Function at 0x10004c40
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1158
call fcn.1000cfc0
mov eax, dword [0x10022cac]
xor eax, esp
mov dword [esp + 0x1154], eax
mov eax, dword [esp + 0x1160]
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, dword [esp + 0x1174]
push edi
mov edi, dword [esp + 0x116c]
xor ebp, ebp
mov dword [esp + 0x5c], ecx
push edi
mov ecx, ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.10002b70
mov esi, eax
cmp esi, ebp
jl 0x10005221
cmp byte [edi], 0x7d
je 0x1000521f
jmp 0x10004cb4
mov ebx, dword [esp + 0x58]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [esp + 0x34], 1
call esi
neg eax
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x10004ce3
test ebp, ebp
je 0x10004e0b
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
xor eax, eax
cmp dword [esp + 0x1174], eax
je 0x10004e0b
mov cl, byte [edi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, edi
test cl, cl
je 0x10004d38
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov edi, edi
cmp cl, 0x5c
je 0x10004d30
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x10004d20
jmp 0x10004d38
test eax, eax
jne 0x100051ee
mov esi, 0x1001b404
lea ecx, [ecx]
mov edx, dword [esi]
push edx
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
je 0x10004d83
add esi, 4
cmp esi, 0x1001b434
jl 0x10004d40
mov eax, dword [esp + 0x10]
xor esi, esi
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.10003140
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
jmp 0x10004d85
xor esi, esi
cmp ebp, esi
je 0x10004e07
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005207
push edi
mov ecx, ebx
call fcn.10002d30
mov esi, eax
test esi, esi
js 0x10005207
mov dword [esp + 0x24], 0
cmp byte [edi], 0x7b
jne 0x10004df9
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 1
jne 0x10004df9
mov ecx, dword [esp + 0x1174]
mov edx, dword [esp + 0x14]
push 0
push ecx
push edx
push edi
mov ecx, ebx
call fcn.10004c40
mov esi, eax
test esi, esi
js 0x10005210
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
cmp byte [edi], 0x7d
jne 0x10004cb0
jmp 0x10005210
mov dword [esp + 0x24], esi
push str.NoRemove
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x10004e31
push edi
mov ecx, ebx
mov dword [esp + 0x30], eax
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
push 0x1001b3d0
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x10004f49
lea ecx, [esp + 0x164]
push ecx
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
cmp byte [edi], 0x3d
jne 0x100051f7
xor ebp, ebp
cmp dword [esp + 0x1174], ebp
je 0x10004ec8
mov edx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
call fcn.100048f0
mov esi, eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
cmp esi, ebp
jl 0x1000523c
mov dword [esp + 0x38], ebp
jmp 0x10004db5
cmp dword [esp + 0x1178], ebp
jne 0x10004f32
cmp dword [esp + 0x2c], ebp
je 0x10004f32
mov edx, dword [esp + 0x10]
push 0x20006
push ebp
push edx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
call fcn.100027e0
cmp eax, ebp
jne 0x10005250
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x164]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebp
je 0x10004f1f
cmp eax, 2
jne 0x10005250
cmp esi, ebp
je 0x10004f2e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
push edi
mov ecx, ebx
call fcn.10002d30
mov esi, eax
cmp esi, ebp
jl 0x10005210
jmp 0x10004df9
mov cl, byte [edi]
mov eax, edi
test cl, cl
je 0x10004f6f
mov esi, dword [sym.imp.USER32.dll_CharNextA]
cmp cl, 0x5c
je 0x10004f67
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x10004f57
jmp 0x10004f6f
test eax, eax
jne 0x100051f7
cmp dword [esp + 0x1174], 0
je 0x1000500c
mov ecx, dword [esp + 0x10]
push 0x2001f
push edi
push ecx
lea ecx, [esp + 0x20]
call fcn.100027e0
test eax, eax
je 0x10004fd3
