Function at 0x1055e25
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0102150d
mov edi, eax
mov ax, word [0x10deb04]
test ax, ax
jbe 0x1055e44
xor edx, edx
jmp 0x1055e47
movzx edx, ax
movzx ecx, word [0x10de844]
cmp edx, ecx
jle 0x1055e60
test ax, ax
jbe 0x1055e5b
xor eax, eax
jmp 0x1055e62
movzx eax, ax
jmp 0x1055e62
mov eax, ecx
mov ecx, dword [edi + 0xb90]
push 0
mov word [ecx + 4], ax
mov eax, dword [edi + 0xb90]
and word [eax + 0x6a], 0
push 0x100b9f4
mov esi, 0x100b9d8
push esi
call fcn.010215b6
mov ecx, dword [edi + 0xb90]
push 9
mov ebx, 0x100b9ac
push ebx
push esi
mov word [ecx], ax
call fcn.010215b6
mov ecx, dword [0x10deb02]
cmp ax, cx
jae 0x1055eb6
push 9
push ebx
push esi
call fcn.010215b6
jmp 0x1055eb8
mov eax, ecx
mov edx, dword [0x10de842]
cmp ax, dx
jbe 0x1055ee6
push 9
push ebx
push esi
call fcn.010215b6
mov ecx, dword [0x10deb02]
cmp ax, cx
jae 0x1055ee2
push 9
push ebx
push esi
call fcn.010215b6
jmp 0x1055ee8
mov eax, ecx
jmp 0x1055ee8
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0x2400
mov word [ecx + 2], ax
movzx eax, word [0x10deb06]
mov ebx, 0x100b988
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.010215b6
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055f26
push 0x2400
push ebx
push esi
call fcn.010215b6
movsx ecx, ax
jmp 0x1055f29
mov ecx, dword [ebp - 4]
movzx eax, word [0x10de846]
cmp ecx, eax
jle 0x1055f66
movzx eax, word [0x10deb06]
push 0x2400
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.010215b6
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055f63
push 0x2400
push ebx
push esi
call fcn.010215b6
movsx eax, ax
jmp 0x1055f66
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0x20
mov word [ecx + 6], ax
movzx eax, word [0x10deb08]
mov ebx, 0x100b954
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.010215b6
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055f9e
push 0x20
push ebx
push esi
call fcn.010215b6
movsx ecx, ax
jmp 0x1055fa1
mov ecx, dword [ebp - 4]
movzx eax, word [0x10de848]
cmp ecx, eax
jle 0x1055fd8
movzx eax, word [0x10deb08]
push 0x20
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.010215b6
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1055fd5
push 0x20
push ebx
push esi
call fcn.010215b6
movsx eax, ax
jmp 0x1055fd8
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0x200
mov word [ecx + 8], ax
movzx eax, word [0x10deb0a]
mov ebx, 0x100b934
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.010215b6
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1056016
push 0x200
push ebx
push esi
call fcn.010215b6
movsx ecx, ax
jmp 0x1056019
mov ecx, dword [ebp - 4]
movzx eax, word [0x10de84a]
cmp ecx, eax
jle 0x1056056
movzx eax, word [0x10deb0a]
push 0x200
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.010215b6
movsx eax, ax
cmp eax, dword [ebp - 4]
jge 0x1056053
push 0x200
push ebx
push esi
call fcn.010215b6
movsx eax, ax
jmp 0x1056056
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0xb90]
push 0
push 0x100b914
mov ebx, 0x100b460
push ebx
mov word [ecx + 0xa], ax
call fcn.010215b6
mov ecx, dword [0x10deb0c]
cmp ax, cx
jge 0x105608c
push 0
push 0x100b914
push ebx
call fcn.010215b6
jmp 0x105608e
mov eax, ecx
mov edx, dword [0x10de84c]
cmp ax, dx
jle 0x10560c4
push 0
push 0x100b914
push ebx
call fcn.010215b6
mov ecx, dword [0x10deb0c]
cmp ax, cx
jge 0x10560c0
push 0
push 0x100b914
push ebx
call fcn.010215b6
jmp 0x10560c6
mov eax, ecx
jmp 0x10560c6
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b8ec
push ebx
push esi
mov word [ecx + 0xc], ax
call fcn.010215b6
