Function at 0x1001746b
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1007c143
call fcn.1007b848
sub esp, 0x98
push ebx
push esi
push edi
push 3
pop esi
mov ebx, edx
mov dword [ebp - 0x4c], ecx
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x24], ebx
call fcn.10014fc7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x18], 0x744d
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xe62b5009
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xe9a9d012
mov dword [ebp - 0x20], 1
push esi
call fcn.10014fc7
mov byte [ebp - 4], 1
xor edx, edx
mov dword [ebp - 0x20], 0xf4f2d891
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x14], edx
jmp 0x100174f2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 0x7a4a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100174e2
mov dword [ebp - 0x14], edx
jmp 0x1001750c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], 0x6232c2a4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100174fc
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
push 2
pop edi
mov ecx, dword [ecx + 8]
sub ecx, eax
je 0x100175a5
mov dword [ebp - 0x1c], 0xe12aa53f
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edi
jg 0x10017610
push esi
lea ecx, [ebp - 0x68]
call fcn.10014fc7
mov dword [ebp - 0x14], 0
jmp 0x1001755a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], 0xae4b9a73
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001754a
mov eax, dword [ebp - 0x68]
mov dword [eax], edi
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x10017574
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x58]
mov eax, dword [esi]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esi]
jns 0x10017564
mov dword [ebp - 0x1c], 0x104272ba
lea ecx, [ebp - 0x68]
call fcn.100157f4
inc dword [ebp - 0x18]
push 3
pop esi
cmp dword [ebp - 0x18], edi
jle 0x10017538
jmp 0x10017610
mov dword [ebp - 0x10], 0xffff
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x14], edx
jmp 0x100175c2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100175b8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
sub ecx, 0xcefbde28
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sete cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x74]
call fcn.100157f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.100157f4
cmp byte [ebp + 8], 0
je 0x100177e0
mov dword [ebp + 8], 0
jmp 0x10017645
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x48], 0xad313dd3
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x10017637
mov dword [ebp - 0x44], 0x1b
jmp 0x1001768e
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 0xb
jmp 0x10017685
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x1001767c
push 0xfed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 0x44], 0
jne 0x1001768b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
jl 0x10017663
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffe9
je 0x10017653
push esi
lea ecx, [ebp - 0x3c]
call fcn.10014fc7
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x98]
mov dword [ebp + 8], 0xf57a7c2
push edi
call fcn.10014fc7
xor edx, edx
mov dword [ebp + 8], edx
jmp 0x100176ca
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x3c]
mov dword [eax + ecx*4], 0x77862fd4
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x100176ba
mov dword [ebp + 8], edx
jmp 0x100176e7
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 6
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x100176d4
mov dword [ebp + 8], edi
cmp dword [ebp + 8], edx
jl 0x100177ac
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], esi
xor ecx, ecx
mov dword [ebp - 0x10], edx
inc ecx
jmp 0x10017714
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10017706
mov dword [esi + 4], ecx
mov dword [ebp - 0x5c], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x3c]
cmp dword [eax + ecx*4], edx
jne 0x1001772d
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x3c]
push 0
imul ecx, dword [eax + edx*4]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, 3
setge dl
xor ecx, ecx
imul edx, dword [eax + esi*4]
mov esi, dword [ebp - 0x1c]
cmp dword [eax + edi*4], edx
mov eax, dword [ebp + 8]
setne cl
xor edx, edx
cmp ecx, dword [esi + 8]
setne dl
xor ecx, ecx
add eax, edx
cmp eax, 0xfffffff6
pop edx
setg cl
xor eax, eax
cmp ecx, 0xfffffff7
setle al
xor ecx, ecx
cmp eax, dword [esi + 8]
setg cl
xor eax, eax
cmp ecx, 0xffff
mov ecx, 0x67f5ed9a
setne al
sub ecx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + ebx*4], ecx
dec dword [ebp + 8]
jns 0x100176fe
mov ebx, dword [ebp - 0x24]
mov byte [ebp + 0xb], dl
cmp byte [ebp + 0xb], 0
je 0x100177c1
push 0x11b2
push edx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea ecx, [ebp - 0x98]
call fcn.100157f4
lea ecx, [ebp - 0x3c]
call fcn.100157f4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx], eax
jmp 0x100179c4
xor ecx, ecx
mov dword [ebp - 0x18], 0xffffffff
push 0xfffffffffffffff6
mov dword [ebp + 8], ecx
pop ebx
jmp 0x100177fe
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x100177f1
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x18], ecx
jl 0x10017854
mov dword [ebp - 0x10], 0xfe77dd68
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ecx
jl 0x1001784f
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x1001784a
push ecx
push 0xf4a
push 0x2673
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor ecx, ecx
dec dword [ebp - 0x10]
jns 0x10017824
dec dword [ebp - 0x18]
jns 0x10017811
mov dword [ebp - 0x9c], 0xf3d4210e
xor eax, eax
mov dword [ebp + 8], esi
inc eax
mov dword [ebp - 0x10], 0xcdead9ba
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x389a9b8
mov dword [ebp - 0x1c], 0x2c39d5b6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xdf8a
cmp dword [ebp + 8], ebx
jne 0x1001789e
mov esi, ebx
cmp dword [ebp - 0x10], ebx
je 0x100178a0
mov esi, eax
mov dword [ebp - 0x18], 9
xor edx, edx
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
inc ecx
jne 0x100178ca
cmp dword [ebp + 8], ebx
je 0x100178d4
cmp dword [ebp - 0x18], ebx
je 0x100178d4
xor eax, eax
inc eax
jmp 0x100178d6
mov eax, ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp + 8], 0x10c93b4e
mov dword [ebp + 8], 0xfffffff7
push eax
call fcn.10014fc7
mov dword [ebp - 0x24], 4
mov dword [ebp + 8], ebx
jmp 0x10017930
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0x17f75960
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x10017920
mov dword [ebp + 8], ebx
jmp 0x10017944
mov dword [ebp - 0x1c], ebx
dec dword [ebp - 0x1c]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0xc
jne 0x1001793b
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x80]
call fcn.100157f4
mov eax, dword [ebp - 0x4c]
cmp byte [eax], bl
je 0x10017964
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 1
lea ecx, [ebp - 0x8c]
call fcn.10014fc7
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp + 8], ebx
jmp 0x1001798f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0xea7
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001797c
mov dword [ebp - 0x10], ebx
jmp 0x100179b4
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x100179b1
push ebx
push ebx
push 0x59d
call edi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10017999
lea ecx, [ebp - 0x8c]
call fcn.100157f4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret