Function at 0x1c3a410
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x7c
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test esi, esi
je 0x1c3a444
mov eax, 0x100
push eax
push esi
call fcn.01ca064c
add esp, 8
cmp eax, 0x100
je 0x1c3aba0
cmp byte [0x1d1bce4], 0
je 0x1c3ab93
mov eax, dword [ebp + 8]
movzx ecx, byte [0x1d1bce5]
and ecx, 1
mov edi, 2
sub edi, ecx
test eax, eax
cmovne edi, eax
xorps xmm0, xmm0
movsd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
test esi, esi
je 0x1c3a49d
lea ebx, [ebp - 0x3c]
mov ecx, ebx
push esi
call fcn.01c39e00
mov ecx, ebx
call fcn.01c3ada0
mov ecx, edi
mov edx, dword [ebp + 0x10]
push ebx
call fcn.01c3b040
add esp, 4
xor eax, eax
mov dword [ebp - 0x40], eax
xorps xmm0, xmm0
movsd qword [ebp - 0x48], xmm0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x60]
mov edx, edi
call fcn.01c3b210
cmp byte [ebp - 0x3d], 0
js 0x1c3abb2
mov word [ebp - 0x48], 0
mov byte [ebp - 0x3d], 0
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0x50]
cmp edi, esi
je 0x1c3a503
add edi, 0xfffffff4
jmp 0x1c3a4f3
push dword [edi]
call fcn.01c86cb6
add esp, 4
lea eax, [edi - 0xc]
cmp edi, esi
mov edi, eax
je 0x1c3a503
test edi, edi
je 0x1c3ab50
cmp byte [edi + 0xb], 0
js 0x1c3a4e0
jmp 0x1c3a4ea
mov dword [ebp - 0x50], esi
xorps xmm0, xmm0
movsd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], 0
movzx eax, word [0x1d1bce6]
or ax, word [0x1d1bee6]
jne 0x1c3abe5
lea eax, [ebp - 0x3c]
movsx edx, byte [eax + 0xb]
test edx, edx
cmovs edx, dword [eax + 4]
cmovs eax, dword [eax]
lea edi, [ebp - 0x30]
mov ecx, edi
push edx
push eax
call fcn.01c66260
mov dword [ebp - 0x78], 0
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x1c3a55a
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
test eax, eax
je 0x1c3a638
xor ecx, ecx
xor ebx, ebx
inc ebx
xor esi, esi
cmp word [edi + ecx*2], 0x5c
je 0x1c3a57d
add esi, 0xfffffffe
inc ecx
cmp eax, ecx
jne 0x1c3a569
jmp 0x1c3aa3c
xor eax, eax
cmp edi, esi
je 0x1c3a60a
cmp esi, 2
je 0x1c3a60a
neg esi
xor eax, eax
lea ecx, [ebp - 0x54]
mov ecx, dword [ecx + 4]
lea edi, [ebp - 0x30]
jmp 0x1c3a5aa
lea esi, [edx + 2]
add ecx, esi
je 0x1c3a607
cmp edx, 0xfffffffc
mov ecx, dword [ebp - 0x7c]
je 0x1c3a607
sar esi, 1
mov edx, esi
sub edx, eax
mov dword [ebp - 0x18], edx
cmp ecx, dword [ebp - 0x4c]
jb 0x1c3ab19
lea ecx, [ebp - 0x54]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
call fcn.01c3bb90
mov edx, edi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x50], eax
lea eax, [esi + 1]
mov dword [ebp - 0x78], eax
movsx ebx, byte [ebp - 0x25]
test ebx, ebx
cmovs ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
cmovns ecx, edx
cmp ebx, eax
jbe 0x1c3a60a
je 0x1c3a60e
mov edi, edx
lea edx, [esi + esi]
sub esi, ebx
inc esi
cmp word [ecx + edx + 2], 0x5c
je 0x1c3a59b
add edx, 2
inc esi
jne 0x1c3a5f9
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x1c3a638
mov edi, dword [ebp - 0x50]
