Function at 0x1000371f
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005478b
mov eax, dword fs:[0]
push eax
mov eax, 0x2258
call fcn.10033850
mov eax, dword [0x10076098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], ecx
xor ecx, ecx
mov dword [ebp - 0x223c], ecx
mov dword [ebp - 0x2238], ecx
mov dword [ebp - 0x2234], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
push 0x7d
pop eax
cmp word [edi], ax
je 0x10003d18
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp - 0x2224], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x10068330
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100037cc
test ebx, ebx
je 0x100038ac
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
cmp dword [ebp + 0x10], 0
je 0x100038ac
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
inc eax
mov byte [ebp - 4], al
mov ecx, edi
push 0x5c
pop edx
call fcn.10002b9d
test eax, eax
jne 0x10003d04
push edi
call fcn.10003238
test eax, eax
je 0x1000385b
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
and dword [ebp - 0x222c], 0
and dword [ebp - 0x2228], 0
push edi
mov dword [ebp - 0x2230], eax
call fcn.100024ef
and dword [ebp - 0x2230], 0
and dword [ebp - 0x222c], 0
and dword [ebp - 0x2228], 0
test ebx, ebx
je 0x1000389d
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003cf8
push edi
mov ecx, ebx
call fcn.1000329c
mov esi, eax
test esi, esi
js 0x10003cf8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2230]
call fcn.100023e1
jmp 0x10003cb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2230]
call fcn.100023e1
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x221c]
test eax, eax
jne 0x100038da
and dword [ebp - 0x2224], eax
mov ecx, ebx
push edi
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
push 0x10068328
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10003a1e
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
push edi
mov ecx, ebx
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10003d13
cmp dword [ebp + 0x10], 0
je 0x1000399c
xor ecx, ecx
mov dword [ebp - 0x2248], ecx
mov dword [ebp - 0x2244], ecx
mov dword [ebp - 0x2240], ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2248]
mov dword [ebp - 0x2244], ecx
mov dword [ebp - 0x2240], ecx
mov ecx, ebx
push eax
call fcn.10002d5d
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], eax
test esi, esi
js 0x10003d45
mov byte [ebp - 4], al
lea ecx, [ebp - 0x2248]
jmp 0x10003893
cmp dword [ebp + 0x14], 0
jne 0x10003a11
cmp dword [ebp - 0x2224], 0
je 0x10003a11
xor eax, eax
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2260], eax
mov dword [ebp - 0x225c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2264]
push 0x20006
push eax
push dword [ebp - 0x2220]
call fcn.10002465
test eax, eax
jne 0x10003d50
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2264]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10003a02
cmp eax, 2
jne 0x10003d50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2264]
call fcn.100023e1
push edi
mov ecx, ebx
call fcn.1000329c
jmp 0x10003784
push 0x5c
pop edx
mov ecx, edi
call fcn.10002b9d
test eax, eax
jne 0x10003d13
cmp dword [ebp + 0x10], eax
je 0x10003ac9
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
push 0x2001f
push edi
push esi
call fcn.10002465
test eax, eax
je 0x10003a8b
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x223c]
call fcn.10002465
test eax, eax
je 0x10003a8b
xor eax, eax
lea ecx, [ebp - 0x223c]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.100023fb
test eax, eax
jne 0x10003d7e
push edi
mov ecx, ebx
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10003cb0
push edi
push 0
lea eax, [ebp - 0x223c]
mov ecx, ebx
push eax
call fcn.10002d5d
mov esi, eax
test esi, esi
js 0x10003d18
jmp 0x10003cb0
cmp dword [ebp + 0x14], 0
jne 0x10003aea
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
call fcn.10002465
mov ebx, eax
jmp 0x10003aed
push 2
pop ebx
mov eax, dword [ebp + 0x14]
test ebx, ebx
push 1
pop ecx
push 0xffffffffffffffff
cmovne eax, ecx
push edi
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1003d73e
push eax
call fcn.10001f59
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.1000329c
mov esi, eax
test esi, esi
js 0x10003d18
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10003ba0
push edi
call fcn.1003d469
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x10003ba0
push dword [ebp - 0x2258]
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp - 0x223c]
push edi
call fcn.1000371f
mov esi, eax
test esi, esi
jns 0x10003b8a
cmp dword [ebp - 0x2258], 0
je 0x10003d18
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10002c02
mov esi, eax
test esi, esi
js 0x10003d18
cmp ebx, 2
je 0x1000378e
test ebx, ebx
je 0x10003bc5
cmp dword [ebp + 0x14], 0
jne 0x1000378e
mov ecx, ebx
call fcn.10001fab
mov esi, eax
jmp 0x10003d18
cmp dword [ebp + 0x14], 0
je 0x10003c12
push dword [ebp - 0x223c]
call fcn.10003267
test eax, eax
je 0x10003c12
lea eax, [ebp - 0x218]
push eax
call fcn.10003238
test eax, eax
je 0x1000378e
cmp dword [ebp - 0x2224], 0
je 0x1000378e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x223c]
call fcn.100024ef
jmp 0x1000378e
push dword [ebp - 0x223c]
call fcn.10003267
lea ecx, [ebp - 0x223c]
mov ebx, eax
call fcn.100023e1
test eax, eax
jne 0x10003d7e
cmp dword [ebp - 0x2224], eax
je 0x1000378e
test ebx, ebx
jne 0x1000378e
mov dword [ebp - 0x2254], ebx
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], ebx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x218]
mov eax, dword [ebp - 0x2220]
push ecx
push eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x2254], ebx
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], ebx
test eax, eax
jne 0x10003d6a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2254]
call fcn.100023e1
mov ebx, dword [ebp - 0x221c]
cmp dword [ebp + 0x10], 0
je 0x1000378e
push 0x7b
pop eax
cmp word [edi], ax
jne 0x1000378e
push edi
call fcn.1003d469
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x1000378e
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x223c]
push edi
call fcn.1000371f
mov esi, eax
test esi, esi
js 0x10003d18
mov ecx, ebx
jmp 0x1000377e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2230]
jmp 0x10003d63
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2230]
call fcn.100023e1
mov esi, 0x80020009
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x223c]
call fcn.100023e1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100325c7
leave
ret 0x10
mov byte [ebp - 4], al
lea ecx, [ebp - 0x2248]
jmp 0x10003d63
mov ecx, eax
call fcn.10001fab
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2264]
call fcn.100023e1
jmp 0x10003d18
mov ecx, eax
call fcn.10001fab
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2254]
jmp 0x10003d63
mov ecx, eax
jmp 0x10003bb9