Function at 0x10015491
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078dcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1cc
and dword [ebp - 0xf4], 0
mov dword [ebp - 0x58], 0x1897a4a
mov dword [ebp - 0x188], 0x7cefa9d1
mov dword [ebp - 0x94], 0x62c9cc14
mov dword [ebp - 0x28], 0
jmp 0x100154e1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100154f7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1d8], 0xe279
jmp 0x100154da
mov dword [ebp - 0x28], 0
jmp 0x10015507
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001551d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1ac], 0
jmp 0x10015500
mov dword [ebp - 0x58], 0
jmp 0x1001552d
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1001555f
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x10015549
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x1001555d
push 1
call fcn.1001537b
pop ecx
jmp 0x10015526
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
xor eax, eax
mov word [ebp - 0x7e], ax
lea eax, [ebp - 0x7e]
push eax
mov eax, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
lea ecx, [ebp - 0x138]
call fcn.10017931
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x174], eax
mov eax, 0x469ad59e
test eax, eax
je 0x1001565d
mov dword [ebp - 0x4c], 0
jmp 0x100155b9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x100155cc
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x3c], 0xa0029bf3
jmp 0x100155b2
mov dword [ebp - 0x14], 0
jmp 0x100155dc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x10015638
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x194], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x158], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x190], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp + ecx*4 - 0x3c], eax
jmp 0x100155d5
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x10015658
push 0x674
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0x100156f0
mov dword [ebp - 0x5c], 0
jmp 0x1001566d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10015683
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x160], 3
jmp 0x10015666
mov dword [ebp - 0x14], 0
jmp 0x10015693
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x100156e8
mov dword [ebp - 0x78], 8
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x100156b4
push 0
call fcn.100160ac
pop ecx
mov dword [ebp - 0x78], 0
jmp 0x100156c4
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x100156e6
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x100156e4
push 0x1ba8
push 0
call fcn.100153d8
pop ecx
pop ecx
jmp 0x100156bd
jmp 0x1001568c
push 1
call fcn.1001539e
pop ecx
push 0x694d
push 0
call fcn.10015ff9
pop ecx
pop ecx
and dword [ebp - 0x64], 0
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x138]
call fcn.100179bd
dec eax
mov dword [ebp - 0x118], eax
jmp 0x10015721
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x118]
jae 0x10015a2f
push dword [ebp - 0x60]
lea ecx, [ebp - 0x138]
call fcn.100179c5
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x40], 0x43d837bc
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x148], 0xd39c7c6f
mov dword [ebp - 0x144], 0xd39c7c6f
mov dword [ebp - 0x140], 0xd39c7c6f
mov dword [ebp - 0x13c], 0xd39c7c6f
mov dword [ebp - 0x12c], 0x2280
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x70], 0
jmp 0x100157a1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x100157b7
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1a4], 1
jmp 0x1001579a
cmp dword [ebp - 0x40], 0
jne 0x10015870
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x88], eax
jg 0x100157d8
mov dword [ebp - 0xc8], 1
jmp 0x100157df
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xc8], eax
jge 0x100157f9
mov dword [ebp - 0xfc], 1
jmp 0x10015800
and dword [ebp - 0xfc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0xfc], eax
jne 0x10015821
mov dword [ebp - 0x110], 1
jmp 0x10015828
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x40]
imul eax, eax, 9
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x88], eax
jge 0x10015855
mov dword [ebp - 0xf0], 1
jmp 0x1001585c
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xf0], eax
jne 0x10015870
and dword [ebp - 0xa0], 0
jmp 0x1001587a
mov dword [ebp - 0xa0], 1
cmp dword [ebp - 0xa0], 0xdffb
je 0x10015892
mov dword [ebp - 0x108], 1
jmp 0x10015899
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp + ecx - 0x1a4], eax
mov byte [ebp - 0x2d], 0
lea eax, [ebp - 0x2d]
push eax
push 1
call fcn.100153d8
pop ecx
pop ecx
and dword [ebp - 0x6c], 0
jmp 0x100158e0
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x6c], 2
jae 0x10015a2a
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x120], 0xcbad
mov dword [ebp - 0x10c], 0xfc371865
mov dword [ebp - 0x68], 0
jmp 0x10015915
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1001592b
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1cc], 0x223fa3a9
jmp 0x1001590e
mov dword [ebp - 0x54], 0xffffffe4
jmp 0x1001593b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x16
jge 0x100159ca
mov dword [ebp - 0xd0], 0x8b5131d8
mov dword [ebp - 0x50], 0
jmp 0x1001595f
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x10015975
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1bc], 0xd416db6d
jmp 0x10015958
mov dword [ebp - 0x10c], 0xffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x120], eax
jg 0x100159ac
mov dword [ebp - 0xa8], 1
jmp 0x100159b3
and dword [ebp - 0xa8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + eax - 0x1cc], ecx
jmp 0x10015934
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x100159e4
push 1
push 0x386e
call fcn.10015413
pop ecx
pop ecx
push dword [0x1007d5c0]
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x64]
push eax
call fcn.10008f90
pop ecx
pop ecx
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + 4]
movzx eax, byte [ecx + eax]
push eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x64]
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
