Function at 0x10002896
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x1000fd43
call fcn.1000f098
sub esp, 0x420
and dword [ebp - 0x10], 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jge 0x100028ce
jmp 0x10002c30
cmp word [ebx], 0x7d
push edi
je 0x10002c2d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x18], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x10002905
test edi, edi
je 0x10002971
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
cmp dword [ebp + 0x10], 0
je 0x10002971
push 0x5c
mov eax, ebx
call fcn.10002621
test eax, eax
pop ecx
jne 0x10002cfb
push ebx
call fcn.1000320c
test eax, eax
je 0x1000294a
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.10003238
test edi, edi
je 0x10002971
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.1000318e
jmp 0x10002b52
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10002998
and dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
push 0x10012c80
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10002ac0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x42c]
call fcn.1000275f
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x10002c1e
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
cmp esi, edi
jl 0x10002c1e
cmp word [ebx], 0x3d
jne 0x10002cbe
cmp dword [ebp + 0x10], edi
je 0x10002a65
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [ebp + 8], eax
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
call fcn.10002d67
mov esi, eax
cmp esi, edi
jl 0x10002cc3
mov byte [ebp - 4], 0
cmp word [ebx], 0x7b
jne 0x10002a56
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10002a56
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ebx
call fcn.10002896
mov esi, eax
test esi, esi
jl 0x10002c1e
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
cmp word [ebx], 0x7d
jne 0x100028d9
jmp 0x10002c1e
cmp dword [ebp + 0x14], edi
jne 0x10002ab4
cmp dword [ebp - 0x18], edi
je 0x10002ab4
push 0x20006
push edi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.100016ac
cmp eax, edi
jne 0x10002cdd
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x42c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10002aa9
cmp eax, 2
jne 0x10002ccb
test edi, edi
je 0x10002ab4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.1000318e
jmp 0x10002a4c
push 0x5c
mov eax, ebx
call fcn.10002621
test eax, eax
pop ecx
jne 0x10002cfb
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x10002b61
push 0x2001f
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.100016ac
test eax, eax
je 0x10002b25
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.100016ac
test eax, eax
je 0x10002b25
push esi
push 0x2001f
push esi
push esi
push ebx
push dword [ebp + 0xc]
xor edi, edi
lea eax, [ebp - 0x10]
call fcn.10002d1e
cmp eax, esi
jne 0x10002c17
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
cmp word [ebx], 0x3d
jne 0x10002a15
push ebx
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.10002d67
mov esi, eax
test esi, esi
jl 0x10002c1e
jmp 0x10002a15
cmp dword [ebp + 0x14], esi
jne 0x10002b7c
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.100016ac
mov dword [ebp + 8], eax
jmp 0x10002b83
mov dword [ebp + 8], 2
cmp dword [ebp + 8], esi
je 0x10002b8f
mov dword [ebp + 0x14], 1
push 0x104
push ebx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.1000318e
mov esi, eax
test esi, esi
jl 0x10002c1e
cmp word [ebx], 0x7b
jne 0x10002bf5
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
push ebx
call fcn.10002896
mov esi, eax
test esi, esi
jge 0x10002be5
cmp dword [ebp + 0x14], 0
je 0x10002c1e
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.1000275f
mov esi, eax
test esi, esi
jl 0x10002c1e
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0x14], eax
je 0x10002a56
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
je 0x10002c40
cmp dword [ebp - 0x1c], edi
jne 0x10002a56
call fcn.100032fc
mov esi, eax
cmp dword [ebp - 0x10], 0
je 0x10002c2d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
cmp dword [ebp - 0x1c], edi
je 0x10002c83
push dword [ebp - 0x10]
call fcn.100031d7
test eax, eax
je 0x10002c83
lea eax, [ebp - 0x224]
push eax
call fcn.1000320c
test eax, eax
je 0x10002a56
cmp dword [ebp - 0x18], 0
je 0x10002a56
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x10]
call fcn.10003238
jmp 0x10002a56
cmp dword [ebp - 0x10], edi
je 0x10002c98
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov dword [ebp - 0x10], edi
jne 0x10002d14
cmp dword [ebp - 0x18], edi
je 0x10002a56
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x10002c17
jmp 0x10002a56
cmp dword [ebp - 0x10], edi
jmp 0x10002cff
cmp dword [ebp - 0x10], edi
jmp 0x10002c22
call fcn.100032fc
test edi, edi
mov esi, eax
je 0x10002c1e
push edi
jmp 0x10002cf0
call fcn.100032fc
cmp dword [ebp + 8], edi
mov esi, eax
je 0x10002c1e
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10002c1e
cmp dword [ebp - 0x10], 0
je 0x10002d0a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x10002c2f
call fcn.100032fc
jmp 0x10002c2f