cmp edi, dword [ebp - 0x4c]
jae 0x1c3ac05
test edi, edi
je 0x1c3ab3b
lea edx, [ebp - 0x18]
lea esi, [ebp - 0x30]
mov ecx, edi
push edx
push eax
push esi
call fcn.01c3bd00
add edi, 0xc
mov dword [ebp - 0x50], edi
movzx eax, word [0x1d1bce6]
or ax, word [0x1d1bee6]
jne 0x1c3aa50
cmp byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x55]
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x60]
js 0x1c3aa04
test al, al
jns 0x1c3a6bd
lea ecx, [ebp - 0x48]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.01c39f00
mov al, 1
mov dword [ebp - 0x7c], eax
cmp byte [ebp - 0x25], 0
jns 0x1c3a688
push dword [ebp - 0x30]
call fcn.01c86cb6
add esp, 4
cmp byte [ebp - 0x55], 0
jns 0x1c3a699
push dword [ebp - 0x60]
call fcn.01c86cb6
add esp, 4
xor ebx, ebx
cmp byte [ebp - 0x7c], 0
je 0x1c3a961
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
cmp byte [ebp - 0x3d], 0
js 0x1c3a6cf
lea eax, [ebp - 0x48]
jmp 0x1c3a6d2
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x40], eax
movsd xmm0, qword [ebp - 0x60]
movsd qword [ebp - 0x48], xmm0
jmp 0x1c3a672
mov eax, dword [ebp - 0x48]
push eax
push edi
call sub.ntdll.dll_RtlInitUnicodeString
lea eax, [ebp - 0x30]
mov dword [eax], 0x18
mov dword [eax + 4], ebx
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], edi
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
sub esp, 0x1c
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
lea eax, [ebp - 0x64]
mov dword [esp], eax
call sub.ntdll.dll_NtCreateKey
test eax, eax
js 0x1c3a961
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x54]
je 0x1c3abc6
sar eax, 2
imul esi, eax, 0xaaaaaaab
push dword [ebp - 0x64]
call sub.ntdll.dll_NtClose
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
lea eax, [esi - 1]
mov dword [ebp - 0x84], eax
cmp esi, 1
adc esi, 0
mov dword [ebp - 0x88], esi
lea esi, [ebp - 0x48]
xor ebx, ebx
xor edi, edi
jmp 0x1c3a8ee
cmp al, 4
je 0x1c3a9e8
mov ecx, eax
inc cl
and cl, 0x7f
mov byte [ebp - 0x3d], cl
mov ecx, esi
jmp 0x1c3a7bf
mov byte [ebp - 0x6d], bl
lea eax, [ebp - 0x78]
jmp 0x1c3a830
mov edx, dword [eax + ebx + 4]
mov eax, dword [eax + ebx]
mov ecx, esi
push edx
push eax
call fcn.01c66260
movsx eax, byte [ebp - 0x3d]
test eax, eax
mov dword [ebp - 0x80], edi
jns 0x1c3a764
mov edi, dword [ebp - 0x40]
mov eax, 0x7fffffff
and edi, eax
dec edi
mov eax, dword [ebp - 0x44]
cmp eax, edi
je 0x1c3a9ed
mov ecx, dword [ebp - 0x48]
lea edx, [eax + 1]
mov dword [ebp - 0x44], edx
mov dword [ecx + eax*2], 0x5c
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0xffffffff
cmp byte [ebp - 0x3d], 0
mov edi, esi
jns 0x1c3a7df
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x7c], ebx
test edi, edi
je 0x1c3ab42
push edi
call fcn.01ca0524
add esp, 4
cmp eax, 0x7ffffff8
jae 0x1c3aa48
mov ebx, eax
cmp eax, 4
jbe 0x1c3a77a
mov esi, ebx
or esi, 3
inc esi
js 0x1c3aa43
lea eax, [esi + esi]
push eax
call fcn.01c86c86
add esp, 4
