Function at 0xaa23b6
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xa
lea eax, [ebp - 0x18]
mov esi, reloc.SHCORE.dll_Ordinal_1
push eax
push 2
pop edi
push edi
push 0x9f45c4
mov edx, 0x9f4570
mov ecx, esi
xor ebx, ebx
call fcn.00aac1c5
test eax, eax
js 0xaa2400
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrToIntW]
mov ebx, eax
push 0
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0xc
push eax
push 0xc
push 0x42
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
test eax, eax
je 0xaa249d
push 0x104
lea eax, [ebp - 0x220]
mov edx, 0x9f44e0
push eax
push edi
push 0x9f4544
mov ecx, esi
call fcn.00aac1c5
test eax, eax
jns 0xb42454
test byte [ebp - 0x438], 1
jne 0xb42467
xor eax, eax
mov word [ebp - 0x220], ax
test ax, ax
jne 0xb42547
and ebx, 1
lea edx, [ebp - 0x429]
mov dword [ebp - 0x430], ebx
lea ecx, [ebp - 0x43d]
mov bl, byte [ebp - 0x438]
and bl, 1
call fcn.00aa24ac
test eax, eax
jns 0xb42636
cmp byte [ebp - 0x430], bl
jne 0xb42645
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
cmp word [ebp - 0x220], 0
jne 0xb4254c
jmp 0xaa2447
push 0x104
lea eax, [ebp - 0x220]
mov edx, 0x9f4814
push eax
push edi
push 0x9f0f78
mov ecx, esi
call fcn.00aac1c5
test eax, eax
js 0xaa2454
cmp word [ebp - 0x220], 0
je 0xaa2454
push 0xa15514
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xaa2454
push 0xa1555c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xaa2454
mov esi, 0xa15538
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xaa2454
push 0xa15590
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xaa2454
lea ecx, [ebp - 0x220]
mov edx, 0x104
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0xb42530
movzx eax, word [esi + ecx]
test ax, ax
je 0xb42530
mov word [ecx], ax
add ecx, edi
sub edx, 1
jne 0xb42513
test edx, edx
jne 0xb42536
sub ecx, edi
xor eax, eax
mov word [ecx], ax
mov ax, word [ebp - 0x220]
jmp 0xaa245d
mov esi, reloc.SHCORE.dll_Ordinal_1
test byte [ebp - 0x438], 1
je 0xb425ab
cmp dword [ebp - 0x434], 0
je 0xb425ab
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpIW]
test eax, eax
je 0xb425d1
push 0
push 0x104
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_string_l2_1_1.dll_SHLoadIndirectString]
test eax, eax
js 0xb425ab
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpIW]
test eax, eax
je 0xb425d1
or dword [ebp - 0x438], 1
lea eax, [ebp - 0x220]
push 3
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x43c]
push eax
push 0xc
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
push 0x9f4544
push 0x9f44e0
push esi
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
lea eax, [ebp - 0x430]
push eax
push 0xa156f0
push 3
push 0
push 0xa23d0c
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0xaa249d
mov eax, dword [ebp - 0x430]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x60]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x430]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xaa249d
cmp bl, byte [ebp - 0x429]
je 0xb42645
xor dword [ebp - 0x438], 1
push 3
lea eax, [ebp - 0x43c]
push eax
push 0xc
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
jmp 0xaa249d