mov edx, dword [esp + 0x10]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x20]
call fcn.100027e0
test eax, eax
je 0x10004fd3
mov eax, dword [esp + 0x10]
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push eax
lea ecx, [esp + 0x30]
call fcn.10002730
mov esi, eax
test esi, esi
jne 0x10005261
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
cmp byte [edi], 0x3d
jne 0x10004db5
push edi
push 0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebx
call fcn.100048f0
mov esi, eax
test esi, esi
js 0x10005210
jmp 0x10004db5
cmp dword [esp + 0x1178], 0
jne 0x1000506b
mov edx, dword [esp + 0x10]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x20]
call fcn.100027e0
mov ebp, eax
mov dword [esp + 0x30], ebp
test ebp, ebp
je 0x1000503f
mov dword [esp + 0x1178], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x68]
push 0x104
push eax
call fcn.1001329e
add esp, 0x10
cmp eax, 0x50
ja case.0x10005064.103
movzx ecx, byte [eax + 0x100052cc]
jmp dword [ecx*4 + 0x100052bc]
mov dword [esp + 0x30], 2
mov ebp, dword [esp + 0x30]
jmp 0x10005034
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
push edi
mov ecx, ebx
call fcn.10002d30
mov esi, eax
test esi, esi
js 0x10005210
cmp byte [edi], 0x7b
jne 0x100050e9
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 1
jne 0x100050e9
mov ebp, dword [esp + 0x1178]
mov edx, dword [esp + 0x14]
push ebp
push 0
push edx
push edi
mov ecx, ebx
call fcn.10004c40
mov esi, eax
test esi, esi
jns 0x100050d3
test ebp, ebp
je 0x10005210
push edi
mov ecx, ebx
call fcn.10002b70
mov esi, eax
test esi, esi
js 0x10005210
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1178], eax
cmp ebp, 2
je 0x10004df9
test ebp, ebp
je 0x10005119
test eax, eax
jne 0x10004df9
push ebp
call fcn.100024a0
add esp, 4
mov esi, eax
jmp 0x10005210
test eax, eax
je 0x1000515f
mov eax, dword [esp + 0x14]
push eax
mov ecx, ebx
call fcn.10002ce0
test eax, eax
je 0x1000515f
lea ecx, [esp + 0x60]
push ecx
mov ecx, ebx
call fcn.10002ca0
test eax, eax
je 0x10004df9
cmp dword [esp + 0x2c], 0
je 0x10004df9
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x18]
call fcn.10003140
jmp 0x10004df9
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x58]
push eax
call fcn.10002ce0
xor ebp, ebp
mov ebx, eax
cmp dword [esp + 0x14], ebp
je 0x1000518c
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
test ebp, ebp
jne 0x10005289
cmp dword [esp + 0x2c], ebp
je 0x10004df9
test ebx, ebx
jne 0x10004df9
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.10002680
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
cmp eax, ebx
jne 0x1000529d
lea ecx, [esp + 0x4c]
call fcn.10003120
jmp 0x10004df9
lea ecx, [esp + 0x20]
call fcn.10003120
lea ecx, [esp + 0x14]
call fcn.10003120
mov eax, 0x80020009
jmp 0x10005221
lea ecx, [esp + 0x20]
call fcn.10003120
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000521f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x1164]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000cc2a
add esp, 0x1158
ret 0x10
lea ecx, [esp + 0x34]
call fcn.10003120
lea ecx, [esp + 0x14]
call fcn.10003120
jmp 0x1000521f
push eax
call fcn.100024a0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x40]
jmp 0x1000520b
lea ecx, [esp + 0x14]
call fcn.10003120
push esi
call fcn.100024a0
add esp, 4
jmp 0x10005221
push 0x8007000e
call fcn.10001000
push 0x80070057
call fcn.10001000
lea ecx, [esp + 0x14]
call fcn.10003120
push ebp
call fcn.100024a0
add esp, 4
jmp 0x10005221
push eax
call fcn.100024a0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x4c]
jmp 0x1000520b
push 0x80004005
call fcn.10001000
nop
jns 0x1000530e
add byte [eax], dl
jne 0x10005314
add byte [eax], dl
jg 0x10005318
add byte [eax], dl
mov cl, 0x52
add byte [eax], dl
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3