Function at 0x1075d50
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11365d6
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x428], ebx
mov edx, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x438], edx
call fcn.01072210
mov esi, eax
cmp esi, ebx
jl 0x10763ea
cmp word [edi], 0x7d
je 0x10763e8
mov edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001928
push edi
mov dword [ebp - 0x424], 1
call esi
mov ebx, eax
neg ebx
push 0x100194c
sbb ebx, ebx
push edi
add ebx, 1
call esi
test eax, eax
je 0x1075df5
test ebx, ebx
je 0x1075ee6
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1075ee6
push 0x5c
push edi
mov dword [ebp - 0x430], esi
call fcn.01072160
test eax, eax
jne 0x1076374
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072380
test eax, eax
je 0x1075e5a
mov eax, dword [ebp - 0x434]
push edi
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x430], eax
call fcn.01073790
mov dword [ebp - 0x430], esi
cmp ebx, esi
je 0x1075ee6
mov ebx, dword [ebp - 0x42c]
push edi
mov ecx, ebx
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x1076391
push edi
mov ecx, ebx
call fcn.01072410
mov esi, eax
test esi, esi
jl 0x1076391
cmp word [edi], 0x7b
jne 0x1075ed7
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1075ed7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x428]
push 0
push eax
push ecx
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01075d50
mov esi, eax
test esi, esi
jl 0x10763d7
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
cmp word [edi], 0x7d
jne 0x1075dc0
jmp 0x10763d7
push 0x1001938
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1075f12
mov ecx, dword [ebp - 0x42c]
push edi
mov dword [ebp - 0x424], eax
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
mov ebx, dword [ebp - 0x434]
push 0x1001964
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1076025
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp - 0x42c]
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
cmp word [edi], 0x3d
jne 0x107637f
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x1075fb1
mov edx, dword [ebp - 0x434]
push edi
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x424]
push ecx
mov ecx, dword [ebp - 0x42c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x424], edx
call fcn.010759c0
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x424], ebx
jl 0x1076399
mov byte [ebp - 4], bl
jmp 0x1075e8c
cmp dword [ebp + 0x14], ebx
jne 0x1076010
cmp dword [ebp - 0x424], ebx
je 0x1076010
mov edx, dword [ebp - 0x434]
push 0x20006
push ebx
push edx
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], ebx
call fcn.01071d80
cmp eax, ebx
jne 0x10763c4
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x1076005
cmp eax, 2
jne 0x10763c4
cmp esi, ebx
je 0x1076010
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072410
mov esi, eax
cmp esi, ebx
jmp 0x1075ed1
push 0x5c
push edi
call fcn.01072160
test eax, eax
jne 0x107637f
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x107616f
lea ecx, [ebp - 0x424]
push ecx
push 0x2001f
push esi
push edi
push ebx
mov dword [ebp - 0x424], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1076088
mov ecx, dword [ebp - 0x428]
xor eax, eax
cmp ecx, esi
je 0x1076072
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov esi, dword [ebp - 0x424]
mov dword [ebp - 0x428], esi
je 0x107612b
jmp 0x107608e
mov esi, dword [ebp - 0x428]
lea edx, [ebp - 0x424]
push edx
push 0x20019
push 0
push edi
push ebx
mov dword [ebp - 0x424], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10760cd
test esi, esi
je 0x10760bd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov esi, dword [ebp - 0x424]
mov dword [ebp - 0x428], esi
je 0x107612b
mov edx, dword [ebp - 0x434]
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x424]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push edx
mov dword [ebp - 0x424], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x10763b1
test esi, esi
je 0x1076115
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [ebp - 0x424]
mov ebx, eax
mov dword [ebp - 0x428], ecx
jne 0x10763b1
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
cmp word [edi], 0x3d
jne 0x1075e8c
mov ecx, dword [ebp - 0x42c]
push edi
push 0
lea edx, [ebp - 0x428]
push edx
call fcn.010759c0
mov esi, eax
test esi, esi
jl 0x10763d7
jmp 0x1075e8c
cmp dword [ebp + 0x14], esi
jne 0x1076290
lea eax, [ebp - 0x430]
push eax
push 0x20019
push esi
push edi
push ebx
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10761b6
mov ecx, dword [ebp - 0x428]
xor eax, eax
cmp ecx, esi
je 0x10761aa
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x430]
mov dword [ebp - 0x428], ecx
cmp eax, esi
mov dword [ebp - 0x430], eax
je 0x10761c7
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.01083df1
add esp, 0x10
push eax
call fcn.01071730
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072410
mov esi, eax
test esi, esi
jl 0x10763d7
cmp word [edi], 0x7b
jne 0x107625f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x107625f
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x42c]
push ebx
push 0
push eax
push edi
call fcn.01075d50
mov esi, eax
test esi, esi
jge 0x1076249
test ebx, ebx
je 0x10763d7
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01072210
mov esi, eax
test esi, esi
jl 0x10763d7
mov eax, dword [ebp - 0x430]
cmp eax, 2
mov ecx, dword [ebp - 0x438]
mov dword [ebp + 0x14], ecx
je 0x1075ed7
test eax, eax
je 0x107629f
test ecx, ecx
jne 0x1075ed7
push eax
call fcn.01071a90
mov esi, eax
jmp 0x10763d7
mov dword [ebp - 0x430], 2
jmp 0x10761c0
test ecx, ecx
mov ebx, dword [ebp - 0x428]
je 0x10762f7
mov ecx, dword [ebp - 0x42c]
push ebx
call fcn.010723c0
test eax, eax
je 0x10762f7
mov ecx, dword [ebp - 0x42c]
lea edx, [ebp - 0x218]
push edx
call fcn.01072380
test eax, eax
je 0x1075ed7
cmp dword [ebp - 0x424], 0
je 0x1075ed7
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.01073790
jmp 0x1075ed7
mov ecx, dword [ebp - 0x42c]
push ebx
call fcn.010723c0
test ebx, ebx
mov dword [ebp - 0x430], eax
je 0x1076328
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x428], 0
jne 0x10763b1
cmp dword [ebp - 0x424], 0
je 0x1075ed7
cmp dword [ebp - 0x430], 0
jne 0x1075ed7
mov edx, dword [ebp - 0x434]
lea ecx, [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov dword [ebp - 0x424], 0
jne 0x10763c4
lea ecx, [ebp - 0x424]
call fcn.01073770
jmp 0x1075ed7
lea ecx, [ebp - 0x430]
call fcn.01073770
lea ecx, [ebp - 0x428]
call fcn.01073770
mov eax, 0x80020009
jmp 0x10763ea
lea ecx, [ebp - 0x430]
jmp 0x10763d2
lea ecx, [ebp - 0x424]
call fcn.01073770
lea ecx, [ebp - 0x428]
call fcn.01073770
jmp 0x10763e8
lea ecx, [ebp - 0x428]
call fcn.01073770
push ebx
call fcn.01071a90
jmp 0x10763ea
push eax
call fcn.01071a90
mov esi, eax
lea ecx, [ebp - 0x424]
call fcn.01073770
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x10763e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0x10