Function at 0x687cf0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2234
call fcn.00651b20
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0xff
push ebx
call fcn.006547d0
add esp, 0xc
mov ecx, esi
push edi
call fcn.00687b80
mov ecx, eax
test eax, eax
js 0x687d66
mov dword [ebp - 0x2238], esi
cmp word [edi], 0x7d
je 0x687d66
mov esi, edi
jmp 0x687f13
mov ecx, eax
jmp 0x687d66
mov ecx, 0x80020009
mov esi, ecx
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x687d79
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x2234
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x687e96
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x687e96
mov ecx, eax
mov edi, dword [edi]
call dword [0x7a29f4]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x687e63
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x687e28
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x687e28
jmp 0x688352
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x687eca
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x687e4b
cmp dword [edi], 0
jne 0x687d92
cmp dword [edi + 4], 0
je 0x687e96
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x687e96
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x687feb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x687eca
sub esp, 0x1c
movaps xmm0, xmmword [0x73dfc0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.006890f0
test eax, eax
jne 0x6885bd
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00687b80
mov ecx, eax
test eax, eax
js 0x687d66
movzx eax, word [esi]
cmp ax, 0x3d
je 0x68832b
cmp ax, 0x7b
jne 0x687f09
mov edi, ecx
push esi
call fcn.0066e7c4
add esp, 4
cmp eax, 1
je 0x6885cb
mov ecx, edi
cmp word [esi], 0x7d
je 0x687d66
push str.Delete
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov edi, eax
push 0x738dc8
push esi
call ebx
test eax, eax
je 0x688069
test edi, edi
je 0x688069
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
push str.NoRemove
push esi
call edi
mov dword [ebp - 0x223c], eax
test eax, eax
je 0x688006
push 0x738dc0
push esi
call edi
test eax, eax
je 0x68801f
test esi, esi
je 0x687f8c
mov eax, esi
jmp 0x687f7c
test ecx, ecx
je 0x687f8c
push eax
call ebx
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x687f75
test eax, eax
jne 0x687d61
cmp dword [ebp + 0x10], 0
je 0x6880b8
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x687fbd
cmp dword [edi], 0
jne 0x687ddf
cmp dword [edi + 4], 0
je 0x687e28
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x687e28
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x687e03
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x687eca
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00687b80
test eax, eax
jns 0x687f5d
jmp 0x687d5d
push 0x2000
push 0xff
lea edi, [ebp - 0x2218]
push edi
call fcn.006547d0
add esp, 0xc
mov ecx, dword [ebp - 0x2238]
push edi
call fcn.00687b80
mov edx, 3
test eax, eax
jns 0x6886a9
mov ecx, eax
test edx, edx
je 0x687f09
cmp edx, 2
je 0x687f09
jmp 0x688603
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00687b80
mov ecx, eax
test eax, eax
js 0x687d66
cmp dword [ebp + 0x10], 0
je 0x687f3b
mov dword [ebp - 0x2234], ecx
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test esi, esi
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
je 0x688275
mov eax, esi
jmp 0x68824a
mov edx, 2
cmp dword [ebp + 0x14], 0
lea ebx, [ebp - 0x218]
jne 0x68813a
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x6880f1
cmp dword [edi], 0
jne 0x6881f4
cmp dword [edi + 4], 0
mov edx, 1
je 0x68813a
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x68813a
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x688124
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov dword [ebp - 0x2234], edx
test edx, edx
mov edi, 1
cmove edi, dword [ebp + 0x14]
push 0xffffffffffffffff
push esi
push 0x104
push ebx
call fcn.0066f40e
add esp, 0x10
mov ebx, esi
cmp eax, 0x15
jle 0x68816d
cmp eax, 0x50
je 0x688175
jmp 0x688873
test eax, eax
jne 0x688887
mov esi, dword [ebp - 0x2238]
mov ecx, esi
push ebx
call fcn.00687b80
test eax, eax
js 0x687d5d
mov ecx, esi
push ebx
call fcn.00688b70
mov ecx, eax
test eax, eax
js 0x687d66
mov esi, ebx
cmp word [ebx], 0x7b
je 0x6881d1
lea ebx, [ebp - 0x218]
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x687f09
test eax, eax
je 0x688378
cmp dword [ebp + 0x14], 0
jne 0x687f09
jmp 0x6885bd
push esi
mov ebx, ecx
call fcn.0066e7c4
mov ecx, ebx
add esp, 4
cmp eax, 1
lea ebx, [ebp - 0x218]
mov eax, dword [ebp - 0x2234]
jne 0x6881b1
jmp 0x688617
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x68813a
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
je 0x68813a
mov ecx, eax
mov edi, dword [edi]
call dword [0x7a29f4]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x688109
push eax
call ebx
movzx ecx, word [eax]
test ecx, ecx
je 0x688275
cmp ecx, 0x5c
jne 0x688247
test eax, eax
je 0x688275
mov dword [ebp - 0x2240], 0x80020009
xor edx, edx
inc edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [ebp - 0x2234]
jmp 0x6882f0
push str.AppID
push esi
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call eax
test eax, eax
je 0x6882da
push str.CLSID
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.Component_Categories
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.FileType
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.Interface
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.Hardware
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x6887cd
xor edx, edx
test edi, edi
mov ecx, dword [ebp - 0x2234]
je 0x688662
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x688319
push eax
mov dword [ebp - 0x2234], ecx
mov dword [ebp - 0x223c], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x223c]
