Function at 0x10003ef0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x1007a236
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x248]
mov edi, dword [esp + 0x23c]
push edi
mov dword [esp + 0x238], ebx
mov dword [esp + 0x20], eax
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jge 0x10003f42
jmp 0x100044ad
cmp byte [edi], 0x7d
push ebp
je 0x100044aa
lea esp, [esp]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [esp + 0x18], 1
call esi
mov ebp, eax
neg ebp
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x10003f81
cmp ebp, ebx
je 0x10004074
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
cmp dword [esp + 0x248], ebx
je 0x10004074
mov cl, byte [edi]
cmp cl, bl
mov dword [esp + 0x1c], ebx
mov eax, edi
je 0x10003fcc
mov edi, edi
cmp cl, 0x5c
je 0x10003fc4
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
cmp cl, bl
jne 0x10003fb0
jmp 0x10003fcc
cmp eax, ebx
jne 0x100044c7
mov ecx, dword [esp + 0x18]
push edi
call fcn.100019f0
test eax, eax
je 0x10003ff3
mov ecx, dword [esp + 0x244]
mov dword [esp + 0x1c], ecx
push edi
lea ecx, [esp + 0x20]
call fcn.10002450
mov dword [esp + 0x1c], ebx
cmp ebp, ebx
je 0x10004074
mov ebp, dword [esp + 0x18]
push edi
mov ecx, ebp
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x100044e0
push edi
mov ecx, ebp
call fcn.10001a80
mov esi, eax
cmp esi, ebx
jl 0x100044e0
cmp byte [edi], 0x7b
jne 0x10004066
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x10004066
mov eax, dword [esp + 0x248]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
push ebx
push eax
push ecx
push edi
mov ecx, ebp
call fcn.10003ef0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
push edi
mov ecx, ebp
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
cmp byte [edi], 0x7d
jne 0x10003f50
jmp 0x1000449b
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000409c
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], ebx
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
push 0x100816c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100041a1
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x12c]
push edx
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
cmp byte [edi], 0x3d
jne 0x100044d0
cmp dword [esp + 0x248], ebx
je 0x10004135
mov eax, dword [esp + 0x244]
push edi
lea ecx, [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x244], 1
mov dword [esp + 0x1c], eax
call fcn.10003b60
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x10], ebx
jl 0x100044e6
mov byte [esp + 0x238], bl
jmp 0x1000401f
cmp dword [esp + 0x24c], ebx
jne 0x10004192
cmp dword [esp + 0x10], ebx
je 0x10004192
mov eax, dword [esp + 0x244]
push 0x20006
push ebx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
call fcn.10001580
cmp eax, ebx
jne 0x10004487
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x12c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x10004187
cmp eax, 2
jne 0x10004487
cmp esi, ebx
je 0x10004192
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001a80
jmp 0x1000405c
mov cl, byte [edi]
cmp cl, bl
mov eax, edi
je 0x100041c8
mov esi, dword [sym.imp.USER32.dll_CharNextA]
nop
cmp cl, 0x5c
je 0x100041c0
push eax
call esi
mov cl, byte [eax]
cmp cl, bl
jne 0x100041b0
jmp 0x100041c8
cmp eax, ebx
jne 0x100044d0
cmp dword [esp + 0x248], ebx
je 0x100042e6
mov eax, dword [esp + 0x244]
lea edx, [esp + 0x10]
push edx
push 0x2001f
push ebx
push edi
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10004218
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x10004208
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x100042aa
mov eax, dword [esp + 0x244]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push edi
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10004257
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x1000424b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x100042aa
mov ecx, dword [esp + 0x244]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x100044fa
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x10004298
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov edx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 0x14], edx
jne 0x100044fa
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
cmp byte [edi], 0x3d
jne 0x1000401f
mov ecx, dword [esp + 0x18]
push edi
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.10003b60
mov esi, eax
cmp esi, ebx
jl 0x1000449b
jmp 0x1000401f
cmp dword [esp + 0x24c], ebx
jne 0x100043ee
mov edx, dword [esp + 0x244]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push edi
push edx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1000432e
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x10004326
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
cmp eax, ebx
mov ebp, eax
je 0x1000433f
mov dword [esp + 0x24c], 1
push 0x104
push edi
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
mov ecx, dword [esp + 0x18]
push edi
call fcn.10001a80
mov esi, eax
cmp esi, ebx
jl 0x1000449b
cmp byte [edi], 0x7b
jne 0x100043bc
mov eax, dword [esp + 0x24c]
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x24]
push edi
call fcn.10003ef0
mov esi, eax
cmp esi, ebx
jge 0x100043a8
cmp dword [esp + 0x24c], ebx
je 0x1000449b
mov ecx, dword [esp + 0x18]
push edi
call fcn.100018b0
mov esi, eax
cmp esi, ebx
jl 0x1000449b
cmp ebp, 2
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24c], edx
je 0x10004066
cmp ebp, ebx
mov eax, edx
je 0x100043f8
cmp eax, ebx
jne 0x10004066
push ebp
call fcn.100014f0
add esp, 4
mov esi, eax
jmp 0x1000449b
mov ebp, 2
jmp 0x10004334
cmp eax, ebx
je 0x10004441
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
call fcn.10001a30
test eax, eax
je 0x10004441
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.100019f0
test eax, eax
je 0x10004066
cmp dword [esp + 0x10], ebx
je 0x10004066
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.10002450
jmp 0x10004066
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1000445e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x14], ebx
jne 0x1000450e
cmp dword [esp + 0x10], ebx
je 0x10004066
mov edx, dword [esp + 0x244]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x10004066
push eax
call fcn.100014f0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.10002430
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x100044aa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x22c
ret 0x10
lea ecx, [esp + 0x1c]
call fcn.10002430
lea ecx, [esp + 0x14]
call fcn.10002430
mov eax, 0x80020009
jmp 0x100044ac
lea ecx, [esp + 0x1c]
jmp 0x10004496
lea ecx, [esp + 0x10]
call fcn.10002430
lea ecx, [esp + 0x14]
call fcn.10002430
jmp 0x100044aa
lea ecx, [esp + 0x14]
call fcn.10002430
push esi
call fcn.100014f0
add esp, 4
jmp 0x100044ac
lea ecx, [esp + 0x14]
call fcn.10002430
push ebp
call fcn.100014f0
add esp, 4
jmp 0x100044ac