Function at 0x131797f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x131797f8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.131455c0
xor eax, eax
push ebp
push 0x13179ac1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x1317b734]
call fcn.131442e4
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.131451d8
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x13179adc
call fcn.131456c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.13145638
mov edx, dword [ebp - 0xc]
mov eax, 0x13179adc
call fcn.131456c0
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.13145678
mov edx, dword [ebp - 0xc]
mov eax, edx
test eax, eax
je 0x13179881
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
cmp byte [ecx + eax - 1], 0x5c
jne 0x131799ff
mov edi, edx
test edi, edi
je 0x1317989a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.13145638
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x131798ba
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x13179adc
mov eax, ebx
call fcn.1317ba1c
mov edx, eax
inc edx
mov ecx, edi
mov eax, dword [ebp - 0xc]
call fcn.13145638
mov ecx, dword [ebp - 0xc]
mov edx, 0x13179adc
mov eax, ebx
call fcn.1317ba1c
mov edx, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x131798f7
sub eax, 4
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
xchg ecx, eax
call fcn.13145678
lea eax, [ebp - 0x1c]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0xc]
call fcn.131455d0
push eax
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.131796b8
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.131794f4
cmp dword [ebp - 0x20], 0
jne 0x13179957
mov eax, dword [ebp - 8]
call fcn.131455d0
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 0x15]
jmp 0x13179a89
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.131794f4
jmp 0x131799d1
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x14]
mov eax, 0x13179ae8
call fcn.131456c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.13145638
push dword [ebp - 0x28]
push 0x13179adc
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x24]
mov eax, esi
call fcn.131797f0
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x131799e2
mov edx, dword [ebp - 0x14]
mov eax, 0x13179ae8
call fcn.131456c0
mov ecx, eax
lea eax, [ebp - 0x14]
mov edx, 1
call fcn.13145678
mov edx, dword [ebp - 0x14]
mov eax, 0x13179ae8
call fcn.131456c0
test eax, eax
jg 0x13179969
mov eax, dword [ebp - 8]
call fcn.131455d0
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 0x15]
jmp 0x13179a89
mov edi, edx
test edi, edi
je 0x13179a0a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x13179adc
mov eax, ebx
call fcn.1317ba1c
mov edx, eax
inc edx
mov ecx, edi
mov eax, dword [ebp - 0xc]
call fcn.13145638
mov ecx, dword [ebp - 0xc]
mov edx, 0x13179adc
mov eax, ebx
call fcn.1317ba1c
mov edx, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x13179a47
sub eax, 4
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
xchg ecx, eax
call fcn.13145678
lea eax, [ebp - 0x1c]
push eax
push 2
push 0
mov eax, dword [ebp - 0xc]
call fcn.131455d0
push eax
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.131796b8
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
mov eax, dword [ebp - 8]
call fcn.131455d0
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 0x15]
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
call fcn.13144314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13179ac8
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.13145164
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.13145164
ret