Function at 0x18015fbd
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x225c
call fcn.18168e80
mov eax, dword [0x181c7008]
xor eax, esp
mov dword [esp + 0x2258], eax
mov eax, ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [esp + 8], ecx
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov ecx, eax
mov dword [esp + 0xc], eax
jmp 0x1801644c
push str.Delete
push edi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x1817dc80
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18016034
test ebx, ebx
je 0x180160de
mov ecx, dword [esp + 0xc]
push edi
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x180160e0
push 0x5c
pop edx
mov ecx, edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.18015566
test eax, eax
jne 0x1801646c
push edi
call fcn.18015af3
test eax, eax
je 0x18016099
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push edi
mov dword [esp + 0x28], eax
call fcn.18014faa
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
test ebx, ebx
je 0x180160d3
mov ebx, dword [esp + 0xc]
mov ecx, ebx
push edi
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x18016466
push edi
mov ecx, ebx
call fcn.18015b57
mov esi, eax
lea ecx, [esp + 0x24]
call fcn.18014ed3
test esi, esi
js 0x1801647a
jmp 0x18016419
lea ecx, [esp + 0x24]
call fcn.18014ed3
jmp 0x180160e0
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [esp + 0xc]
test eax, eax
jne 0x1801610a
push edi
mov ecx, ebx
mov dword [esp + 0x18], esi
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
push 0x1817dc78
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18016206
lea eax, [esp + 0x260]
mov ecx, ebx
push eax
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
push edi
mov ecx, ebx
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x18016475
cmp dword [ebp + 0x10], 0
je 0x1801619b
mov eax, dword [esp + 0x10]
mov ecx, ebx
and dword [esp + 0x38], 0
and dword [esp + 0x3c], 0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x260]
push edi
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.18015726
mov esi, eax
lea ecx, [esp + 0x34]
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
jmp 0x180160c1
cmp dword [ebp + 0x14], 0
jne 0x180161f9
cmp dword [esp + 0x14], 0
je 0x180161f9
xor eax, eax
lea ecx, [esp + 0x40]
push 0x20006
push eax
push dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call fcn.18014f4e
test eax, eax
jne 0x1801649c
lea eax, [esp + 0x260]
push eax
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x180161f0
cmp eax, 2
jne 0x1801649c
lea ecx, [esp + 0x40]
call fcn.18014ed3
push edi
mov ecx, ebx
call fcn.18015b57
jmp 0x18016452
push 0x5c
pop edx
mov ecx, edi
call fcn.18015566
test eax, eax
jne 0x18016475
cmp dword [ebp + 0x10], eax
je 0x18016293
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 0x2001f
push edi
push esi
call fcn.18014f4e
test eax, eax
je 0x1801625f
push 0x20019
push edi
push esi
lea ecx, [esp + 0x24]
call fcn.18014f4e
test eax, eax
je 0x1801625f
sub esp, 0x14
lea ecx, [esp + 0x2c]
push edi
push esi
call fcn.18014eed
test eax, eax
jne 0x180164bd
push edi
mov ecx, ebx
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x18016419
push edi
push 0
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.18015726
mov esi, eax
jmp 0x180160c6
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x180162b1
push 0x20019
push edi
push dword [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.18014f4e
mov ebx, eax
jmp 0x180162b4
push 2
pop ebx
mov dword [esp + 0x30], esi
test ebx, ebx
je 0x180162c4
mov dword [esp + 0x30], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x60]
push 0x104
push eax
call fcn.181503cf
push eax
call fcn.180044d7
mov ecx, dword [esp + 0x20]
add esp, 0x14
push edi
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
mov ecx, dword [esp + 0xc]
push edi
call fcn.18015b57
mov esi, eax
test esi, esi
js 0x1801647a
push 0x7b
pop eax
cmp word [edi], ax
jne 0x18016354
push edi
call fcn.181482a3
pop ecx
cmp eax, 1
jne 0x18016354
push dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push 0
push dword [esp + 0x20]
push edi
call fcn.18015fbd
mov esi, eax
test esi, esi
jns 0x18016340
cmp dword [esp + 0x30], 0
je 0x1801647a
mov ecx, dword [esp + 0xc]
push edi
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
cmp ebx, 2
je 0x18016458
test ebx, ebx
je 0x18016379
cmp dword [ebp + 0x14], 0
jne 0x18016458
mov ecx, ebx
call fcn.18014b72
mov esi, eax
jmp 0x1801647a
cmp dword [ebp + 0x14], 0
je 0x180163bc
push dword [esp + 0x18]
call fcn.18015b22
test eax, eax
je 0x180163bc
lea eax, [esp + 0x58]
push eax
call fcn.18015af3
test eax, eax
je 0x18016458
cmp dword [esp + 0x14], 0
je 0x18016458
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x1c]
call fcn.18014faa
jmp 0x18016458
push dword [esp + 0x18]
call fcn.18015b22
lea ecx, [esp + 0x18]
mov ebx, eax
call fcn.18014ed3
test eax, eax
jne 0x180164bd
cmp dword [esp + 0x14], eax
je 0x18016458
test ebx, ebx
jne 0x18016458
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.18014e5a
mov dword [esp + 0x4c], ebx
test eax, eax
jne 0x180164b0
lea ecx, [esp + 0x4c]
call fcn.18014ed3
mov ebx, dword [esp + 0xc]
cmp dword [ebp + 0x10], 0
je 0x18016458
push 0x7b
pop eax
cmp word [edi], ax
jne 0x18016458
push edi
call fcn.181482a3
pop ecx
cmp eax, 1
jne 0x18016458
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [esp + 0x20]
push edi
call fcn.18015fbd
mov esi, eax
test esi, esi
js 0x1801647a
mov ecx, ebx
push edi
call fcn.180155cb
mov esi, eax
test esi, esi
js 0x1801647a
push 0x7d
pop eax
cmp word [edi], ax
jne 0x18016003
jmp 0x1801647a
lea ecx, [esp + 0x24]
jmp 0x180164a9
lea ecx, [esp + 0x24]
call fcn.18014ed3
mov esi, 0x80020009
lea ecx, [esp + 0x18]
call fcn.18014ed3
mov ecx, dword [esp + 0x2264]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18141824
mov esp, ebp
pop ebp
ret 0x10
mov ecx, eax
call fcn.18014b72
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.18014ed3
jmp 0x1801647a
mov ecx, eax
call fcn.18014b72
lea ecx, [esp + 0x4c]
jmp 0x180164a7
mov ecx, eax
jmp 0x1801636d