Function at 0x1008792
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1002f28
mov esi, ecx
call fcn.01015547
xor ebx, ebx
cmp word [esi + 0x83c], bx
pop ecx
je 0x1008873
lea eax, [esi + 0xc4c]
cmp word [eax], bx
jne 0x10087e6
push 0x104
push eax
lea eax, [esi + 0x634]
push eax
call fcn.0101971c
add esp, 0xc
lea eax, [esi + 0x634]
push eax
lea eax, [esi + 0x83c]
push eax
lea eax, [esi + 0xc4c]
push eax
lea edi, [esi + 0xe54]
push 0x104
push edi
call fcn.0101816d
push edi
push 0x1002f10
mov dword [ebp - 0x418], eax
call fcn.010155fa
add esp, 0x1c
cmp dword [ebp - 0x418], ebx
je 0x1008873
cmp word [edi], bx
jne 0x1008873
mov ecx, esi
call fcn.01006eb9
test eax, eax
jne 0x100886c
push 0x4c8
push dword [esi + 0x1274]
push dword [esi + 0x428]
call fcn.0100648b
add esp, 0xc
test eax, eax
jne 0x100886c
push ebx
push 0x100151c
push 0x10021b8
push dword [esi + 0x428]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x1008a84
cmp dword [ebp + 8], ebx
jne 0x100890a
mov ecx, esi
call fcn.01007ad5
test eax, eax
je 0x100886c
mov ecx, esi
call fcn.01006fa4
test eax, eax
je 0x100886c
mov ecx, esi
call fcn.01007912
test eax, eax
je 0x100886c
mov ecx, esi
call fcn.010075ee
test eax, eax
je 0x100886c
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push ebx
lea eax, [esi + 0x106c]
push eax
push 0x80000001
mov dword [ebp - 0x418], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100890a
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1002664
push dword [ebp - 0x418]
call edi
push 0x1002654
push dword [ebp - 0x418]
call edi
push 0x1002640
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.010055f2
cmp word [esi + 0xa44], bx
je 0x1008926
cmp dword [eax + 0x18], ebx
jne 0x1008926
push 2
mov ecx, esi
call fcn.01007110
cmp dword [ebp + 8], 1
je 0x100886c
mov edi, 0x208
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.01008e20
add esp, 0xc
push 0x1002ee0
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.010055fd
test eax, eax
push edi
push ebx
je 0x1008976
lea eax, [ebp - 0x414]
push eax
call fcn.01008e20
add esp, 0xc
jmp 0x10089ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01008e20
lea eax, [esi + 0x634]
add esp, 0xc
cmp word [eax], bx
jne 0x1008996
lea eax, [esi + 0x42c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010055fd
test eax, eax
je 0x10089bd
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01008e20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x10089ff
xor edx, edx
lea ecx, [ebp + edx*2 - 0x20c]
cmp word [ecx], 0x5c
jne 0x10089e2
mov word [ecx], 0x2f
inc edx
cmp edx, eax
jl 0x10089d0
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.01005637
lea eax, [ebp - 0x414]
push eax
push 0x1002ec8
call fcn.010155fa
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 0x1280], eax
je 0x100886c
push 0x1002ea0
call fcn.01015547
pop ecx
push dword [esi + 0x1280]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x1008767
push ebx
push ebx
mov dword [ebp - 0x41c], ebx
call fcn.01009e3b
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x127c], eax
jne 0x1008a81
push dword [esi + 0x1280]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100886c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret 4