Function at 0x1001d8f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a423
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x15c], 8
mov dword [ebp - 0x54], 0
jmp 0x1001d935
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1001d94b
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x158], 0xa8e
jmp 0x1001d92e
mov dword [ebp - 0x2c], 0
jmp 0x1001d95b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1001d97d
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x1001d97b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1001d954
mov dword [ebp - 0x2c], 7
jmp 0x1001d98d
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jl 0x1001d9aa
mov dword [ebp - 0xfc], 4
cmp dword [ebp - 0xfc], 0
je 0x1001d9a8
jmp 0x1001d9aa
jmp 0x1001d986
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
jmp 0x1001d9c0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 0
jg 0x1001e2f3
mov dword [ebp - 0x4c], 0x53b26bdd
mov dword [ebp - 0x4c], 2
jmp 0x1001d9e3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1d
jne 0x1001da42
mov dword [ebp - 0x3c], 0x318d5816
cmp dword [ebp - 0x3c], 0
je 0x1001d9f8
jmp 0x1001da42
mov dword [ebp - 0x3c], 0
jmp 0x1001da08
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
je 0x1001da40
mov dword [ebp - 0x100], 0x60d00585
cmp dword [ebp - 0x100], 0
je 0x1001da23
jmp 0x1001da40
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x1001da3e
push 0x16b7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x1001da01
jmp 0x1001d9dc
mov byte [ebp - 0x2d], 0
push 3
lea ecx, [ebp - 0x84]
call fcn.100177e1
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x12c], 2
mov dword [ebp - 0x128], 2
mov dword [ebp - 0x124], 2
mov dword [ebp - 0x120], 2
lea ecx, [ebp - 0x71]
call fcn.10017948
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x16c]
call fcn.1001794b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x154]
call fcn.10017894
mov byte [ebp - 4], 1
mov dword [ebp - 0x48], 0xe50714ba
mov dword [ebp - 0x20], 0
jmp 0x1001dada
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001daf0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x118], 1
jmp 0x1001dad3
mov dword [ebp - 0x20], 0
jmp 0x1001db00
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001db1c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x84]
call fcn.10017939
mov dword [eax], 0x1897a4a
jmp 0x1001daf9
push 1
lea ecx, [ebp - 0x84]
call fcn.10017939
and dword [eax], 0
jmp 0x1001db52
push 1
lea ecx, [ebp - 0x84]
call fcn.10017939
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x84]
call fcn.10017939
cmp dword [eax], 2
jg 0x1001db93
mov dword [ebp - 0x40], 0x7555b7ce
mov dword [ebp - 0x40], 0
jmp 0x1001db7b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1001db91
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x118], 3
jmp 0x1001db74
jmp 0x1001db2e
mov dword [ebp - 0x18], 2
jmp 0x1001dba3
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1001dde2
mov dword [ebp - 0x24], 0xe5d5ec7e
mov dword [ebp - 0x38], 0xffffffff
push dword [ebp - 0x18]
lea ecx, [ebp - 0x84]
call fcn.10017939
push dword [ebp - 0x18]
lea ecx, [ebp - 0x84]
call fcn.10017939
mov dword [ebp - 0xf8], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x84]
call fcn.10017939
mov ecx, dword [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xf8]
cmp dword [eax], 0
je 0x1001dc78
push dword [ebp - 0x18]
lea ecx, [ebp - 0x84]
call fcn.10017939
cmp dword [eax], 0
jne 0x1001dc1f
mov dword [ebp - 0x10c], 1
jmp 0x1001dc26
and dword [ebp - 0x10c], 0
push 0
lea ecx, [ebp - 0x84]
call fcn.10017939
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x118], 0x74b6046e
je 0x1001dc52
mov dword [ebp - 0x104], 1
jmp 0x1001dc59
and dword [ebp - 0x104], 0
push 2
lea ecx, [ebp - 0x84]
call fcn.10017939
cmp dword [ebp - 0x44], 0
je 0x1001dc78
mov dword [ebp - 0xe4], 1
jmp 0x1001dc7f
and dword [ebp - 0xe4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
cmp dword [ebp - 0xe4], eax
jl 0x1001dc9d
mov dword [ebp - 0x78], 1
jmp 0x1001dca1
and dword [ebp - 0x78], 0
push 2
lea ecx, [ebp - 0x154]
call fcn.10017939
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1001dcc5
cmp dword [ebp - 0x24], 0
je 0x1001dcd7
cmp dword [ebp - 0x18], 0
je 0x1001dcd7
mov dword [ebp - 0x90], 1
jmp 0x1001dcde
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jne 0x1001dcf9
mov dword [ebp - 0xd8], 1
jmp 0x1001dd00
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0
jmp 0x1001dd19
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff7
jge 0x1001dddd
mov dword [ebp - 0x48], 2
jmp 0x1001dd33
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1001ddd8
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x118], 0
je 0x1001dd74
mov byte [ebp - 0x30], 0
movzx eax, byte [ebp - 0x30]
test eax, eax
je 0x1001dd72
push 0x1731
push 0
push 0x4dd
push 0x219e
push 0x229f
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x1001ddd3
mov dword [ebp - 0x24], 0
jmp 0x1001dd84
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1001ddd3
mov dword [ebp - 0x44], 0
jmp 0x1001dd9a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1001ddd1
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x118], 0
je 0x1001ddaf
jmp 0x1001ddd1
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x1001ddcf
push 0
push 0
push 0x904
push 0x802
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1001dd93
jmp 0x1001dd7d
jmp 0x1001dd2c
jmp 0x1001dd12
jmp 0x1001db9c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.100118e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.100118e9
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1001e2ee
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x1c], 0xc28cae2f
mov dword [ebp - 0xa4], 3
mov dword [ebp - 0x28], 0
jmp 0x1001de34
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffec
