Function at 0x10005b27
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007afc9
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.10061440
mov eax, dword [0x100a82b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2228], esi
mov dword [ebp - 0x2224], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2250], eax
mov eax, ebx
mov dword [ebp - 4], esi
call fcn.1000521f
mov edi, eax
cmp edi, esi
jmp 0x1000607b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x2234], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x10005bc8
test esi, esi
je 0x10005c8a
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x100060e9
cmp dword [ebp + 0x10], 0
je 0x10005c8a
xor edi, edi
push 0x5c
mov eax, ebx
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], edi
call fcn.100051d0
pop ecx
test eax, eax
jne 0x10006089
push ebx
call fcn.100056d8
test eax, eax
je 0x10005c3d
mov eax, dword [ebp - 0x2220]
push ebx
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], edi
call fcn.10004abd
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], edi
cmp esi, edi
je 0x10005c7f
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x1000609b
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.1000573c
lea esi, [ebp - 0x2230]
mov edi, eax
call fcn.1000448d
test edi, edi
jl 0x100060e9
jmp 0x10006035
lea esi, [ebp - 0x2230]
call fcn.1000448d
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10005cb7
and dword [ebp - 0x2234], eax
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x100060e9
push 0x1009385c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10005dd9
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
call fcn.1000521f
mov edi, eax
xor esi, esi
cmp edi, esi
jl 0x100060e9
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
cmp edi, esi
jl 0x100060e9
cmp word [ebx], 0x3d
jne 0x10006094
cmp dword [ebp + 0x10], esi
je 0x10005d62
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x223c], eax
push ebx
lea eax, [ebp - 0x2218]
push eax
lea edx, [ebp - 0x223c]
mov dword [ebp - 0x2238], esi
call fcn.10005335
mov edi, eax
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
cmp edi, esi
lea esi, [ebp - 0x223c]
jl 0x100060e4
mov byte [ebp - 4], 0
jmp 0x10006030
cmp dword [ebp + 0x14], esi
jne 0x10005dc7
cmp dword [ebp - 0x2234], esi
je 0x10005dc7
push 0x20006
push esi
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2244]
mov dword [ebp - 0x2244], esi
mov dword [ebp - 0x2240], esi
call fcn.1000445a
cmp eax, esi
jne 0x100060a3
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2244]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x10005dba
cmp eax, 2
jne 0x100060a3
lea esi, [ebp - 0x2244]
call fcn.1000448d
xor esi, esi
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.1000573c
jmp 0x10005b8c
push 0x5c
mov eax, ebx
call fcn.100051d0
pop ecx
test eax, eax
jne 0x10006094
cmp dword [ebp + 0x10], eax
je 0x10005e82
push 0x2001f
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.1000445a
test eax, eax
je 0x10005e46
push 0x20019
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.1000445a
test eax, eax
je 0x10005e46
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.10004a05
mov edi, eax
test edi, edi
jne 0x100060b0
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x100060e9
cmp word [ebx], 0x3d
jne 0x10006035
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
lea edx, [ebp - 0x2228]
call fcn.10005335
mov edi, eax
jmp 0x10005c72
cmp dword [ebp + 0x14], 0
jne 0x10005ea3
push 0x20019
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.1000445a
mov esi, eax
jmp 0x10005ea6
push 2
pop esi
test esi, esi
je 0x10005eb1
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1005a527
push eax
call fcn.10002638
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x100060e9
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.1000573c
mov edi, eax
test edi, edi
jl 0x100060e9
cmp word [ebx], 0x7b
jne 0x10005f4c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10005f4c
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp - 0x2228]
push ebx
call fcn.10005b27
mov edi, eax
test edi, edi
jge 0x10005f35
cmp dword [ebp + 0x14], 0
je 0x100060e9
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x100060e9
mov eax, dword [ebp - 0x2250]
mov dword [ebp + 0x14], eax
cmp esi, 2
je 0x1000607d
test esi, esi
je 0x10005f78
test eax, eax
jne 0x1000607d
mov eax, esi
call fcn.100048f3
mov edi, eax
jmp 0x100060e9
test eax, eax
je 0x10005fc3
push dword [ebp - 0x2228]
call fcn.10005707
test eax, eax
je 0x10005fc3
lea eax, [ebp - 0x218]
push eax
call fcn.100056d8
test eax, eax
je 0x1000607d
cmp dword [ebp - 0x2234], 0
je 0x1000607d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2228]
call fcn.10004abd
jmp 0x1000607d
push dword [ebp - 0x2228]
call fcn.10005707
lea esi, [ebp - 0x2228]
mov dword [ebp - 0x2258], eax
call fcn.1000448d
xor esi, esi
mov dword [ebp - 0x2254], eax
cmp eax, esi
jne 0x100060c4
cmp dword [ebp - 0x2234], esi
je 0x1000607d
cmp dword [ebp - 0x2258], esi
jne 0x1000607d
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x224c], esi
mov dword [ebp - 0x2248], esi
cmp eax, esi
jne 0x100060d7
lea esi, [ebp - 0x224c]
call fcn.1000448d
cmp dword [ebp + 0x10], 0
je 0x1000607d
cmp word [ebx], 0x7b
jne 0x1000607d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1000607d
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2228]
push ebx
call fcn.10005b27
mov edi, eax
test edi, edi
jl 0x100060e9
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.1000521f
mov edi, eax
test edi, edi
jl 0x100060e9
cmp word [ebx], 0x7d
jne 0x10005b95
jmp 0x100060e9
lea esi, [ebp - 0x2230]
call fcn.1000448d
mov edi, 0x80020009
jmp 0x100060e9
lea esi, [ebp - 0x2230]
jmp 0x100060e4
call fcn.100048f3
lea esi, [ebp - 0x2244]
jmp 0x100060e2
lea esi, [ebp - 0x2228]
call fcn.1000448d
mov eax, edi
call fcn.100048f3
jmp 0x100060f6
lea esi, [ebp - 0x2228]
call fcn.1000448d
mov eax, dword [ebp - 0x2254]
jmp 0x100060bd
call fcn.100048f3
lea esi, [ebp - 0x224c]
mov edi, eax
call fcn.1000448d
lea esi, [ebp - 0x2228]
call fcn.1000448d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10059ccb
leave
ret 0x10