Function at 0x1000ed60
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x10065777
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x1007c060]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007c060]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
lea eax, [esp + 0x70]
xor ebp, ebp
push eax
mov edx, str.offlineRule
mov ecx, str.Softwareprojonepodlpdlpcore_
mov dword [esp + 0x1c], ebp
call fcn.100277a0
add esp, 4
mov dword [esp + 0x1a0], ebp
and dword [esp + 0x24], 0xfffffe00
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov byte [esp + 0x1a0], 2
cmp dword [esp + 0x84], ebp
je 0x1000f045
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.100014b0
add esp, 8
mov esi, eax
lea eax, [esp + 0x8c]
mov ebx, 3
mov byte [esp + 0x1a0], bl
push eax
mov dword [esp + 0x1c], 1
call fcn.100374a8
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x1a8], 4
push eax
mov dword [esp + 0x24], ebx
call fcn.10037517
lea edi, [ebp + 0xf]
test al, al
je 0x1000ee8b
push 0x18
push str.endTime:_cksum:1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebp
mov byte [esp + 0x60], 0
call fcn.10004c30
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x1a4], 5
mov ebx, 7
push eax
mov dword [esp + 0x20], ebx
call fcn.1000b420
add esp, 8
mov byte [esp + 0x17], 1
test al, al
jne 0x1000ee90
mov byte [esp + 0x17], 0
mov esi, 0x10
test bl, 4
je 0x1000eebd
and ebx, 0xfffffffb
cmp dword [esp + 0x6c], esi
jb 0x1000eeb0
mov ecx, dword [esp + 0x58]
push ecx
call fcn.1004a7e9
add esp, 4
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebp
mov byte [esp + 0x58], 0
test bl, 2
je 0x1000eed1
lea edi, [esp + 0x8c]
and ebx, 0xfffffffd
call fcn.1000f0a0
mov dword [esp + 0x1a0], 2
test bl, 1
je 0x1000eef4
cmp dword [esp + 0x50], esi
jb 0x1000eef4
mov edx, dword [esp + 0x3c]
push edx
call fcn.1004a7e9
add esp, 4
cmp byte [esp + 0x17], 0
je 0x1000f030
push str.endTime
lea eax, [esp + 0x20]
push eax
mov ecx, 0x1006b077
call fcn.1003b8e7
push eax
lea ecx, [esp + 0x58]
call fcn.1003ae0f
mov byte [esp + 0x1a0], 6
mov ebx, dword [esp + 0x68]
mov edi, dword [esp + 0x58]
cmp dword [esp + 0x6c], esi
jae 0x1000ef37
lea edi, [esp + 0x58]
push str.cksum
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x1006b07d
call fcn.1003b8e7
push ebx
mov esi, eax
push edi
mov eax, 0x5b7900c1
call fcn.10025f7c
mov edi, eax
call fcn.1003b090
cmp edi, eax
jne 0x1000f01c
push 0x103
lea edx, [esp + 0x91]
push ebp
push edx
mov byte [esp + 0x98], 0
call fcn.1004e1c0
add esp, 0xc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x44]
movzx edx, word [esp + 0x42]
movzx eax, word [esp + 0x40]
push ecx
movzx ecx, word [esp + 0x42]
push edx
movzx edx, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x44]
push ecx
push edx
push eax
push str._04d__02d__02d__02d:_02d:_02d
lea ecx, [esp + 0xa8]
push 0x104
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [esp + 0x7c]
add esp, 0x24
cmp dword [esp + 0x6c], 0x10
jae 0x1000efdf
lea eax, [esp + 0x58]
lea edx, [esp + 0x8c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jle 0x1000f01c
lea ecx, [esp + 0x54]
call fcn.10002e00
lea esi, [esp + 0x1c]
mov byte [esp + 0x1a0], 0
call fcn.1003ac21
lea esi, [esp + 0x70]
call fcn.10009500
mov eax, 1
jmp 0x1000f06f
cmp dword [esp + 0x6c], 0x10
jb 0x1000f030
mov eax, dword [esp + 0x58]
push eax
call fcn.1004a7e9
add esp, 4
push str.offlineRule
push str.Softwareprojonepodlpdlpcore_
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea esi, [esp + 0x1c]
mov byte [esp + 0x1a0], 0
call fcn.1003ac21
cmp dword [esp + 0x88], 8
jb 0x1000f06d
mov ecx, dword [esp + 0x74]
push ecx
call fcn.1004a7e9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.1004a172
add esp, 0x190
ret