Function at 0x10003516
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 0x14]
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
jmp 0x100038fb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [ebp - 0xc], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x10003567
test ebx, ebx
je 0x100035ed
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x1000394e
cmp dword [ebp + 0x10], 0
je 0x100035ed
and dword [ebp + 8], 0
push 0x5c
push edi
call fcn.10001b21
test eax, eax
pop ecx
pop ecx
jne 0x10003912
mov ecx, dword [ebp - 4]
push edi
call fcn.10001c70
test eax, eax
je 0x100035b6
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.1000261f
and dword [ebp + 8], 0
test ebx, ebx
je 0x100035e5
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x10003946
mov ecx, dword [ebp - 4]
push edi
call fcn.10001cd1
lea ecx, [ebp + 8]
mov esi, eax
call fcn.100016e6
jmp 0x1000377e
lea ecx, [ebp + 8]
call fcn.100016e6
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10003613
mov ecx, dword [ebp - 4]
and dword [ebp - 0xc], eax
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x1000394e
push 0x1000b2c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100036ee
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x218]
push eax
call fcn.10001b85
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x1000394e
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
cmp esi, ebx
jl 0x1000394e
cmp byte [edi], 0x3d
jne 0x1000391a
cmp dword [ebp + 0x10], ebx
je 0x10003691
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10003144
lea ecx, [ebp + 8]
mov esi, eax
mov dword [ebp + 8], ebx
call fcn.100016e6
cmp esi, ebx
jmp 0x10003780
cmp dword [ebp + 0x14], ebx
jne 0x100036dc
cmp dword [ebp - 0xc], ebx
je 0x100036dc
push 0x20006
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.10001765
cmp eax, ebx
jne 0x1000393d
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x100036d4
cmp eax, 2
jne 0x1000393d
lea ecx, [ebp + 8]
call fcn.100016e6
mov ecx, dword [ebp - 4]
push edi
call fcn.10001cd1
mov esi, eax
cmp esi, ebx
jmp 0x10003905
push 0x5c
push edi
call fcn.10001b21
test eax, eax
pop ecx
pop ecx
jne 0x1000391a
cmp dword [ebp + 0x10], eax
je 0x1000378b
mov esi, 0x2001f
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.10001765
test eax, eax
je 0x10003751
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.10001765
test eax, eax
je 0x10003751
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.10001717
mov esi, eax
cmp esi, ebx
jne 0x10003921
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x1000394e
cmp byte [edi], 0x3d
jne 0x100038ca
mov ecx, dword [ebp - 4]
push edi
push 0
lea eax, [ebp - 8]
push eax
call fcn.10003144
mov esi, eax
test esi, esi
jl 0x1000394e
jmp 0x100038ca
cmp dword [ebp + 0x14], 0
jne 0x100037a6
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.10001765
mov ebx, eax
jmp 0x100037a9
push 2
pop ebx
test ebx, ebx
je 0x100037b4
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x1000394e
mov ecx, dword [ebp - 4]
push edi
call fcn.10001cd1
mov esi, eax
test esi, esi
jl 0x1000394e
cmp byte [edi], 0x7b
jne 0x10003826
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 8]
push edi
call fcn.10003516
mov esi, eax
test esi, esi
jge 0x10003813
cmp dword [ebp + 0x14], 0
je 0x1000394e
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x1000394e
cmp ebx, 2
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x14], eax
je 0x10003907
test ebx, ebx
je 0x1000384f
test eax, eax
jne 0x10003907
push ebx
call fcn.10001686
pop ecx
mov esi, eax
jmp 0x1000394e
test eax, eax
je 0x10003894
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.10001c9c
test eax, eax
je 0x10003894
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x114]
push eax
call fcn.10001c70
test eax, eax
je 0x10003907
cmp dword [ebp - 0xc], 0
je 0x10003907
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 8]
call fcn.1000261f
jmp 0x10003907
lea ecx, [ebp - 8]
call fcn.100016e6
mov ebx, eax
test ebx, ebx
jne 0x1000392c
cmp dword [ebp - 0xc], eax
je 0x10003907
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp + 8], ebx
test eax, eax
jne 0x1000393d
lea ecx, [ebp + 8]
call fcn.100016e6
cmp dword [ebp + 0x10], 0
je 0x10003907
cmp byte [edi], 0x7b
jne 0x10003907
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x10003907
mov ecx, dword [ebp - 4]
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
push edi
call fcn.10003516
mov esi, eax
test esi, esi
jl 0x1000394e
mov ecx, dword [ebp - 4]
push edi
call fcn.10001b85
mov esi, eax
test esi, esi
jl 0x1000394e
cmp byte [edi], 0x7d
jne 0x10003537
jmp 0x1000394e
lea ecx, [ebp + 8]
call fcn.100016e6
mov esi, 0x80020009
jmp 0x1000394e
lea ecx, [ebp - 8]
call fcn.100016e6
push esi
jmp 0x10003935
lea ecx, [ebp - 8]
call fcn.100016e6
push ebx
call fcn.10001686
pop ecx
jmp 0x10003958
push eax
call fcn.10001686
pop ecx
mov esi, eax
lea ecx, [ebp + 8]
call fcn.100016e6
lea ecx, [ebp - 8]
call fcn.100016e6
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10