mov dword [ebp - 0x78], eax
or esi, 0x80000000
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], ebx
lea esi, [eax + ebx*2]
cmp eax, edi
ja 0x1c3a83f
cmp esi, edi
ja 0x1c3ab5f
test ebx, ebx
je 0x1c3a850
add ebx, ebx
push ebx
push edi
push eax
call fcn.01c8a630
add esp, 0xc
mov word [esi], 0
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
cmp byte [ebp - 0x6d], 0
lea eax, [ebp - 0x78]
jns 0x1c3a869
mov eax, dword [ebp - 0x78]
push eax
lea edi, [ebp - 0x18]
push edi
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x6c]
push eax
call sub.ntdll.dll_NtCreateKey
mov ebx, eax
cmp byte [ebp - 0x6d], 0
jns 0x1c3a8b7
push dword [ebp - 0x78]
call fcn.01c86cb6
add esp, 4
test ebx, ebx
lea esi, [ebp - 0x48]
mov edi, dword [ebp - 0x80]
js 0x1c3aa1f
cmp dword [ebp - 0x84], edi
mov ebx, dword [ebp - 0x7c]
je 0x1c3a91b
cmp dword [ebp - 0x68], 1
je 0x1c3ab66
push dword [ebp - 0x6c]
call sub.ntdll.dll_NtClose
inc edi
add ebx, 0xc
cmp dword [ebp - 0x88], edi
je 0x1c3a923
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, edi
jbe 0x1c3ab49
movsx edx, byte [eax + ebx + 0xb]
test edx, edx
js 0x1c3a785
add eax, ebx
jmp 0x1c3a78c
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x64], eax
jmp 0x1c3a8e2
mov bl, 1
mov esi, dword [ebp - 0x60]
mov edi, dword [ebp - 0x5c]
cmp esi, edi
jne 0x1c3abd6
test bl, bl
je 0x1c3a947
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x64]
test ecx, ecx
je 0x1c3aba7
mov dword [ecx], eax
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x1c3a961
mov ecx, dword [ebp - 0x5c]
cmp ecx, eax
jne 0x1c3a976
mov dword [ebp - 0x5c], eax
push eax
call fcn.01c86cb6
add esp, 4
mov esi, dword [ebp - 0x54]
test esi, esi
je 0x1c3a9b2
mov edi, dword [ebp - 0x50]
mov eax, esi
cmp edi, esi
je 0x1c3a9a6
add edi, 0xfffffff4
jmp 0x1c3a993
add ecx, 0xfffffffc
jne 0x1c3a951
jmp 0x1c3ab50
push dword [edi]
call fcn.01c86cb6
add esp, 4
lea eax, [edi - 0xc]
cmp edi, esi
mov edi, eax
je 0x1c3a9a3
test edi, edi
je 0x1c3ab50
cmp byte [edi + 0xb], 0
js 0x1c3a980
jmp 0x1c3a98a
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], esi
push eax
call fcn.01c86cb6
add esp, 4
cmp byte [ebp - 0x3d], 0
jns 0x1c3a9c3
push dword [ebp - 0x48]
call fcn.01c86cb6
add esp, 4
cmp byte [ebp - 0x31], 0
jns 0x1c3a9d4
push dword [ebp - 0x3c]
call fcn.01c86cb6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 4
mov ecx, esi
xor eax, eax
push eax
push eax
push edi
push edi
push 1
push edi
call fcn.01c5d1f0
mov eax, edi
jmp 0x1c3a7b6
test al, al
cmovs eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x60]
cmovns edx, edi
lea ecx, [ebp - 0x48]
push eax
push edx
call fcn.01c39e30
jmp 0x1c3a672
mov esi, dword [ebp - 0x60]
mov edi, dword [ebp - 0x5c]
xor ebx, ebx
jmp 0x1c3aa33
push dword [esi]
call sub.ntdll.dll_NtDeleteKey
add esi, 4
cmp esi, edi
jne 0x1c3aa29
jmp 0x1c3a925
xor eax, eax
jmp 0x1c3a60a
call fcn.01cb3190
lea ecx, [ebp - 0x78]
call fcn.01cb3170
