Function at 0x1000ecd9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004fa86
mov eax, dword fs:[0]
push eax
mov eax, 0x1a20
call fcn.10045780
mov eax, dword [0x10069060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19b0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x19bc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x19cc], eax
lea eax, [ebp - 0x1a10]
mov ebx, ecx
push eax
mov dword [ebp - 0x19c8], ebx
call fcn.1000d857
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov ecx, dword [ebx]
mov dword [ebp - 0x19ac], ecx
mov dword [ebp - 0x19a8], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x19b4], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x19b8]
lea esi, [ebp - 0x19ac]
mov dword [ebp - 0x19b8], eax
call fcn.1000f27c
test al, al
jne 0x1000ee16
call fcn.1000b132
mov ebx, dword [ebp - 0x19b0]
mov ecx, dword [ebx + 0x1c]
add ebx, 4
push eax
mov dword [ebp - 0x19c0], ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x19d4]
push eax
mov dword [ebp - 0x19c4], ecx
call fcn.1000f029
mov edi, eax
lea esi, [ebp - 0x19c4]
call fcn.1000f27c
test al, al
je 0x1000ede8
lea esi, [ebp - 0x19ac]
call fcn.1000b132
mov ebx, dword [ebp - 0x19bc]
push eax
call fcn.1000f0eb
push 0x198c
mov edi, eax
call fcn.1000b132
add eax, 0x1c
push eax
push edi
call fcn.10039220
add esp, 0xc
lea esi, [ebp - 0x19ac]
call fcn.1000b132
push eax
lea eax, [ebp - 0x1a10]
push eax
lea ebx, [ebp - 0x19f0]
call fcn.1000dc3c
call fcn.1000f4d9
mov ebx, dword [ebp - 0x19c8]
jmp 0x1000ed51
mov eax, dword [ebp - 0x19b0]
mov ecx, dword [eax + 0x1c]
mov ecx, dword [ecx]
add eax, 4
mov edx, dword [eax]
mov dword [ebp - 0x19b0], eax
mov dword [ebp - 0x19ac], edx
mov dword [ebp - 0x19a8], ecx
mov ecx, dword [eax + 0x18]
mov eax, dword [eax]
lea edi, [ebp - 0x19c4]
lea esi, [ebp - 0x19ac]
mov dword [ebp - 0x19c0], ecx
mov dword [ebp - 0x19c4], eax
call fcn.1000f27c
test al, al
jne 0x1000efa3
call fcn.1000b132
mov dword [ebp - 0x19bc], eax
push eax
mov eax, ebx
call fcn.1000f8ba
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 0x19b4], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x19e4]
lea esi, [ebp - 0x19b8]
mov dword [ebp - 0x19b8], eax
mov dword [ebp - 0x19e0], ecx
mov dword [ebp - 0x19e4], eax
call fcn.1000f27c
test al, al
jne 0x1000eec3
mov ecx, dword [ebp - 0x19b4]
mov eax, dword [ebp - 0x19bc]
add ecx, 0xc
call fcn.1000b88c
test al, al
jne 0x1000eec3
mov eax, esi
jmp 0x1000eeda
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x19d8], eax
mov eax, dword [ebx]
mov dword [ebp - 0x19dc], eax
lea eax, [ebp - 0x19dc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x19e8], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x19d0], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x19ec]
lea esi, [ebp - 0x19d4]
mov dword [ebp - 0x19ec], ecx
mov dword [ebp - 0x19d4], eax
call fcn.1000f27c
test al, al
je 0x1000ef8d
mov edi, 0x198c
push edi
lea eax, [ebp - 0x19a4]
push 0
push eax
call fcn.10038cf0
add esp, 0xc
lea eax, [ebp - 0x19a4]
push eax
lea esi, [ebp - 0x19ac]
call fcn.1000b132
mov ecx, eax
call fcn.1000e3a5
test eax, eax
je 0x1000ef8d
lea eax, [ebp - 0x19a4]
push eax
lea esi, [ebp - 0x1a2c]
call fcn.10001ec7
mov ebx, dword [ebp - 0x19cc]
push edi
lea eax, [ebp - 0x19a4]
push eax
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.1000f0eb
push eax
call fcn.10039220
add esp, 0xc
push 0
push 1
mov byte [ebp - 4], 0
call fcn.100021ef
mov ebx, dword [ebp - 0x19c8]
lea esi, [ebp - 0x19ac]
call fcn.1000b697
mov eax, dword [ebp - 0x19b0]
jmp 0x1000ee38
mov esi, dword [ebp - 0x19b0]
lea eax, [ebp - 0x1a10]
push eax
call fcn.1000eff8
push str.Softwareprojonepodlp_software_
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, ebx
call fcn.1000e685
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1a10]
push eax
call fcn.1000d31e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100366e3
leave
ret 0xc