Function at 0x10104e29
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017508b
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.101642f6
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
xor eax, eax
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
push edi
mov dword [ebp - 4], eax
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
push 0x7d
pop eax
cmp word [edi], ax
je 0x10105415
xor eax, eax
inc eax
push str.Delete
push edi
mov dword [ebp - 0x2224], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x221c], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10104eda
test esi, esi
je 0x10104fa8
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
cmp dword [ebp + 0x10], 0
je 0x10104fa8
xor eax, eax
push 0x5c
push edi
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], eax
call fcn.10108c76
test eax, eax
jne 0x10105405
push edi
mov ecx, ebx
call fcn.100f7d80
test eax, eax
je 0x10104f60
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
mov dword [ebp - 0x223c], eax
xor eax, eax
push edi
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], eax
call fcn.10104a06
xor eax, eax
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], eax
cmp dword [ebp - 0x221c], 0
je 0x10104f9d
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x101053fd
push edi
mov ecx, ebx
call fcn.10108719
lea ecx, [ebp - 0x223c]
mov esi, eax
call fcn.10005a78
test esi, esi
js 0x10105415
jmp 0x10105397
lea ecx, [ebp - 0x223c]
call fcn.10005a78
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10104fd0
push edi
mov ecx, ebx
mov dword [ebp - 0x2224], eax
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
push 0x10184154
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10105103
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10105410
cmp dword [ebp + 0x10], 0
je 0x10105089
xor eax, eax
mov ecx, ebx
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x2250], eax
xor eax, eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2250]
push eax
call fcn.100f6aa8
mov esi, eax
lea ecx, [ebp - 0x2250]
xor eax, eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
call fcn.10005a78
test esi, esi
js 0x10105415
xor eax, eax
mov byte [ebp - 4], al
jmp 0x10105397
cmp dword [ebp + 0x14], 0
jne 0x101050f6
cmp dword [ebp - 0x2224], 0
je 0x101050f6
xor eax, eax
lea ecx, [ebp - 0x2268]
push 0x20006
push eax
push dword [ebp - 0x2220]
mov dword [ebp - 0x2268], eax
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2260], eax
call fcn.100059db
test eax, eax
jne 0x10105440
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2268]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x101050eb
cmp eax, 2
jne 0x10105440
lea ecx, [ebp - 0x2268]
call fcn.10005a78
push edi
mov ecx, ebx
call fcn.10108719
jmp 0x101053e6
push 0x5c
push edi
call fcn.10108c76
test eax, eax
jne 0x10105410
cmp dword [ebp + 0x10], eax
je 0x101051a5
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
push 0x2001f
push edi
push esi
call fcn.100059db
test eax, eax
je 0x1010516e
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2230]
call fcn.100059db
test eax, eax
je 0x1010516e
xor eax, eax
lea ecx, [ebp - 0x2230]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.100f88c2
test eax, eax
jne 0x101052a0
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10105397
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.100f6aa8
mov esi, eax
jmp 0x10104f90
cmp dword [ebp + 0x14], 0
jne 0x101051c4
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
call fcn.100059db
jmp 0x101051c7
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [ebp - 0x221c], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp - 0x218]
push edi
push 0x104
push eax
mov dword [ebp - 0x2240], ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
push eax
call fcn.100e4266
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
push edi
mov ecx, ebx
call fcn.10108719
mov esi, eax
test esi, esi
js 0x10105415
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10105283
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2244]
jne 0x1010522d
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x10105283
push dword [ebp - 0x2240]
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp - 0x2230]
push edi
call fcn.10104e29
mov esi, eax
test esi, esi
jns 0x10105271
cmp dword [ebp - 0x2240], 0
je 0x10105415
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
mov eax, dword [ebp - 0x221c]
cmp eax, 2
je 0x101053ec
test eax, eax
je 0x101052ad
cmp dword [ebp + 0x14], 0
jne 0x101053ec
push eax
call fcn.100f79ea
mov esi, eax
jmp 0x10105415
cmp dword [ebp + 0x14], 0
je 0x101052fe
push dword [ebp - 0x2230]
mov ecx, ebx
call fcn.100fea37
test eax, eax
je 0x101052fe
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.100f7d80
test eax, eax
je 0x101053ec
cmp dword [ebp - 0x2224], 0
je 0x101053ec
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.10104a06
jmp 0x101053ec
push dword [ebp - 0x2230]
mov ecx, ebx
call fcn.100fea37
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x221c], eax
call fcn.10005a78
test eax, eax
jne 0x101052a0
cmp dword [ebp - 0x2224], eax
je 0x101053ec
cmp dword [ebp - 0x221c], eax
jne 0x101053ec
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x225c]
mov dword [ebp - 0x225c], eax
xor eax, eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
lea eax, [ebp - 0x218]
push eax
call fcn.100e5956
mov dword [ebp - 0x221c], eax
lea ecx, [ebp - 0x225c]
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
call fcn.10005a78
mov eax, dword [ebp - 0x221c]
test eax, eax
jne 0x101052a0
cmp dword [ebp + 0x10], 0
je 0x101053ec
push 0x7b
pop eax
cmp word [edi], ax
jne 0x101053ec
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2244]
jne 0x101053aa
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x101053ef
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2230]
push edi
call fcn.10104e29
mov esi, eax
test esi, esi
js 0x10105415
push edi
mov ecx, ebx
call fcn.10101de2
mov esi, eax
test esi, esi
js 0x10105415
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [edi], cx
jne 0x10104ea5
jmp 0x10105415
lea ecx, [ebp - 0x223c]
jmp 0x1010544e
lea ecx, [ebp - 0x223c]
call fcn.10005a78
mov esi, 0x80020009
lea ecx, [ebp - 0x2230]
call fcn.10005a78
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100042bb
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.100f79ea
mov esi, eax
lea ecx, [ebp - 0x2268]
call fcn.10005a78
jmp 0x10105415