jle 0x1001e2e0
mov dword [ebp - 0x70], 0x6de713a4
mov dword [ebp - 0x6c], 0x6de713a4
mov dword [ebp - 0x68], 0x6de713a4
mov dword [ebp - 0x64], 0x6de713a4
mov dword [ebp - 0x14], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x70], 0xfffffffb
jmp 0x1001de86
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x70], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70], 0xb
je 0x1001e2db
mov dword [ebp - 0x10], 0xf7bf
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + eax - 0x70], ecx
jne 0x1001deb9
mov dword [ebp - 0x98], 1
jmp 0x1001dec0
and dword [ebp - 0x98], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x70]
sub eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x10]
jg 0x1001dee5
mov dword [ebp - 0xe0], 1
jmp 0x1001deec
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x10], 0x698
je 0x1001df1c
mov dword [ebp - 0xa0], 1
jmp 0x1001df23
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa0], eax
jne 0x1001df46
cmp dword [ebp - 0x10], 0
jne 0x1001df46
mov eax, 0x4f78d7cb
test eax, eax
jne 0x1001df46
and dword [ebp - 0xe8], 0
jmp 0x1001df50
mov dword [ebp - 0xe8], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xe8]
je 0x1001e038
mov dword [ebp - 0xd4], 8
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x28], eax
jl 0x1001df84
mov dword [ebp - 0xf0], 1
jmp 0x1001df8b
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
neg eax
je 0x1001dfae
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x70], 0
je 0x1001dfae
mov dword [ebp - 0x88], 1
jmp 0x1001dfb5
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x88]
jl 0x1001dfcf
mov dword [ebp - 0xb4], 1
jmp 0x1001dfd6
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xb4]
jg 0x1001dff7
mov dword [ebp - 0xf4], 1
jmp 0x1001dffe
and dword [ebp - 0xf4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
imul eax, dword [ebp - 0xf4]
test eax, eax
jne 0x1001e020
xor eax, eax
jne 0x1001e020
and dword [ebp - 0xbc], 0
jmp 0x1001e02a
mov dword [ebp - 0xbc], 1
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x14], eax
jmp 0x1001e127
push 2
lea ecx, [ebp - 0x138]
call fcn.100177e1
mov dword [ebp - 4], 2
mov dword [ebp - 0x60], 0
jmp 0x1001e05c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1001e078
push dword [ebp - 0x60]
lea ecx, [ebp - 0x138]
call fcn.10017939
mov dword [eax], 0x36cedda5
jmp 0x1001e055
mov dword [ebp - 0x10], 0
jmp 0x1001e088
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1001e0eb
mov dword [ebp - 0x14], 0
jmp 0x1001e09e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1001e0d3
mov dword [ebp - 0x1c], 1
jmp 0x1001e0b4
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1001e0d1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x138]
call fcn.10017939
cmp dword [eax], 0
je 0x1001e0cf
jmp 0x1001e0d1
jmp 0x1001e0ad
jmp 0x1001e097
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1001e0e9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1001e081
mov dword [ebp - 0x14], 1
jmp 0x1001e0fb
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1001e118
mov dword [ebp - 0x108], 0xffffffff
cmp dword [ebp - 0x108], 0
je 0x1001e116
jmp 0x1001e118
jmp 0x1001e0f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.100118e9
mov eax, dword [ebp - 0x10]
sub eax, 0x5b2dbbfa
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x70]
jg 0x1001e147
mov dword [ebp - 0xdc], 1
jmp 0x1001e14e
and dword [ebp - 0xdc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0xdc], eax
jl 0x1001e16c
mov dword [ebp - 0xc4], 1
jmp 0x1001e173
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc4], eax
je 0x1001e18a
mov dword [ebp - 0xec], 1
jmp 0x1001e191
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xec], eax
jle 0x1001e1a8
mov dword [ebp - 0xcc], 1
jmp 0x1001e1af
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xcc]
lea eax, [ecx + eax - 0xffff]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xa4], eax
jg 0x1001e1dc
mov dword [ebp - 0xa8], 1
jmp 0x1001e1e3
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xa8], eax
je 0x1001e1fa
mov dword [ebp - 0xb0], 1
jmp 0x1001e201
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xb0]
jg 0x1001e21b
mov dword [ebp - 0xb8], 1
jmp 0x1001e222
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xb8]
jg 0x1001e239
mov dword [ebp - 0xc0], 1
jmp 0x1001e240
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc0], eax
jle 0x1001e257
mov dword [ebp - 0xc8], 1
jmp 0x1001e25e
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc8], eax
jge 0x1001e275
mov dword [ebp - 0xd0], 1
jmp 0x1001e27c
and dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0xb4b2
je 0x1001e294
mov dword [ebp - 0x8c], 1
jmp 0x1001e29b
and dword [ebp - 0x8c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x8c], eax
jl 0x1001e2c6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70], 0
je 0x1001e2c6
mov dword [ebp - 0x94], 1
jmp 0x1001e2cd
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x14], eax
jmp 0x1001de71
jmp 0x1001de2d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1001d9b5
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x160], 0x4f833fcb
mov dword [ebp - 0x164], 0xfffffffb
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0x148], 0xfffffffc
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x50], 0
jmp 0x1001e33c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1001e352
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x178], 0x951fe77d
jmp 0x1001e335
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x58], 0
jmp 0x1001e36f
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff2
jg 0x1001e392
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1001e390
push 0
push 0
push 0x1b0e
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x1001e368
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret