Function at 0x10018c24
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x10018c40
mov dword [ebp - 4], 0x80000001
jmp 0x10018c47
mov dword [ebp - 4], 0x80000002
push str.Public_DomainBlat
push str.SOFTWARE
push 0x1002e620
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
push str._default_
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
jne 0x10018db7
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x10018cc7
movzx eax, word [0x100415d0]
test eax, eax
jne 0x10018cbf
push str.Error_in_finding_blat_default_profile_in_the_registry_n
call dword [0x100320c4]
pop ecx
push 0xa
pop eax
jmp 0x10018f94
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x20c], 0
jne 0x10018da9
mov dword [ebp - 0x214], 0x101
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0x10043628
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x218], eax
push dword [ebp - 0x218]
push dword [ebp - 8]
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x103
jne 0x10018d3c
and dword [ebp - 0x20c], 0
jmp 0x10018da9
cmp dword [ebp - 0x20c], 0
jne 0x10018da4
push 0x10043628
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x10018d97
movzx eax, word [0x100415d0]
test eax, eax
jne 0x10018d8f
push str.Error_in_deleting_profile
call dword [0x100320c4]
pop ecx
push dword [ebp + 8]
call dword [0x100320c4]
pop ecx
push str._in_the_registry_n
call dword [0x100320c4]
pop ecx
push 0xb
pop eax
jmp 0x10018f94
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
jmp 0x10018cce
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10018f92
push str._all_
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
jne 0x10018e87
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call fcn.10018f96
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x10018e82
push 0x10023874
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x20c], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5c
lea eax, [ebp - 0x208]
push eax
call fcn.10001458
pop ecx
pop ecx
and word [eax], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x10018e82
push 0x10023874
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x20c], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10018f92
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test eax, eax
je 0x10018f92
push 0x1002e61c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call fcn.10018f96
pop ecx
pop ecx
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x10018f10
movzx eax, word [0x100415d0]
test eax, eax
jne 0x10018f08
push str.Error_in_deleting_profile
call dword [0x100320c4]
pop ecx
push dword [ebp + 8]
call dword [0x100320c4]
pop ecx
push str._in_the_registry_n
call dword [0x100320c4]
pop ecx
push 0xb
pop eax
jmp 0x10018f94
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x10018f57
push 0x10023874
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x20c], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], 0
je 0x10018f92
movzx eax, word [0x100415d0]
test eax, eax
jne 0x10018f8d
push str.Error_in_finding_blat_profile
call dword [0x100320c4]
pop ecx
push dword [ebp + 8]
call dword [0x100320c4]
pop ecx
push str._in_the_registry_n
call dword [0x100320c4]
pop ecx
push 0xa
pop eax
jmp 0x10018f94
xor eax, eax
leave
ret