Function at 0xbb8640
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0xa
lea eax, [ebp - 0x18]
mov edx, 0xb2c6c0
push eax
push 2
push 0xb2c714
mov ecx, reloc.SHCORE.dll_Ordinal_1
xor ebx, ebx
call fcn.00bbc0f1
test eax, eax
js 0xbb8684
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrToIntW]
mov ebx, eax
push 0
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0xc
push eax
push 0xc
push 0x42
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
test eax, eax
je 0xbb871a
push esi
push 0x104
lea eax, [ebp - 0x220]
mov edx, 0xb2c630
push eax
push 2
push 0xb2c694
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00bbc0f1
test eax, eax
jns 0xc170f1
test byte [ebp - 0x434], 1
jne 0xc17104
xor eax, eax
mov word [ebp - 0x220], ax
test bl, 1
jne 0xbb8729
xor bl, bl
test byte [ebp - 0x434], 1
jne 0xbb872d
xor bh, bh
lea edx, [ebp - 0x429]
lea ecx, [ebp - 0x439]
call fcn.00bb8731
test eax, eax
jns 0xc172e4
cmp bl, bh
jne 0xc172f3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0xbb86ed
mov bh, 1
jmp 0xbb86f8
cmp word [ebp - 0x220], 0
jne 0xc171f1
jmp 0xbb86d0
push 0x104
lea eax, [ebp - 0x220]
mov edx, 0xb2dc68
push eax
push 2
push 0xb28090
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00bbc0f1
test eax, eax
js 0xbb86dd
cmp word [ebp - 0x220], 0
je 0xbb86dd
push 0xb3e34c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xbb86dd
push 0xb3e370
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xbb86dd
push 0xb3e394
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xbb86dd
push 0xb3e3b8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
je 0xbb86dd
lea ecx, [ebp - 0x220]
mov esi, 0xb3e394
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0xc171d8
movzx eax, word [esi + ecx]
test ax, ax
je 0xc171d8
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0xc171b8
jmp 0xc171dc
test edx, edx
jne 0xc171df
sub ecx, 2
xor eax, eax
mov word [ecx], ax
cmp word [ebp - 0x220], ax
je 0xbb86e6
mov eax, dword [ebp - 0x434]
test al, 1
je 0xc17253
mov ecx, dword [ebp - 0x430]
test ecx, ecx
je 0xc17253
lea eax, [ebp - 0x220]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpIW]
test eax, eax
je 0xc1727b
push 0
push 0x104
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_string_l2_1_1.dll_SHLoadIndirectString]
test eax, eax
js 0xc1724d
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x430]
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpIW]
test eax, eax
je 0xc1727b
mov eax, dword [ebp - 0x434]
or eax, 1
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x220]
push 3
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x438]
push eax
push 0xc
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
push 0xb2c694
push 0xb2c630
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
lea eax, [ebp - 0x440]
push eax
push 0xb3e640
push 3
push 0
push 0xb47328
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0xbb8719
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x60]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xbb8719
cmp bh, byte [ebp - 0x429]
je 0xc172f3
xor dword [ebp - 0x434], 1
push 3
lea eax, [ebp - 0x438]
push eax
push 0xc
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
jmp 0xbb8719