mov ecx, dword [ebp - 0x2234]
cmp edx, 4
je 0x68834a
test edx, edx
je 0x687f47
jmp 0x688053
mov ecx, dword [ebp - 0x2238]
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00688c30
mov ecx, eax
test eax, eax
js 0x687d66
movzx eax, word [esi]
jmp 0x687eed
mov ecx, eax
mov edi, dword [edi]
call dword [0x7a29f4]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x687fd5
mov dword [ebp - 0x2234], ecx
cmp dword [ebp + 0x14], 0
mov edi, 0
je 0x68846d
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x68846d
cmp dword [ebp - 0x2218], 0
je 0x68846d
push str.AppID
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x688462
push str.CLSID
push ebx
call edi
test eax, eax
je 0x688462
push str.Component_Categories
push ebx
call edi
test eax, eax
je 0x688462
push str.FileType
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
push str.Interface
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
push str.Hardware
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
push str.Mime
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
push 0x738e84
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x688551
mov ecx, dword [ebp - 0x2234]
jmp 0x687f09
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
setne dl
cmp dword [ebp - 0x2218], edi
sete dh
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x68853f
push eax
mov ebx, edx
mov bh, dh
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dh, bh
mov dl, bl
lea ebx, [ebp - 0x218]
mov dword [ebp - 0x2224], edi
mov dword [ebp - 0x2220], edi
test eax, eax
mov ecx, dword [ebp - 0x2234]
jne 0x6885bd
or dl, dh
cmp dword [ebp - 0x223c], 0
sete al
xor dl, 1
or dl, al
jne 0x687f09
lea edi, [ebp - 0x2218]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
push ebx
call fcn.00689200
xor ecx, ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
test eax, eax
je 0x688462
jmp 0x6888b1
mov dword [ebp - 0x2220], 0
mov ecx, dword [ebp - 0x2234]
jmp 0x6884f6
push str.SECURITY
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
push str.SYSTEM
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
push str.Software
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x688462
cmp dword [ebp - 0x223c], 0
sete byte [ebp - 0x223c]
push str.TypeLib
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
sete al
or al, byte [ebp - 0x223c]
jne 0x688462
jmp 0x6888a0
push eax
call fcn.006890d0
add esp, 4
jmp 0x687d5d
mov edi, dword [ebp - 0x2238]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push esi
call fcn.00687cf0
test eax, eax
js 0x687d5d
mov ecx, edi
push esi
call fcn.00687b80
mov ecx, eax
test eax, eax
jns 0x687f09
jmp 0x687d66
cmp edx, 3
je 0x687d66
mov ecx, dword [ebp - 0x2240]
jmp 0x687d66
mov ecx, dword [ebp - 0x2238]
push edi
push 0
push dword [ebp - 0x2224]
push esi
call fcn.00687cf0
test eax, eax
setns dl
test edi, edi
setne cl
or cl, dl
cmp cl, 1
jne 0x687d5d
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00687b80
mov ecx, eax
test eax, eax
mov eax, dword [ebp - 0x2234]
jns 0x6881b1
jmp 0x687d66
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00687b80
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x688684
mov ecx, eax
mov edx, 3
jmp 0x6882f0
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00688b70
mov ecx, eax
mov edx, eax
sar edx, 0x1f
add edx, 4
jmp 0x6882f0
mov edx, 3
jmp 0x688053
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00687b80
mov ecx, eax
test eax, eax
js 0x68869f
xor edx, edx
inc edx
cmp word [esi], 0x3d
je 0x6886d3
mov dword [ebp - 0x2240], 0x80020009
jmp 0x688053
cmp dword [ebp + 0x10], 0
jne 0x68878b
mov dword [ebp - 0x2234], ecx
cmp dword [ebp + 0x14], 0
jne 0x688770
cmp dword [ebp - 0x223c], 0
je 0x688770
xor eax, eax
lea edi, [ebp - 0x2230]
mov dword [edi], eax
push edi
push 0x20006
push eax
xor ebx, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
mov edi, 0
test eax, eax
cmove edi, ecx
jne 0x688758
lea eax, [ebp - 0x2218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov cl, 1
test eax, 0xfffffffd
jne 0x688758
test edi, edi
je 0x688747
push edi
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test cl, cl
jne 0x688770
mov ecx, dword [ebp - 0x2234]
mov edx, ebx
jmp 0x688053
mov ebx, 3
push eax
call fcn.006890d0
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x2234], eax
jmp 0x688738
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00688b70
mov ecx, eax
mov edx, eax
shr edx, 0x1f
or edx, 2
jmp 0x688053
mov ebx, edx
lea eax, [ebp - 0x2230]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x2238]
mov edi, esi
push esi
lea edx, [ebp - 0x2218]
push edx
push eax
call fcn.00688c30
mov ecx, eax
test eax, eax
js 0x6887c3
mov esi, edi
jmp 0x68834a
mov dword [ebp - 0x2240], ecx
mov esi, edi
jmp 0x688751
push str.Mime
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push 0x738e84
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.SECURITY
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.SYSTEM
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
push str.TypeLib
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x6882da
lea ecx, [ebp - 0x2218]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push esi
call fcn.00688a20
xor eax, eax
lea ecx, [ebp - 0x2218]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
jmp 0x6882da
cmp eax, 0x16
je 0x68887d
cmp eax, 0x22
jne 0x688896
push 0x80070057
call fcn.0069f5f0
cmp eax, 0xc
jne 0x688896
push 0x8007000e
call fcn.0069f5f0
push 0x80004005
call fcn.0069f5f0
lea ecx, [ebp - 0x2224]
push ebx
call fcn.00688a20
jmp 0x688462
push eax
call fcn.006890d0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x6888cd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
jmp 0x687d66