xor eax, eax
lea ecx, [ebp - 0x30]
push str.REGISTRYUSER_
push 0xe
mov dword [ebp - 0x7c], 0
push eax
call fcn.01cc9600
cmp eax, 1
mov ecx, 0
adc ecx, 2
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x54]
sar eax, 2
imul eax, eax, 0xaaaaaaab
mov dword [ebp - 0x80], ecx
cmp eax, ecx
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x60]
jb 0x1c3a677
lea edi, [ebp - 0x48]
mov ecx, edi
push 0x5c
call fcn.01c66610
xor ebx, ebx
jmp 0x1c3aac3
add eax, dword [ebp - 0x7c]
mov ecx, edi
push edx
push eax
call fcn.01c66260
mov ecx, edi
push 0x5c
call fcn.01c66610
inc ebx
add dword [ebp - 0x7c], 0xc
cmp dword [ebp - 0x80], ebx
je 0x1c3aaf0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, ebx
jbe 0x1c3ab49
mov ecx, dword [ebp - 0x7c]
movsx edx, byte [eax + ecx + 0xb]
test edx, edx
jns 0x1c3aaa4
mov ecx, dword [ebp - 0x7c]
mov edx, dword [eax + ecx + 4]
mov eax, dword [eax + ecx]
jmp 0x1c3aaa7
lea ecx, [ebp - 0x54]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x80]
lea edx, [edx + edx*2]
lea edx, [eax + edx*4]
lea esi, [ebp - 0x18]
push edx
push eax
push esi
call fcn.01c3bad0
mov al, 1
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x60]
jmp 0x1c3a677
test ecx, ecx
je 0x1c3ab3b
mov ebx, ecx
mov dword [ebp - 0x7c], ebx
lea ebx, [ebp - 0x64]
push ebx
push edx
push eax
push edi
call fcn.01c664f0
mov edx, edi
mov eax, dword [ebp - 0x7c]
add eax, 0xc
jmp 0x1c3a5cf
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
jmp 0x1c3ab55
push str....._third_partylibc_srcinclude_string:973:_assertion___s___nullptr_failed:_basic_string_const_char__detected_nullptr_n
jmp 0x1c3ab55
push str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
jmp 0x1c3ab55
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
push 0x1ce99e6
call fcn.01cb3fe0
push str....._third_partylibc_srcinclude__stringchar_traits.h:222:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
jmp 0x1c3ab55
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x58]
jae 0x1c3ab7c
test eax, eax
je 0x1c3ab3b
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
add eax, 4
jmp 0x1c3ab88
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x6c]
push eax
call fcn.01c33960
mov dword [ebp - 0x5c], eax
mov ebx, dword [ebp - 0x7c]
jmp 0x1c3a8e2
call fcn.01c3ac20
test al, al
jne 0x1c3a451
xor ebx, ebx
jmp 0x1c3a9d4
push eax
call sub.ntdll.dll_NtClose
jmp 0x1c3a947
mov eax, dword [ebp - 0x48]
mov word [eax], 0
mov dword [ebp - 0x44], 0
jmp 0x1c3a4d1
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
jmp 0x1c3a923
push dword [esi]
call sub.ntdll.dll_NtClose
add esi, 4
jmp 0x1c3a92b
movsx eax, byte [ebp - 0x55]
test eax, eax
jns 0x1c3abf0
mov eax, dword [ebp - 0x5c]
dec eax
lea ecx, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 0x60]
push eax
call fcn.01cc95b0
jmp 0x1c3a529
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x54]
push eax
push edx
call fcn.01cca590
mov edi, eax
jmp 0x1c3a635