movzx eax, byte [ecx + eax]
push eax
call fcn.10008d23
pop ecx
pop ecx
mov ecx, dword [ebp - 0x100]
add ecx, dword [ebp - 0x6c]
mov byte [ecx], al
jmp 0x100158d2
jmp 0x1001571a
mov dword [ebp - 0x10], 0x9beb0647
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x20], 0x974ca779
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x198], eax
push 6
pop eax
cmp eax, 0x1f38
jne 0x10015a6e
xor eax, eax
inc eax
jne 0x10015a6e
and dword [ebp - 0xe8], 0
jmp 0x10015a78
mov dword [ebp - 0xe8], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe8], eax
jge 0x10015a8f
mov dword [ebp - 0x128], 1
jmp 0x10015a96
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], eax
jg 0x10015ab0
mov dword [ebp - 0xb0], 1
jmp 0x10015ab7
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xb0], eax
jg 0x10015ace
mov dword [ebp - 0xd8], 1
jmp 0x10015ad5
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x10]
jg 0x10015aef
mov dword [ebp - 0x104], 1
jmp 0x10015af6
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x12
jmp 0x10015b1e
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xa
jne 0x10015f7c
mov dword [ebp - 0x7c], 0x3f12
mov dword [ebp - 0x1c], 0xff51
mov dword [ebp - 0x2c], 0x39c1d5
mov dword [ebp - 0x74], 0
jmp 0x10015b4d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10015b60
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x48], 0x91450187
jmp 0x10015b46
cmp dword [ebp - 0x10], 0
je 0x10015bf2
push 3
pop eax
test eax, eax
je 0x10015b83
cmp dword [ebp - 0x7c], 0
je 0x10015b83
mov dword [ebp - 0xb8], 1
jmp 0x10015b8a
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 0x5f4
jne 0x10015ba2
mov dword [ebp - 0xf8], 1
jmp 0x10015ba9
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xf8], eax
jl 0x10015bc6
cmp dword [ebp - 0x7c], 0
je 0x10015bc6
mov dword [ebp - 0x84], 1
jmp 0x10015bcd
and dword [ebp - 0x84], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x84]
mov dword [ebp + eax - 0x48], ecx
cmp dword [ebp - 0x84], 0
je 0x10015bf2
mov dword [ebp - 0x114], 1
jmp 0x10015bf9
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x178], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 0
je 0x10015c18
mov eax, 0xa048c84
test eax, eax
jne 0x10015c1c
cmp dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2c], eax
jge 0x10015c49
mov dword [ebp - 0xc0], 1
jmp 0x10015c50
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
neg eax
sub eax, 0x7f583923
cmp eax, dword [ebp - 0x1c]
jge 0x10015c74
mov dword [ebp - 0xe0], 1
jmp 0x10015c7b
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
jmp 0x10015c94
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10015f77
mov dword [ebp - 0xd4], 0x58b9e079
mov dword [ebp - 0x24], 0xc66c3c34
mov dword [ebp - 0x124], 0xfffffffb
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x48], 0
jne 0x10015e7d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x18], 0
je 0x10015e59
cmp dword [ebp - 0x20], 0x42a26b13
je 0x10015cf6
mov dword [ebp - 0x90], 1
jmp 0x10015cfd
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x90], eax
je 0x10015d14
mov dword [ebp - 0x8c], 1
jmp 0x10015d1b
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x8c], eax
jne 0x10015d32
mov dword [ebp - 0x11c], 1
jmp 0x10015d39
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x48]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x10], 7
jle 0x10015d58
mov dword [ebp - 0x9c], 1
jmp 0x10015d5f
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x9c], eax
jge 0x10015d76
mov dword [ebp - 0xa4], 1
jmp 0x10015d7d
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0xa4], eax
je 0x10015d98
mov dword [ebp - 0xac], 1
jmp 0x10015d9f
and dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 4
jne 0x10015db4
mov dword [ebp - 0xb4], 1
jmp 0x10015dbb
and dword [ebp - 0xb4], 0
cmp dword [ebp - 0xb4], 7
jne 0x10015dda
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 0
jne 0x10015dda
and dword [ebp - 0xbc], 0
jmp 0x10015de4
mov dword [ebp - 0xbc], 1
cmp dword [ebp - 0xbc], 0x6324
jle 0x10015dfc
mov dword [ebp - 0xc4], 1
jmp 0x10015e03
and dword [ebp - 0xc4], 0
imul eax, dword [ebp - 0xc4], 0xbfd
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x48], ecx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10015e4d
push 3
pop eax
test eax, eax
je 0x10015e59
mov dword [ebp - 0xdc], 1
jmp 0x10015e60
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
dec eax
imul eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x124]
cmp eax, 0xe8f1e0ef
jb 0x10015f12
mov dword [ebp - 0x164], 0x26224f16
mov dword [ebp - 0x16c], 0xae89e6d5
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x2c], 1
jmp 0x10015eab
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x10015f03
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x48], 0
je 0x10015ebd
jmp 0x10015f03
mov dword [ebp - 0x20], 1
jmp 0x10015ecd
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10015f01
mov dword [ebp - 0x24], 1
jmp 0x10015ee3
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10015eff
mov byte [ebp - 0x30], 0
movzx eax, byte [ebp - 0x30]
test eax, eax
je 0x10015efd
push 1
call fcn.10015445
pop ecx
jmp 0x10015edc
jmp 0x10015ec6
jmp 0x10015ea4
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
jmp 0x10015f67
mov dword [ebp - 0x24], 0
jmp 0x10015f22
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jle 0x10015f53
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0xfffffff8
jle 0x10015f41
mov dword [ebp - 0xec], 1
jmp 0x10015f48
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x10], eax
jmp 0x10015f1b
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10015f67
push 0
call fcn.1001616c
pop ecx
cmp dword [ebp - 0x7c], 0
je 0x10015f72
jmp 0x10015c8d
jmp 0x10015c8d
jmp 0x10015b17
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp + 8]
call fcn.10017953
mov eax, dword [ebp - 0xf4]
or eax, 1
mov dword [ebp - 0xf4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.100179b8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret