Function at 0x10028141
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f44e
mov eax, dword fs:[0]
push eax
mov eax, 0x2264
call fcn.1001d640
mov eax, dword [0x1005b328]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2248], ecx
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282b1
push 0x7d
pop eax
cmp word [edi], ax
je 0x100282a0
push 0x1000ccc4
push edi
mov dword [ebp - 0x2234], 1
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
neg eax
push 0x1000cc98
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2224], esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x100281ff
test esi, esi
je 0x100282cf
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
cmp dword [ebp + 0x10], 0
je 0x100282cf
xor eax, eax
mov ecx, edi
push 0x5c
pop edx
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
call fcn.100297d8
test eax, eax
jne 0x10028777
push edi
call fcn.10023eef
test eax, eax
je 0x1002826f
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2254]
push edi
mov dword [ebp - 0x2254], eax
call fcn.10027d7c
xor eax, eax
mov dword [ebp - 0x2254], eax
cmp dword [ebp - 0x2224], 0
je 0x100282cf
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10029744
mov esi, eax
test esi, esi
jns 0x100284d9
mov ebx, dword [ebp - 0x2230]
test ebx, ebx
je 0x100282b1
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a260
leave
ret 0x10
push 0x1000ccb0
push edi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x100282f7
mov ecx, dword [ebp - 0x221c]
push edi
mov dword [ebp - 0x2234], eax
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
push 0x1000cc90
push edi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x10028432
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
push eax
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10028777
cmp dword [ebp + 0x10], 0
je 0x100283a1
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x2260], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2260]
push eax
call fcn.100236a1
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2260], eax
test esi, esi
js 0x100282a6
mov byte [ebp - 4], al
jmp 0x100284d9
cmp dword [ebp + 0x14], 0
jne 0x10028417
cmp dword [ebp - 0x2234], 0
je 0x10028417
xor eax, eax
lea ecx, [ebp - 0x2244]
push 0x20006
push eax
push dword [ebp - 0x2220]
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], eax
call fcn.10027327
test eax, eax
jne 0x1002874b
mov ebx, dword [ebp - 0x2244]
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
je 0x10028404
cmp eax, 2
jne 0x1002872e
test ebx, ebx
je 0x10028417
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x2244], eax
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10029744
mov esi, eax
test esi, esi
js 0x100282a0
jmp 0x10028717
push 0x5c
pop edx
mov ecx, edi
call fcn.100297d8
test eax, eax
jne 0x10028777
cmp dword [ebp + 0x10], eax
je 0x10028532
mov ebx, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
push 0x2001f
push edi
push ebx
call fcn.10027327
test eax, eax
je 0x10028497
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x2230]
call fcn.10027327
test eax, eax
je 0x10028497
sub esp, 0x14
lea ecx, [ebp - 0x2230]
push edi
push ebx
call fcn.1002435a
test eax, eax
jne 0x1002864a
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
push 0x3d
pop eax
cmp word [edi], ax
jne 0x100284d3
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.100236a1
mov esi, eax
test esi, esi
js 0x100282a0
mov ebx, dword [ebp - 0x2230]
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10028717
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2248]
jne 0x100284ea
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x10028717
xor eax, eax
push eax
push dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.10028141
mov esi, eax
test esi, esi
js 0x100282a0
push edi
mov ecx, ebx
call fcn.10026f97
jmp 0x10028423
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x10028562
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
call fcn.10027327
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2238], ebx
test eax, eax
jne 0x1002856c
jmp 0x10028576
mov dword [ebp - 0x2224], 2
mov dword [ebp - 0x2238], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
mov ecx, eax
call fcn.1001432c
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
push edi
mov ecx, ebx
call fcn.10029744
mov esi, eax
test esi, esi
js 0x100282a0
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10028627
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100285ce
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x10028627
push dword [ebp - 0x2238]
mov ecx, dword [ebp - 0x221c]
push ebx
mov ebx, dword [ebp - 0x2230]
push ebx
push edi
call fcn.10028141
mov esi, eax
test esi, esi
jns 0x1002860f
cmp dword [ebp - 0x2238], 0
je 0x100282a0
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.10026f97
mov esi, eax
test esi, esi
js 0x100282a0
jmp 0x1002862d
mov ebx, dword [ebp - 0x2230]
mov eax, dword [ebp - 0x2224]
cmp eax, 2
je 0x10028717
test eax, eax
je 0x10028658
cmp dword [ebp + 0x14], 0
jne 0x10028717
mov ecx, eax
call fcn.10023e41
mov esi, eax
jmp 0x100282a0
cmp dword [ebp + 0x14], 0
je 0x1002869d
push ebx
call fcn.10026701
test eax, eax
je 0x1002869d
lea eax, [ebp - 0x218]
push eax
call fcn.10023eef
test eax, eax
je 0x10028717
cmp dword [ebp - 0x2234], 0
je 0x10028717
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.10027d7c
jmp 0x10028717
push ebx
call fcn.10026701
mov dword [ebp - 0x2224], eax
test ebx, ebx
je 0x100286ce
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2230], ebx
test eax, eax
jne 0x10028769
mov eax, dword [ebp - 0x2224]
jmp 0x100286d0
xor ecx, ecx
cmp dword [ebp - 0x2234], 0
je 0x10028717
test eax, eax
jne 0x10028717
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x226c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2268], ecx
mov dword [ebp - 0x2264], ecx
lea ecx, [ebp - 0x226c]
push eax
call fcn.1002512c
xor ecx, ecx
mov dword [ebp - 0x226c], ecx
test eax, eax
jne 0x1002864a
push 0x7d
pop eax
cmp word [edi], ax
je 0x100282a0
mov ebx, dword [ebp - 0x2230]
jmp 0x100281c6
mov ecx, eax
call fcn.10023e41
mov esi, eax
test ebx, ebx
je 0x100282a0
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x100282a0
mov ecx, eax
call fcn.10023e41
cmp dword [ebp - 0x2244], 0
mov esi, eax
je 0x100282a0
push dword [ebp - 0x2244]
jmp 0x10028740
mov ecx, eax
call fcn.10023e41
mov esi, eax
jmp 0x100282a6
mov esi, 0x80020009
jmp 0x100282a6