Function at 0x10003b84
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1108]
mov eax, 0x1108
call fcn.1000c210
push 0xffffffffffffffff
push 0x1002abe5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10041024]
xor eax, ebp
mov dword [ebp + 0x1104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x1114]
mov edi, dword [ebp + 0x1110]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push edi
mov dword [ebp - 4], eax
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
cmp byte [edi], 0x7d
je 0x1000406c
xor eax, eax
inc eax
push 0x1002f070
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
neg eax
push 0x1002f058
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
je 0x10003c2b
test esi, esi
je 0x10003cca
push edi
mov ecx, ebx
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
xor esi, esi
cmp dword [ebp + 0x1118], esi
je 0x10003ccc
push 0x5c
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.100045dd
pop ecx
pop ecx
test eax, eax
jne 0x1000405f
push edi
mov ecx, ebx
call fcn.10002d4d
test eax, eax
je 0x10003c8a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x30], eax
call fcn.10003626
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x14], esi
je 0x10003cc0
push edi
mov ecx, ebx
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000405a
push edi
mov ecx, ebx
call fcn.1002128b
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.10002ded
test esi, esi
js 0x1000406c
jmp 0x10004002
lea ecx, [ebp - 0x30]
call fcn.10002ded
jmp 0x10003ccc
xor esi, esi
push 0x1002f064
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x10003cf1
push edi
mov ecx, ebx
mov dword [ebp - 0x18], esi
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
push 0x1002f054
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x10003de4
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
push edi
mov ecx, ebx
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
cmp byte [edi], 0x3d
jne 0x10004067
cmp dword [ebp + 0x1118], 0
je 0x10003d82
and dword [ebp - 0x3c], 0
xor eax, eax
and dword [ebp - 0x38], 0
inc eax
mov byte [ebp - 4], al
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp]
push edi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100025c8
mov esi, eax
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
test esi, esi
js 0x100040a7
mov byte [ebp - 4], al
jmp 0x10003ffd
cmp dword [ebp + 0x111c], 0
jne 0x10003dd7
cmp dword [ebp - 0x18], 0
je 0x10003dd7
xor eax, eax
lea ecx, [ebp - 0x4c]
push 0x20006
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
call fcn.1002128b
test eax, eax
jne 0x1000409b
lea eax, [ebp]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x10003dcf
cmp eax, 2
jne 0x1000409b
lea ecx, [ebp - 0x4c]
call fcn.10002ded
push edi
mov ecx, ebx
call fcn.1002128b
jmp 0x10004046
push 0x5c
push edi
call fcn.100045dd
pop ecx
pop ecx
test eax, eax
jne 0x10004067
cmp dword [ebp + 0x1118], eax
je 0x10003e74
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
push 0x2001f
push edi
push esi
call fcn.1002128b
test eax, eax
je 0x10003e44
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x24]
call fcn.1002128b
test eax, eax
je 0x10003e44
xor eax, eax
lea ecx, [ebp - 0x24]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.1002128b
test eax, eax
jne 0x10003f51
push edi
mov ecx, ebx
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
cmp byte [edi], 0x3d
jne 0x10004002
push edi
push 0
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.100025c8
mov esi, eax
jmp 0x10003cb3
cmp dword [ebp + 0x111c], 0
jne 0x10003e90
push 0x20019
push edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.1002128b
jmp 0x10003e93
push 2
pop eax
mov ecx, dword [ebp + 0x111c]
test eax, eax
push 1
mov dword [ebp - 0x14], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp + 0x1000]
push edi
push 0x104
push eax
mov dword [ebp - 0x34], ecx
call fcn.1002128b
push eax
call fcn.10002c96
add esp, 0x14
mov ecx, ebx
push edi
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
push edi
mov ecx, ebx
call fcn.1002128b
mov esi, eax
test esi, esi
js 0x1000406c
cmp byte [edi], 0x7b
jne 0x10003f34
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003ef2
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x10003f34
push dword [ebp - 0x34]
mov ecx, ebx
push 0
push dword [ebp - 0x24]
push edi
call fcn.10003b84
mov esi, eax
test esi, esi
jns 0x10003f22
cmp dword [ebp - 0x34], 0
je 0x1000406c
push edi
mov ecx, ebx
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x1000404c
test eax, eax
je 0x10003f5f
cmp dword [ebp + 0x111c], 0
jne 0x1000404c
push eax
call fcn.10002ce5
pop ecx
mov esi, eax
jmp 0x1000406c
cmp dword [ebp + 0x111c], 0
je 0x10003faa
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.1002128b
test eax, eax
je 0x10003faa
lea eax, [ebp + 0x1000]
mov ecx, ebx
push eax
call fcn.10002d4d
test eax, eax
je 0x1000404c
cmp dword [ebp - 0x18], 0
je 0x1000404c
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x24]
call fcn.10003626
jmp 0x1000404c
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.1002128b
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
call fcn.10002ded
test eax, eax
jne 0x10003f51
cmp dword [ebp - 0x18], eax
je 0x1000404c
cmp dword [ebp - 0x14], eax
jne 0x1000404c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x58]
and dword [ebp - 0x54], 0
and dword [ebp - 0x50], 0
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x1000]
push eax
call fcn.10002e76
and dword [ebp - 0x58], 0
test eax, eax
jne 0x100040ae
lea ecx, [ebp - 0x58]
call fcn.10002ded
cmp dword [ebp + 0x1118], 0
je 0x1000404c
cmp byte [edi], 0x7b
jne 0x1000404c
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004015
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x1000404f
push 0
push dword [ebp + 0x1118]
mov ecx, ebx
push dword [ebp - 0x24]
push edi
call fcn.10003b84
mov esi, eax
test esi, esi
js 0x1000406c
push edi
mov ecx, ebx
call fcn.10003203
mov esi, eax
test esi, esi
js 0x1000406c
xor eax, eax
inc eax
cmp byte [edi], 0x7d
jne 0x10003bfc
jmp 0x1000406c
lea ecx, [ebp - 0x30]
jmp 0x100040a7
lea ecx, [ebp - 0x30]
call fcn.10002ded
mov esi, 0x80020009
lea ecx, [ebp - 0x24]
call fcn.10002ded
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1104]
xor ecx, ebp
call fcn.1000be90
add ebp, 0x1108
leave
ret 0x10
push eax
call fcn.10002ce5
pop ecx
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.10002ded
jmp 0x1000406c
push eax
call fcn.10002ce5
pop ecx
lea ecx, [ebp - 0x58]
jmp 0x100040a5