Function at 0x1000764d
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001aae8
mov eax, dword fs:[0]
push eax
mov eax, 0x4264
call fcn.100102e0
mov eax, dword [0x1002005c]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4270], ecx
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
and dword [ebp - 0x24], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x100076d6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1164], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000730a
mov eax, dword [ebp - 0x1164]
jmp 0x10007ffa
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x7d
je 0x10007fdf
mov dword [ebp - 0x10], 1
push dword [0x1001d0f4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x138], eax
push dword [0x1001d0ec]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10007726
cmp dword [ebp - 0x138], 0
je 0x10007903
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007742
jmp 0x10007fdf
cmp dword [ebp + 0x10], 0
je 0x10007903
and dword [ebp - 0x140], 0
and dword [ebp - 0x13c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1188], eax
and dword [ebp - 0x1184], 0
cmp dword [ebp - 0x1188], 0
jne 0x1000777c
and dword [ebp - 0x118c], 0
jmp 0x100077c5
mov eax, dword [ebp - 0x1188]
movsx eax, byte [eax]
test eax, eax
je 0x100077b9
mov eax, dword [ebp - 0x1188]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x100077a5
mov eax, dword [ebp - 0x1188]
mov dword [ebp - 0x1184], eax
jmp 0x100077b9
push dword [ebp - 0x1188]
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1188], eax
jmp 0x1000777c
mov eax, dword [ebp - 0x1184]
mov dword [ebp - 0x118c], eax
cmp dword [ebp - 0x118c], 0
je 0x100077fa
mov dword [ebp - 0x1168], 0x80020009
lea ecx, [ebp - 0x140]
call fcn.1000730a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000730a
mov eax, dword [ebp - 0x1168]
jmp 0x10007ffa
and dword [ebp - 0x1190], 0
jmp 0x10007810
mov eax, dword [ebp - 0x1190]
inc eax
mov dword [ebp - 0x1190], eax
cmp dword [ebp - 0x1190], 0xc
jge 0x1000783e
mov eax, dword [ebp - 0x1190]
push dword [eax*4 + 0x1001d0f8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000783c
and dword [ebp - 0x1194], 0
jmp 0x10007848
jmp 0x10007803
mov dword [ebp - 0x1194], 1
cmp dword [ebp - 0x1194], 0
je 0x10007891
xor eax, eax
jne 0x10007851
xor eax, eax
jne 0x10007851
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x140], eax
and dword [ebp - 0x13c], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x140]
call fcn.100071a7
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1198], eax
and dword [ebp - 0x140], 0
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x138], 0
je 0x100078f8
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x100078c1
lea ecx, [ebp - 0x140]
call fcn.1000730a
jmp 0x10007fdf
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.1000708f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x100078e8
lea ecx, [ebp - 0x140]
call fcn.1000733e
jmp 0x10007fdf
lea ecx, [ebp - 0x140]
call fcn.1000733e
jmp 0x10007f81
lea ecx, [ebp - 0x140]
call fcn.1000733e
push dword [0x1001d0f0]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10007936
and dword [ebp - 0x10], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007936
jmp 0x10007fdf
push dword [0x1001d0e8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10007b40
lea eax, [ebp - 0x1144]
push eax
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x1000796d
jmp 0x10007fdf
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007989
jmp 0x10007fdf
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x3d
je 0x100079b5
mov dword [ebp - 0x116c], 0x80020009
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000733e
mov eax, dword [ebp - 0x116c]
jmp 0x10007ffa
cmp dword [ebp + 0x10], 0
je 0x10007a70
and dword [ebp - 0x114c], 0
and dword [ebp - 0x1148], 0
mov byte [ebp - 4], 1
xor eax, eax
jne 0x100079d1
xor eax, eax
jne 0x100079d1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114c], eax
and dword [ebp - 0x1148], 0
push dword [ebp + 8]
lea eax, [ebp - 0x1144]
push eax
lea eax, [ebp - 0x114c]
push eax
mov ecx, dword [ebp - 0x4270]
call fcn.100068d8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x114c]
mov dword [ebp - 0x21b4], eax
and dword [ebp - 0x114c], 0
and dword [ebp - 0x1148], 0
cmp dword [ebp - 0x24], 0
jge 0x10007a57
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1170], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x114c]
call fcn.1000733e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000733e
mov eax, dword [ebp - 0x1170]
jmp 0x10007ffa
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x114c]
call fcn.1000733e
jmp 0x10007f81
cmp dword [ebp + 0x14], 0
jne 0x10007b1f
cmp dword [ebp - 0x10], 0
je 0x10007b1f
and dword [ebp - 0x1154], 0
and dword [ebp - 0x1150], 0
push 0x20006
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1154]
call fcn.1000712a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10007af8
xor eax, eax
jne 0x10007ab0
xor eax, eax
jne 0x10007ab0
lea eax, [ebp - 0x1144]
push eax
push dword [ebp - 0x1154]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10007af6
cmp dword [ebp - 0x1c], 2
je 0x10007af6
push dword [ebp - 0x1c]
call fcn.100073eb
pop ecx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1154]
call fcn.1000733e
jmp 0x10007fdf
jmp 0x10007b14
push dword [ebp - 0x1c]
call fcn.100073eb
pop ecx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1154]
call fcn.1000733e
jmp 0x10007fdf
lea ecx, [ebp - 0x1154]
call fcn.1000733e
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.1000708f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007b3b
jmp 0x10007fdf
jmp 0x100076d6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x31e8], eax
and dword [ebp - 0x31e4], 0
cmp dword [ebp - 0x31e8], 0
jne 0x10007b62