mov ecx, dword [0x10deb0e]
cmp ax, cx
jge 0x10560f4
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x10560f6
mov eax, ecx
mov edx, dword [0x10de84e]
cmp ax, dx
jle 0x1056124
push 0
push ebx
push esi
call fcn.010215b6
mov ecx, dword [0x10deb0e]
cmp ax, cx
jge 0x1056120
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x1056126
mov eax, ecx
jmp 0x1056126
mov eax, edx
mov ecx, dword [edi + 0xb90]
xor ebx, ebx
inc ebx
push ebx
push 0x100b8bc
push esi
mov word [ecx + 0xe], ax
call fcn.010215b6
mov ecx, dword [0x10deb10]
cmp ax, cx
jge 0x1056158
push ebx
push 0x100b8bc
push esi
call fcn.010215b6
jmp 0x105615a
mov eax, ecx
mov edx, dword [0x10de850]
cmp ax, dx
jle 0x105618e
push ebx
push 0x100b8bc
push esi
call fcn.010215b6
mov ecx, dword [0x10deb10]
cmp ax, cx
jge 0x105618a
push ebx
push 0x100b8bc
push esi
call fcn.010215b6
jmp 0x1056190
mov eax, ecx
jmp 0x1056190
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b890
push esi
mov word [ecx + 0x10], ax
call fcn.010215b6
mov ecx, dword [0x10deb12]
cmp ax, cx
jge 0x10561bf
push ebx
push 0x100b890
push esi
call fcn.010215b6
jmp 0x10561c1
mov eax, ecx
mov edx, dword [0x10de852]
cmp ax, dx
jle 0x10561f5
push ebx
push 0x100b890
push esi
call fcn.010215b6
mov ecx, dword [0x10deb12]
cmp ax, cx
jge 0x10561f1
push ebx
push 0x100b890
push esi
call fcn.010215b6
jmp 0x10561f7
mov eax, ecx
jmp 0x10561f7
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b874
push esi
mov word [ecx + 0x12], ax
call fcn.010215b6
mov ecx, dword [0x10deb14]
cmp ax, cx
jge 0x1056226
push ebx
push 0x100b874
push esi
call fcn.010215b6
jmp 0x1056228
mov eax, ecx
mov edx, dword [0x10de854]
cmp ax, dx
jle 0x105625c
push ebx
push 0x100b874
push esi
call fcn.010215b6
mov ecx, dword [0x10deb14]
cmp ax, cx
jge 0x1056258
push ebx
push 0x100b874
push esi
call fcn.010215b6
jmp 0x105625e
mov eax, ecx
jmp 0x105625e
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b858
push esi
mov word [ecx + 0x14], ax
call fcn.010215b6
mov ecx, dword [0x10deb16]
cmp ax, cx
jge 0x105628d
push ebx
push 0x100b858
push esi
call fcn.010215b6
jmp 0x105628f
mov eax, ecx
mov edx, dword [0x10de856]
cmp ax, dx
jle 0x10562c3
push ebx
push 0x100b858
push esi
call fcn.010215b6
mov ecx, dword [0x10deb16]
cmp ax, cx
jge 0x10562bf
push ebx
push 0x100b858
push esi
call fcn.010215b6
jmp 0x10562c5
mov eax, ecx
jmp 0x10562c5
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b840
push esi
mov word [ecx + 0x16], ax
call fcn.010215b6
mov ecx, dword [0x10deb18]
cmp ax, cx
jge 0x10562f4
push ebx
push 0x100b840
push esi
call fcn.010215b6
jmp 0x10562f6
mov eax, ecx
mov edx, dword [0x10de858]
cmp ax, dx
jle 0x105632a
push ebx
push 0x100b840
push esi
call fcn.010215b6
mov ecx, dword [0x10deb18]
cmp ax, cx
jge 0x1056326
push ebx
push 0x100b840
push esi
call fcn.010215b6
jmp 0x105632c
mov eax, ecx
jmp 0x105632c
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b818
push esi
mov word [ecx + 0x18], ax
call fcn.010215b6
mov ecx, dword [0x10deb1c]
cmp ax, cx
jge 0x105635b
push ebx
push 0x100b818
push esi
call fcn.010215b6
jmp 0x105635d
mov eax, ecx
mov edx, dword [0x10de85c]
cmp ax, dx
jle 0x1056391
push ebx
push 0x100b818
push esi
call fcn.010215b6
mov ecx, dword [0x10deb1c]
cmp ax, cx
jge 0x105638d
push ebx
push 0x100b818
push esi
call fcn.010215b6
jmp 0x1056393
mov eax, ecx
jmp 0x1056393
mov eax, edx
mov ecx, dword [edi + 0xb90]
push ebx
push 0x100b3a0
push esi
mov word [ecx + 0x1c], ax
call fcn.010215b6
mov ecx, dword [0x10deb1e]
cmp ax, cx
jge 0x10563c2
push ebx
push 0x100b3a0
push esi
call fcn.010215b6
jmp 0x10563c4
