Function at 0x1000f61d
Capabilities:
Delete registry value

Disassembly:
push 0x20
mov eax, 0x1003018f
call fcn.1002ae49
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 0x6e9b
mov dword [ebp - 0x18], 0x6a9
mov dword [ebp - 0x14], 0x17fe
mov dword [ebp - 0x1c], 0x3032
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x3775
or ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x1b55
mov dword [ebp - 0x18], 0x5865
mov dword [ebp - 0x1c], 0x6a3c
mov dword [ebp - 0x14], 0x3594
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
imul eax, ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x5337
xor eax, ecx
push 0x24
mov dword [ebp - 0x1c], eax
call fcn.1001e65e
cmp dword [eax + 0x18], 8
pop ecx
jb 0x1000f6a6
mov eax, dword [eax + 4]
jmp 0x1000f6a9
add eax, 4
lea ecx, [ebp - 0x10]
push ecx
mov edi, 0xf003f
push edi
push ebx
push eax
mov esi, SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000f803
mov dword [ebp - 0x1c], 0x2dec
mov dword [ebp - 0x14], 0x1738
mov dword [ebp - 0x18], 0x126c
mov dword [ebp - 0x1c], 0x75b7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 0x48cc]
mov ecx, dword [ebp - 0x14]
and eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x5257
mov dword [ebp - 0x14], 0x461
mov dword [ebp - 0x18], 0x65
mov dword [ebp - 0x1c], 0x7d61
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
and eax, 0x7750
or eax, ecx
mov ecx, dword [ebp - 0x14]
or eax, ecx
push 0x24
mov dword [ebp - 0x1c], eax
call fcn.1001e65e
cmp dword [eax + 0x18], 8
pop ecx
jb 0x1000f73e
mov eax, dword [eax + 4]
jmp 0x1000f741
add eax, 4
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push edi
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1000f7ea
mov dword [ebp - 0x1c], 0x173a
mov dword [ebp - 0x18], 0x365d
mov dword [ebp - 0x1c], 0x71
mov dword [ebp - 0x14], 0x336c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
and eax, ecx
mov ecx, dword [ebp - 0x14]
xor ecx, 0x6c2c
or eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0x12d6
mov dword [ebp - 0x24], 0x10a5
mov dword [ebp - 0x20], 0x5077
mov dword [ebp - 0x28], 0x1433
mov dword [ebp - 0x18], 0x7295
mov dword [ebp - 0x1c], 0x11b
mov dword [ebp - 0x14], 0x2536
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
imul eax, ecx
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x5e67
add eax, ecx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
imul ecx, edx
mov edx, dword [ebp - 0x28]
sub ecx, edx
or eax, ecx
mov dword [ebp - 0x28], eax
jmp 0x1000f8b9
mov dword [ebp - 0x28], 0x33b4
mov dword [ebp - 0x28], 0xd2d
mov eax, dword [ebp - 0x28]
xor eax, 0x1f9c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x2197
mov dword [ebp - 0x2c], 0x3b7f
mov dword [ebp - 0x18], 0x5cc8
mov dword [ebp - 0x1c], 0x11db
mov dword [ebp - 0x14], 0x3609
mov dword [ebp - 0x24], 0x14bd
mov dword [ebp - 0x28], 0x169c
mov dword [ebp - 0x20], 0x77fb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x20]
add eax, 0x3634
and ecx, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x14]
xor edx, eax
mov eax, dword [ebp - 0x2c]
or ecx, edx
or ecx, eax
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
jae 0x1000f870
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x2c], 0x9ed
mov dword [ebp - 0x20], 0x1f8d
mov dword [ebp - 0x24], 0x4861
mov dword [ebp - 0x28], 0x7af8
mov dword [ebp - 0x2c], 0x5d6e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
imul eax, ecx
mov ecx, dword [ebp - 0x24]
imul eax, eax, 0x5a4f
sub ecx, eax
mov eax, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x2c], ecx
push ebx
push 1
lea esi, [ebp + 8]
call fcn.100161cc
call fcn.10028d63
ret