Function at 0x1001c723
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068099
mov eax, dword fs:[0]
push eax
mov eax, 0x2258
call fcn.1002f580
mov eax, dword [0x1008b548]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x221c], eax
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov dword [ebp - 4], eax
push edi
mov ecx, ebx
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
push 0x7d
pop eax
cmp word [edi], ax
je 0x1001cc9d
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp - 0x2224], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x1006c54c
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2220], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001c7d0
test esi, esi
je 0x1001c890
push edi
mov ecx, ebx
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1001c892
push 0x5c
push edi
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.1001cf14
pop ecx
pop ecx
test eax, eax
jne 0x1001cc8d
push edi
mov ecx, ebx
call fcn.1001b2be
test eax, eax
je 0x1001c847
mov eax, dword [ebp - 0x221c]
lea ecx, [ebp - 0x223c]
push edi
mov dword [ebp - 0x223c], eax
call fcn.1001c244
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
cmp dword [ebp - 0x2220], esi
je 0x1001c883
push edi
mov ecx, ebx
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc85
push edi
mov ecx, ebx
call fcn.1001ce8d
mov esi, eax
lea ecx, [ebp - 0x223c]
call fcn.1001b390
test esi, esi
js 0x1001cc9d
jmp 0x1001cc41
lea ecx, [ebp - 0x223c]
call fcn.1001b390
jmp 0x1001c892
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001c8ba
push edi
mov ecx, ebx
mov dword [ebp - 0x2224], esi
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
push 0x1006c544
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001c9d5
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
push edi
mov ecx, ebx
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
push 0x3d
pop eax
cmp word [edi], ax
jne 0x1001cc98
cmp dword [ebp + 0x10], 0
je 0x1001c95b
mov eax, dword [ebp - 0x221c]
mov ecx, ebx
and dword [ebp - 0x2248], 0
and dword [ebp - 0x2244], 0
mov dword [ebp - 0x224c], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x224c]
push eax
call fcn.1001a483
mov esi, eax
lea ecx, [ebp - 0x224c]
xor eax, eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
jmp 0x1001c871
cmp dword [ebp + 0x14], 0
jne 0x1001c9c8
cmp dword [ebp - 0x2224], 0
je 0x1001c9c8
xor eax, eax
lea ecx, [ebp - 0x2258]
push 0x20006
push eax
push dword [ebp - 0x221c]
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
call fcn.1001bf8d
test eax, eax
jne 0x1001ccc6
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2258]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1001c9bd
cmp eax, 2
jne 0x1001ccc6
lea ecx, [ebp - 0x2258]
call fcn.1001b390
push edi
mov ecx, ebx
call fcn.1001ce8d
jmp 0x1001c782
push 0x5c
push edi
call fcn.1001cf14
pop ecx
pop ecx
test eax, eax
jne 0x1001cc98
cmp dword [ebp + 0x10], eax
je 0x1001ca78
mov esi, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2230]
push 0x2001f
push edi
push esi
call fcn.1001bf8d
test eax, eax
je 0x1001ca42
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2230]
call fcn.1001bf8d
test eax, eax
je 0x1001ca42
xor eax, eax
lea ecx, [ebp - 0x2230]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.1001b3aa
test eax, eax
jne 0x1001cb5e
push edi
mov ecx, ebx
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
push 0x3d
pop eax
cmp word [edi], ax
jne 0x1001cc41
push edi
push 0
lea eax, [ebp - 0x2230]
mov ecx, ebx
push eax
call fcn.1001a483
mov esi, eax
jmp 0x1001c876
cmp dword [ebp + 0x14], 0
jne 0x1001ca97
push 0x20019
push edi
push dword [ebp - 0x221c]
lea ecx, [ebp - 0x2230]
call fcn.1001bf8d
jmp 0x1001ca9a
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [ebp - 0x2220], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp - 0x218]
push edi
push 0x104
push eax
mov dword [ebp - 0x2240], ecx
call fcn.1004127f
push eax
call fcn.1000651c
add esp, 0x14
mov ecx, ebx
push edi
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
push edi
mov ecx, ebx
call fcn.1001ce8d
mov esi, eax
test esi, esi
js 0x1001cc9d
push 0x7b
pop eax
cmp word [edi], ax
jne 0x1001cb41
push edi
call fcn.1003d0a0
pop ecx
cmp eax, 1
jne 0x1001cb41
push dword [ebp - 0x2240]
mov ecx, ebx
push 0
push dword [ebp - 0x2230]
push edi
call fcn.1001c723
mov esi, eax
test esi, esi
jns 0x1001cb2f
cmp dword [ebp - 0x2240], 0
je 0x1001cc9d
push edi
mov ecx, ebx
call fcn.1001be55
mov esi, eax
test esi, esi
js 0x1001cc9d
mov eax, dword [ebp - 0x2220]
cmp eax, 2
je 0x1001c78c
test eax, eax
je 0x1001cb6c
cmp dword [ebp + 0x14], 0
jne 0x1001c78c
push eax
call fcn.1001ab84
pop ecx
mov esi, eax
jmp 0x1001cc9d
cmp dword [ebp + 0x14], 0
je 0x1001cbbd
push dword [ebp - 0x2230]
mov ecx, ebx
call fcn.1001b9dd
test eax, eax
je 0x1001cbbd
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.1001b2be
test eax, eax
je 0x1001c78c
cmp dword [ebp - 0x2224], 0
je 0x1001c78c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.1001c244
jmp 0x1001c78c
push dword [ebp - 0x2230]
mov ecx, ebx
call fcn.1001b9dd
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2220], eax
call fcn.1001b390
test eax, eax
jne 0x1001cb5e
cmp dword [ebp - 0x2224], eax
je 0x1001c78c
cmp dword [ebp - 0x2220], eax
jne 0x1001c78c
mov eax, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2264]
and dword [ebp - 0x2260], 0
and dword [ebp - 0x225c], 0
mov dword [ebp - 0x2264], eax
lea eax, [ebp - 0x218]
push eax
call fcn.1001b4a2
and dword [ebp - 0x2264], 0
test eax, eax
jne 0x1001ccdc
lea ecx, [ebp - 0x2264]
call fcn.1001b390
cmp dword [ebp + 0x10], 0
je 0x1001c78c
push 0x7b
pop eax
cmp word [edi], ax
jne 0x1001c78c
push edi
call fcn.1003d0a0
pop ecx
cmp eax, 1
jne 0x1001c78c
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2230]
push edi
call fcn.1001c723
mov esi, eax
test esi, esi
js 0x1001cc9d
jmp 0x1001c77a
lea ecx, [ebp - 0x223c]
jmp 0x1001ccd5
lea ecx, [ebp - 0x223c]
call fcn.1001b390
mov esi, 0x80020009
lea ecx, [ebp - 0x2230]
call fcn.1001b390
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f237
leave
ret 0x10
push eax
call fcn.1001ab84
pop ecx
lea ecx, [ebp - 0x2258]
mov esi, eax
call fcn.1001b390
jmp 0x1001cc9d
push eax
call fcn.1001ab84
pop ecx
lea ecx, [ebp - 0x2264]
jmp 0x1001ccd3