and dword [ebp - 0x31ec], 0
jmp 0x10007bab
mov eax, dword [ebp - 0x31e8]
movsx eax, byte [eax]
test eax, eax
je 0x10007b9f
mov eax, dword [ebp - 0x31e8]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x10007b8b
mov eax, dword [ebp - 0x31e8]
mov dword [ebp - 0x31e4], eax
jmp 0x10007b9f
push dword [ebp - 0x31e8]
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x31e8], eax
jmp 0x10007b62
mov eax, dword [ebp - 0x31e4]
mov dword [ebp - 0x31ec], eax
cmp dword [ebp - 0x31ec], 0
je 0x10007bd5
mov dword [ebp - 0x1174], 0x80020009
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000733e
mov eax, dword [ebp - 0x1174]
jmp 0x10007ffa
cmp dword [ebp + 0x10], 0
je 0x10007caf
push 0x2001f
push dword [ebp + 8]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.1000712a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10007c61
push 0x20019
push dword [ebp + 8]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.1000712a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10007c61
push 0
push 0
push 0x2001f
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.100063fb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10007c61
push dword [ebp - 0x1c]
call fcn.100073eb
pop ecx
mov dword [ebp - 0x1178], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000733e
mov eax, dword [ebp - 0x1178]
jmp 0x10007ffa
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007c7d
jmp 0x10007fdf
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x3d
jne 0x10007caa
push dword [ebp + 8]
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x4270]
call fcn.100068d8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007caa
jmp 0x10007fdf
jmp 0x10007f81
cmp dword [ebp + 0x14], 0
jne 0x10007ccd
push 0x20019
push dword [ebp + 8]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.1000712a
mov dword [ebp - 0x1c], eax
jmp 0x10007cd4
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], 0
je 0x10007ce1
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x134]
push eax
call fcn.1000a6c2
add esp, 0x10
mov dword [ebp - 0x322c], eax
push dword [ebp - 0x322c]
call fcn.100022ab
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007d28
jmp 0x10007fdf
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.1000708f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007d44
jmp 0x10007fdf
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x7b
jne 0x10007da4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x10007da4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.1000764d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007d88
cmp dword [ebp + 0x14], 0
jne 0x10007d88
jmp 0x10007fdf
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007da4
jmp 0x10007fdf
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x14], eax
cmp dword [ebp - 0x1c], 2
jne 0x10007db5
jmp 0x100076d6
cmp dword [ebp - 0x1c], 0
je 0x10007dd9
cmp dword [ebp + 0x14], 0
je 0x10007dc8
jmp 0x100076d6
push dword [ebp - 0x1c]
call fcn.100073eb
pop ecx
mov dword [ebp - 0x24], eax
jmp 0x10007fdf
cmp dword [ebp + 0x14], 0
je 0x10007e76
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x423c], eax
push dword [ebp - 0x423c]
mov ecx, dword [ebp - 0x4270]
call fcn.100072c8
test eax, eax
je 0x10007e76
and dword [ebp - 0x4244], 0
jmp 0x10007e17
mov eax, dword [ebp - 0x4244]
inc eax
mov dword [ebp - 0x4244], eax
cmp dword [ebp - 0x4244], 0xc
jge 0x10007e49
mov eax, dword [ebp - 0x4244]
push dword [eax*4 + 0x1001d0f8]
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10007e47
and dword [ebp - 0x4248], 0
jmp 0x10007e53
jmp 0x10007e0a
mov dword [ebp - 0x4248], 1
cmp dword [ebp - 0x4248], 0
je 0x10007e71
cmp dword [ebp - 0x10], 0
je 0x10007e71
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x18]
call fcn.100071a7
jmp 0x100076d6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x424c], eax
push dword [ebp - 0x424c]
mov ecx, dword [ebp - 0x4270]
call fcn.100072c8
mov dword [ebp - 0x1158], eax
and dword [ebp - 0x4254], 0
cmp dword [ebp - 0x18], 0
je 0x10007eb6
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4254], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x4254]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10007eef
push dword [ebp - 0x1c]
call fcn.100073eb
pop ecx
mov dword [ebp - 0x117c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000733e
mov eax, dword [ebp - 0x117c]
jmp 0x10007ffa
cmp dword [ebp - 0x10], 0
je 0x10007f81
cmp dword [ebp - 0x1158], 0
jne 0x10007f81
and dword [ebp - 0x1160], 0
and dword [ebp - 0x115c], 0
xor eax, eax
jne 0x10007f10
xor eax, eax
jne 0x10007f10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1160], eax
and dword [ebp - 0x115c], 0
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x1160]
call fcn.1000736f
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1160]
mov dword [ebp - 0x4260], eax
and dword [ebp - 0x1160], 0
and dword [ebp - 0x115c], 0
cmp dword [ebp - 0x1c], 0
je 0x10007f76
push dword [ebp - 0x1c]
call fcn.100073eb
pop ecx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1160]
call fcn.1000733e
jmp 0x10007fdf
lea ecx, [ebp - 0x1160]
call fcn.1000733e
cmp dword [ebp + 0x10], 0
je 0x10007fda
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x7b
jne 0x10007fda
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x10007fda
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.1000764d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007fc1
jmp 0x10007fdf
push dword [ebp + 8]
mov ecx, dword [ebp - 0x4270]
call fcn.10007451
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x10007fda
jmp 0x10007fdf
jmp 0x100076d6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1180], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000733e
mov eax, dword [ebp - 0x1180]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.10009868
leave
ret 0x10