0xfe], dx
mov eax, 0xf2
mov ecx, 0xc
mov edx, 0xe5
mov word [esp + 0x100], ax
mov word [esp + 0x102], cx
mov word [esp + 0x104], dx
mov eax, 0x59
mov ecx, 0x8f
mov edx, 0x79
mov word [esp + 0x106], ax
mov word [esp + 0x108], cx
mov word [esp + 0x10a], dx
mov eax, 0x75
mov ecx, 0x47
mov edx, 9
mov word [esp + 0x10c], ax
mov word [esp + 0x10e], cx
mov word [esp + 0x110], dx
mov eax, 0xa9
mov ecx, 0xd5
mov edx, 0x37
mov word [esp + 0x112], ax
mov word [esp + 0x114], cx
mov word [esp + 0x116], dx
mov eax, 0xf4
mov word [esp + 0x118], ax
mov eax, 0x5a
mov word [esp + 0x11e], ax
mov ecx, 0x22
mov word [esp + 0x11a], cx
mov edx, 0xb6
mov word [esp + 0x11c], dx
mov eax, 0x1b
mov word [esp + 0x124], ax
mov ecx, 0x2d
mov word [esp + 0x120], cx
mov edx, 0xa0
mov word [esp + 0x122], dx
mov eax, 0x96
mov word [esp + 0x12a], ax
mov ecx, 0xb6
mov word [esp + 0x126], cx
mov edx, 0x14
mov word [esp + 0x128], dx
mov eax, 0xe0
mov word [esp + 0x130], ax
mov ecx, 0xc6
mov word [esp + 0x12c], cx
mov edx, 0x9b
mov word [esp + 0x12e], dx
mov eax, 0xae
mov word [esp + 0x136], ax
mov ecx, 0x1b
mov word [esp + 0x132], cx
mov edx, 0x88
mov word [esp + 0x134], dx
mov eax, 0x95
mov word [esp + 0x13c], ax
mov ecx, 0x3f
mov word [esp + 0x138], cx
mov edx, 0x2c
mov word [esp + 0x13a], dx
mov eax, 0xc0
mov ecx, 0x34
mov edx, 0x98
mov word [esp + 0x142], ax
mov word [esp + 0x13e], cx
mov word [esp + 0x140], dx
mov eax, 0x67
mov ecx, 0x4c
mov edx, 0x1a
mov word [esp + 0x148], ax
mov word [esp + 0x144], cx
mov word [esp + 0x146], dx
mov eax, 0x1e
mov ecx, 0x70
mov edx, 0xce
mov word [esp + 0x14e], ax
mov word [esp + 0x14a], cx
mov word [esp + 0x14c], dx
mov eax, 1
mov ecx, 0xd3
mov edx, 0x6f
mov word [esp + 0x150], cx
mov word [esp + 0x152], dx
test byte [0x1009098c], al
jne 0x10017bad
or dword [0x1009098c], eax
lea eax, [esp + 0xbc]
lea ecx, [esp + 0x154]
mov byte [esp + 0x400], 4
call fcn.100432a0
push 0x10077ed0
call fcn.1005f1f6
add esp, 4
mov eax, dword [0x100906b0]
push ebx
push eax
mov eax, 0x208
lea ebx, [esp + 0x1f4]
call fcn.1000b110
mov cl, byte [0x1008d8bb]
mov al, cl
mov dl, 0x73
imul dl
mov dl, al
mov al, cl
mov bl, 0x43
imul bl
mov bl, al
sub dl, 0x73
mov al, dl
add bl, 0x21
imul bl
imul cl
add esp, 8
mov cl, 0xe8
lea edx, [esp + 0x1ec]
sub cl, al
push edx
add cl, cl
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x1008d8bb], cl
call esi
mov al, byte [0x1008d8bb]
mov cl, 0x59
imul cl
mov dl, 0xc9
sub dl, al
mov byte [0x1008d8bb], dl
cmp dword [esp + 0x2c], edi
jb 0x10017c2b
mov eax, dword [esp + 0x18]
push eax
call fcn.1004408a
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x3f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.1005f0c0
add esp, 0x3f0
ret