Function at 0x1001aa64
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x18
mov eax, 0x1017a991
call fcn.10145d80
mov eax, dword [ebp + 0x420]
mov edi, dword [ebp + 0x41c]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x428]
and dword [ebp - 4], 0
mov dword [ebp - 0x24], eax
jmp 0x1001aec4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [ebp - 0x1c], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x1001aae0
test ebx, ebx
je 0x1001ab71
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001af29
cmp dword [ebp + 0x424], 0
je 0x1001ab71
and dword [ebp - 0x14], 0
push 0x5c
push edi
call fcn.100171b8
test eax, eax
pop ecx
pop ecx
jne 0x1001aedc
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1001733a
test eax, eax
je 0x1001ab32
mov eax, dword [ebp - 0x20]
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.10018519
and dword [ebp - 0x14], 0
test ebx, ebx
je 0x1001ab69
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001aeeb
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1001739b
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.10016e74
test esi, esi
jl 0x1001af29
jmp 0x1001ae8c
lea ecx, [ebp - 0x14]
call fcn.10016e74
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001ab97
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x1c], eax
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001af29
push 0x101c6d0c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001ac78
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.10017237
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x1001af29
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10017237
mov esi, eax
cmp esi, ebx
jl 0x1001af29
cmp word [edi], 0x3d
jne 0x1001aee4
cmp dword [ebp + 0x424], ebx
je 0x1001ac1b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push edi
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.1001a781
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
jl 0x1001af24
mov byte [ebp - 4], bl
jmp 0x1001ae87
cmp dword [ebp + 0x428], ebx
jne 0x1001ac66
cmp dword [ebp - 0x1c], ebx
je 0x1001ac66
push 0x20006
push ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.10016ed9
cmp eax, ebx
jne 0x1001aef0
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x1001ac5e
cmp eax, 2
jne 0x1001aef0
lea ecx, [ebp - 0x14]
call fcn.10016e74
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1001739b
mov esi, eax
cmp esi, ebx
jmp 0x1001aece
push 0x5c
push edi
call fcn.100171b8
test eax, eax
pop ecx
pop ecx
jne 0x1001aee4
cmp dword [ebp + 0x424], eax
je 0x1001ad0d
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.10016ed9
test eax, eax
je 0x1001acda
push 0x20019
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.10016ed9
test eax, eax
je 0x1001acda
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.10016e8b
mov esi, eax
cmp esi, ebx
jne 0x1001aefc
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001af29
cmp word [edi], 0x3d
jne 0x1001ae8c
mov ecx, dword [ebp - 0x10]
push edi
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.1001a781
mov esi, eax
jmp 0x1001ab5c
cmp dword [ebp + 0x428], 0
jne 0x1001ad2b
push 0x20019
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.10016ed9
mov ebx, eax
jmp 0x1001ad2e
push 2
pop ebx
test ebx, ebx
je 0x1001ad3c
mov dword [ebp + 0x428], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x208]
push 0x104
push eax
call fcn.10147f80
push eax
call fcn.10001067
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001af29
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1001739b
mov esi, eax
test esi, esi
jl 0x1001af29
cmp word [edi], 0x7b
jne 0x1001adcb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1001adcb
push dword [ebp + 0x428]
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x18]
push edi
call fcn.1001aa64
mov esi, eax
test esi, esi
jge 0x1001adb8
cmp dword [ebp + 0x428], 0
je 0x1001af29
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001af29
cmp ebx, 2
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x428], eax
je 0x1001aed0
test ebx, ebx
je 0x1001adf7
test eax, eax
jne 0x1001aed0
push ebx
call fcn.10016dc2
pop ecx
mov esi, eax
jmp 0x1001af29
test eax, eax
je 0x1001ae3f
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.10017366
test eax, eax
je 0x1001ae3f
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x208]
push eax
call fcn.1001733a
test eax, eax
je 0x1001aed0
cmp dword [ebp - 0x1c], 0
je 0x1001aed0
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp - 0x18]
call fcn.10018519
jmp 0x1001aed0
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.10017366
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.10016e74
mov ebx, eax
test ebx, ebx
jne 0x1001af0d
cmp dword [ebp - 0x1c], eax
je 0x1001aed0
cmp dword [ebp - 0x14], eax
jne 0x1001aed0
lea eax, [ebp + 0x208]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0x1c], ebx
test eax, eax
jne 0x1001af18
lea ecx, [ebp - 0x1c]
call fcn.10016e74
cmp dword [ebp + 0x424], 0
je 0x1001aed0
cmp word [edi], 0x7b
jne 0x1001aed0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1001aed0
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x424]
push dword [ebp - 0x18]
push edi
call fcn.1001aa64
mov esi, eax
test esi, esi
jl 0x1001af29
mov ecx, dword [ebp - 0x10]
push edi
call fcn.10017237
mov esi, eax
test esi, esi
jl 0x1001af29
cmp word [edi], 0x7d
jne 0x1001aab0
jmp 0x1001af29
lea ecx, [ebp - 0x14]
call fcn.10016e74
mov esi, 0x80020009
jmp 0x1001af29
lea ecx, [ebp - 0x14]
jmp 0x1001af24
push eax
call fcn.10016dc2
pop ecx
lea ecx, [ebp - 0x14]
jmp 0x1001af22
lea ecx, [ebp - 0x18]
call fcn.10016e74
push esi
call fcn.10016dc2
pop ecx
jmp 0x1001af33
lea ecx, [ebp - 0x18]
call fcn.10016e74
push ebx
jmp 0x1001af05
push eax
call fcn.10016dc2
pop ecx
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.10016e74
lea ecx, [ebp - 0x18]
call fcn.10016e74
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x414
leave
ret 0x10