Function at 0x100266ca
Capabilities:
Delete registry value

Disassembly:
push 0x2c
mov eax, 0x100674ba
call fcn.1003a5de
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x1c], esi
inc eax
lea ecx, [ebp - 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
mov dword [ebp - 0x10], eax
mov ebx, esi
mov byte [ebp - 4], al
call fcn.1000155e
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x18]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x10026737
call fcn.100016f0
call fcn.1002e270
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x1002678b
call fcn.1002e262
mov ebx, eax
test ebx, ebx
je 0x100267c5
push ebx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x100267be
lea eax, [ebp - 0x1c]
push eax
push 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x100267b8
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
test edi, edi
je 0x10026780
mov eax, dword [edi]
jmp 0x10026782
mov eax, esi
push 0x20019
push eax
push ecx
jmp 0x100267a0
test edi, edi
je 0x10026793
mov eax, dword [edi]
jmp 0x10026795
mov eax, esi
push 0x2001f
push eax
push SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.10059c4f
test eax, eax
je 0x100267cd
test ebx, ebx
je 0x100267c5
lea ecx, [ebp - 0x38]
call fcn.1001ad8c
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x1002695f
push str.Flags
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10026886
cmp eax, 2
je 0x10026886
push 0x1007e304
lea ecx, [ebp - 0x10]
call fcn.1000155e
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x1002682b
call fcn.100016f0
push str._Flags
lea ecx, [ebp - 0x14]
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10026858
call fcn.100016f0
mov esi, dword [ebp - 0x10]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10026868
lock inc dword [esi + 8]
push dword [ebp - 0x20]
call fcn.100295eb
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], eax
pop ecx
pop ecx
test esi, esi
je 0x10026886
mov ecx, esi
call fcn.100016f0
push str.Version
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1002693b
cmp eax, 2
je 0x1002693b
push str.cleanupSSVDisabledEntry_error
lea ecx, [ebp - 0x10]
call fcn.1000155e
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x100268e4
call fcn.100016f0
push str._Version
lea ecx, [ebp - 0x14]
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x10026911
call fcn.100016f0
mov esi, dword [ebp - 0x10]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10026921
lock inc dword [esi + 8]
push dword [ebp - 0x20]
call fcn.100295eb
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
pop ecx
test esi, esi
je 0x1002693b
mov ecx, esi
call fcn.100016f0
lea ecx, [ebp - 0x2c]
call fcn.1001ad8c
test ebx, ebx
je 0x1002695c
lea ecx, [ebp - 0x38]
call fcn.1001ad8c
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x1002696a
mov ecx, edi
call fcn.100016f0
lea ecx, [ebp - 0x2c]
call fcn.1001ad8c
lea ecx, [ebp - 0x38]
call fcn.1001ad8c
mov eax, ebx
call fcn.1003a5b8
ret