Function at 0x1002078c
Capabilities:
Delete registry value

Disassembly:
push 0x4c
mov eax, 0x1002bc7f
call fcn.1002acfb
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], edi
mov eax, dword [0x1002f024]
cmp eax, 0x1002f024
je 0x100207cd
test byte [eax + 0x1c], 1
je 0x100207cd
cmp byte [eax + 0x19], 5
jb 0x100207cd
push dword [ebp + 0xc]
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1b
pop ecx
call fcn.10020337
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
push 0x1002f508
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.10009292
push ebx
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push 0x10002a48
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x10020c02
mov ecx, edi
call fcn.100091fe
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.10009185
lea ecx, [ebp - 0x1c]
call fcn.10014c01
push ecx
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
call fcn.10021fcb
mov ebx, eax
mov edx, dword [0x1002f024]
cmp edx, 0x1002f024
je 0x10020861
test byte [edx + 0x1c], 2
je 0x10020861
cmp byte [edx + 0x19], 4
jb 0x10020861
push ebx
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x100030e0
push 0x1c
pop ecx
call fcn.10003c37
mov edx, dword [0x1002f024]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
jne 0x10020b1b
mov edx, esi
lea ecx, [ebp - 0x54]
call fcn.10026d58
mov ebx, eax
mov dword [ebp - 0x2c], eax
mov edx, dword [0x1002f024]
cmp edx, 0x1002f024
je 0x100208ab
test byte [edx + 0x1c], 2
je 0x100208ab
cmp byte [edx + 0x19], 4
jb 0x100208ab
push ebx
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x1d
pop ecx
call fcn.10020337
mov edx, dword [0x1002f024]
cmp ebx, 2
jne 0x100208f1
mov ebx, 0x490
mov dword [ebp - 0x2c], ebx
cmp edx, 0x1002f024
je 0x10020b1b
test byte [edx + 0x1c], 2
je 0x10020b1b
cmp byte [edx + 0x19], 4
jb 0x10020b1b
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x100030e0
push 0x1e
pop ecx
call fcn.10003c19
mov edx, dword [0x1002f024]
test ebx, ebx
jne 0x10020b1b
push esi
push dword [ebp - 0x54]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov ecx, dword [0x1002f024]
cmp ecx, 0x1002f024
je 0x1002092d
test byte [ecx + 0x1c], 2
je 0x1002092d
cmp byte [ecx + 0x19], 4
jb 0x1002092d
push eax
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1f
pop ecx
call fcn.10020337
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edi, dword [eax + 0x2c]
mov ecx, edi
call dword [0x10030334]
mov ecx, dword [ebp - 0x14]
call edi
test eax, eax
je 0x10020b12
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edi, dword [eax + 0x2c]
mov ecx, edi
call dword [0x10030334]
mov ecx, dword [ebp - 0x14]
call edi
push eax
lea ecx, [ebp - 0x24]
call fcn.1000d343
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
push 0x2011f
push ecx
push dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x100209a7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1002f024]
cmp eax, 0x1002f024
je 0x100209d1
test byte [eax + 0x1c], 2
je 0x100209d1
cmp byte [eax + 0x19], 4
jb 0x100209d1
push edi
push dword [ebp - 0x24]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x20
pop ecx
call fcn.10020337
test edi, edi
jne 0x10020aed
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x48]
call fcn.100267fb
mov edi, eax
mov ecx, dword [0x1002f024]
cmp ecx, 0x1002f024
je 0x10020a14
test byte [ecx + 0x1c], 2
je 0x10020a14
cmp byte [ecx + 0x19], 4
jb 0x10020a14
push edi
push dword [ecx + 0x14]
mov edx, 0x100030e0
push dword [ecx + 0x10]
push 0x21
pop ecx
call fcn.10003c37
test edi, edi
jne 0x10020aed
cmp dword [ebp - 0x38], edi
jbe 0x10020aed
mov ebx, dword [ebp - 0x48]
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x3c]
push edi
call fcn.10014bdc
and dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push ecx
push 0x2011f
push 0
push dword [eax]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x10020a5f
and dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1002f024]
cmp eax, 0x1002f024
je 0x10020a98
test byte [eax + 0x1c], 2
je 0x10020a98
cmp byte [eax + 0x19], 4
jb 0x10020a98
push edi
lea ecx, [ebp - 0x3c]
call fcn.10014bdc
push dword [ebp - 0x20]
push dword [eax]
mov eax, dword [0x1002f024]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x22
pop ecx
call fcn.10020337
cmp dword [ebp - 0x20], 0
jne 0x10020ad2
push esi
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov ecx, dword [0x1002f024]
cmp ecx, 0x1002f024
je 0x10020ad2
test byte [ecx + 0x1c], 2
je 0x10020ad2
cmp byte [ecx + 0x19], 4
jb 0x10020ad2
push eax
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x23
pop ecx
call fcn.10020337
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10020ae0
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
inc edi
cmp edi, dword [ebp - 0x38]
jb 0x10020a28
mov ebx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
call fcn.10014f41
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10020b03
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.1000947c
mov edi, dword [ebp - 0x30]
mov edx, dword [0x1002f024]
cmp dword [ebp + 0xc], 0
je 0x10020ba9
test ebx, ebx
jne 0x10020c0b
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x10020b77
call fcn.10027212
test al, al
jne 0x10020b77
mov eax, dword [0x1002f024]
cmp eax, 0x1002f024
je 0x10020b71
test byte [eax + 0x1c], 2
je 0x10020b71
cmp byte [eax + 0x19], 2
jb 0x10020b71
push ebx
push 0x80004001
push dword [eax + 0x14]
mov edx, 0x100030e0
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.1000965c
mov byte [ebp - 4], 1
jmp 0x10020bad
mov eax, dword [0x1002f024]
cmp eax, 0x1002f024
je 0x10020bad
test byte [eax + 0x1c], 2
je 0x10020bad
cmp byte [eax + 0x19], 2
jb 0x10020bad
push edi
push dword [eax + 0x14]
mov edx, 0x100030e0
push dword [eax + 0x10]
push 0x24
pop ecx
call fcn.10006c7a
mov edx, dword [0x1002f024]
test ebx, ebx
jne 0x10020c0b
mov eax, dword [ebp - 0x14]
push 0
push ecx
push 0x3ea
mov eax, dword [eax]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x10030334]
mov ecx, dword [ebp - 0x14]
call edi
mov edx, esi
mov ecx, eax
call fcn.10023874
mov edx, dword [0x1002f024]
cmp edx, 0x1002f024
je 0x10020c41
test byte [edx + 0x1c], 2
je 0x10020c0b
cmp byte [edx + 0x19], 4
jb 0x10020c0b
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x100030e0
push 0x2d
pop ecx
call fcn.10003c19
jmp 0x10020c05
mov esi, dword [ebp - 0x1c]
mov edx, dword [0x1002f024]
cmp edx, 0x1002f024
je 0x10020c41
test byte [edx + 0x1c], 1
je 0x10020c41
movzx ecx, byte [edx + 0x19]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x10020c41
push ebx
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x100030e0
push 0x2e
pop ecx
call fcn.10003c37
lea ecx, [esi - 0x10]
call fcn.1000947c
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x10020c57
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
call fcn.1002acaa
ret 8