mov eax, ecx
mov edx, dword [0x10de85e]
cmp ax, dx
jle 0x10563f8
push ebx
push 0x100b3a0
push esi
call fcn.010215b6
mov ecx, dword [0x10deb1e]
cmp ax, cx
jge 0x10563f4
push ebx
push 0x100b3a0
push esi
call fcn.010215b6
jmp 0x10563fa
mov eax, ecx
jmp 0x10563fa
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b800
push ebx
push esi
mov word [ecx + 0x1e], ax
call fcn.010215b6
mov ecx, dword [0x10deb20]
cmp ax, cx
jge 0x1056428
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x105642a
mov eax, ecx
mov edx, dword [0x10de860]
cmp ax, dx
jle 0x1056458
push 0
push ebx
push esi
call fcn.010215b6
mov ecx, dword [0x10deb20]
cmp ax, cx
jge 0x1056454
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x105645a
mov eax, ecx
jmp 0x105645a
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b7e8
push ebx
push esi
mov word [ecx + 0x20], ax
call fcn.010215b6
mov ecx, dword [0x10deb5e]
cmp ax, cx
jge 0x1056488
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x105648a
mov eax, ecx
mov edx, dword [0x10de89e]
cmp ax, dx
jle 0x10564b8
push 0
push ebx
push esi
call fcn.010215b6
mov ecx, dword [0x10deb5e]
cmp ax, cx
jge 0x10564b4
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x10564ba
mov eax, ecx
jmp 0x10564ba
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 1
push 0x100b7cc
push esi
mov word [ecx + 0x5e], ax
call fcn.010215b6
mov ecx, dword [edi + 0xb90]
push 0
mov ebx, 0x100b7a4
push ebx
push esi
mov word [ecx + 0x6c], ax
call fcn.010215b6
mov ecx, dword [0x10deb60]
cmp ax, cx
jge 0x10564ff
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x1056501
mov eax, ecx
mov edx, dword [0x10de8a0]
cmp ax, dx
jle 0x105652f
push 0
push ebx
push esi
call fcn.010215b6
mov ecx, dword [0x10deb60]
cmp ax, cx
jge 0x105652b
push 0
push ebx
push esi
call fcn.010215b6
jmp 0x1056531
mov eax, ecx
jmp 0x1056531
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 1
mov ebx, 0x100b778
push ebx
push esi
mov word [ecx + 0x60], ax
call fcn.010215b6
mov ecx, dword [0x10deb62]
cmp ax, cx
jge 0x105655f
push 1
push ebx
push esi
call fcn.010215b6
jmp 0x1056561
mov eax, ecx
mov edx, dword [0x10de8a2]
cmp ax, dx
jle 0x105658f
push 1
push ebx
push esi
call fcn.010215b6
mov ecx, dword [0x10deb62]
cmp ax, cx
jge 0x105658b
push 1
push ebx
push esi
call fcn.010215b6
jmp 0x1056591
mov eax, ecx
jmp 0x1056591
mov eax, edx
mov ecx, dword [edi + 0xb90]
push 2
push 0x100b750
push 0x100b738
mov word [ecx + 0x62], ax
call fcn.010215b6
mov ecx, dword [edi + 0xb90]
movsx eax, ax
add ecx, 0x9c
shl eax, 5
xor eax, dword [ecx]
push 2
mov ebx, 0x100b724
push ebx
and eax, 0x60
xor dword [ecx], eax
push esi
call fcn.010215b6
push 2
push ebx
push esi
call fcn.010215b6
push 1
push 0x100b6d8
push esi
call fcn.010215b6
mov ecx, dword [edi + 0xb90]
movzx eax, ax
add ecx, 0x9c
shl eax, 0x11
xor eax, dword [ecx]
and eax, 0x20000
xor dword [ecx], eax
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0x2000000
push eax
push eax
push eax
push 0x100b618
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105663f
push 0x100b5d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.01021b36
push 0
push 0x100b6a0
push esi
call fcn.010215b6
mov ecx, dword [edi + 0xb90]
add ecx, 0x9c
xor edx, edx
test ax, ax
setne dl
push 1
push 0x100b66c
push esi
movsx eax, dx
shl eax, 0x13
xor eax, dword [ecx]
and eax, 0x80000
xor dword [ecx], eax
call fcn.010215b6
mov edi, dword [edi + 0xb90]
xor edx, edx
test ax, ax
setne dl
lea ecx, [edi + 0x9c]
pop edi
pop esi
pop ebx
movsx eax, dx
shl eax, 0x12
xor eax, dword [ecx]
and eax, 0x40000
xor dword [ecx], eax
leave
ret