Function at 0x1001ac40
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, edx
push edi
lea eax, [ecx + esi]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x1001b0a1
ja 0x1001b0a1
cmp byte [eax - 1], 0
jne 0x1001b0a1
push 0x2000
call fcn.100455ea
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
je 0x1001b0a1
push ebx
xor ebx, ebx
lea eax, [edi + 0x1000]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x1001b08f
nop word [eax + eax]
mov cl, byte [esi]
test cl, cl
je 0x1001b08f
mov al, cl
nop dword [eax]
cmp al, 0xd
je 0x1001acc2
cmp al, 0xa
je 0x1001acc2
cmp al, 0x20
je 0x1001acc2
mov cl, al
cmp al, 9
jne 0x1001accc
mov cl, byte [esi + 1]
inc esi
mov al, cl
test cl, cl
jne 0x1001acb0
test cl, cl
je 0x1001b08f
cmp cl, 0x5b
jne 0x1001b08f
inc esi
cmp dword [esi], 0x4d4c4b48
je 0x1001ad6b
push 0x12
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.10046116
add esp, 0xc
test eax, eax
je 0x1001ad6b
cmp dword [esi], 0x52434b48
je 0x1001ad64
push 0x11
push str.HKEY_CLASSES_ROOT
push esi
call fcn.10046116
add esp, 0xc
test eax, eax
je 0x1001ad64
cmp dword [esi], 0x55434b48
je 0x1001ad5d
push 0x11
push str.HKEY_CURRENT_USER
push esi
call fcn.10046116
add esp, 0xc
test eax, eax
je 0x1001ad5d
cmp dword [esi], 0x52535548
je 0x1001ad56
push 0xa
push str.HKEY_USERS
push esi
call fcn.10046116
add esp, 0xc
test eax, eax
jne 0x1001b08f
mov ebx, 0x80000003
jmp 0x1001ad70
mov ebx, 0x80000001
jmp 0x1001ad70
mov ebx, 0x80000000
jmp 0x1001ad70
mov ebx, 0x80000002
push 0x5c
push esi
call fcn.1002b1c0
mov esi, eax
add esp, 8
test esi, esi
je 0x1001b08c
inc esi
push 0x5d
push esi
call fcn.1002b1c0
mov edi, eax
add esp, 8
test edi, edi
je 0x1001b089
inc edi
mov eax, edi
sub eax, esi
cmp eax, 0x1000
jg 0x1001b089
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movzx eax, word [edi]
mov ecx, 0xd0a
cmp ax, cx
je 0x1001ade0
mov ecx, 0xa0d
cmp ax, cx
je 0x1001ade0
cmp al, 0xd
je 0x1001add9
cmp al, 0xa
jne 0x1001b089
mov eax, 1
jmp 0x1001ade5
mov eax, 2
push 0
lea esi, [eax + edi]
mov edi, dword [ebp - 8]
push edi
push ebx
call fcn.10028a50
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xc], 0
je 0x1001b08c
mov ebx, 1
mov ecx, 0xa0d
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x1001af14
movzx eax, word [esi]
cmp ax, cx
je 0x1001af14
mov ecx, 0x3d40
cmp ax, cx
jne 0x1001ae41
push 0x1007efc0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1001ae83
cmp al, 0x22
jne 0x1001af0f
inc esi
push 0x10082b6c
push esi
mov edi, esi
call fcn.1002d6e0
mov esi, eax
add esp, 8
test esi, esi
je 0x1001af14
mov ecx, esi
sub ecx, edi
lea edx, [ecx + 1]
cmp ecx, 0x1000
jge 0x1001af0f
push edx
push edi
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, 2
mov ebx, esi
cmp byte [esi], 0x22
jne 0x1001aed1
lea edi, [esi + 1]
push 0x22
push edi
call fcn.1002b1c0
mov esi, eax
add esp, 8
test esi, esi
je 0x1001af0f
sub eax, edi
lea ecx, [eax + 1]
cmp eax, 0x1000
jge 0x1001af0f
mov ebx, dword [ebp - 0x10]
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call fcn.10029180
cmp eax, 1
jne 0x1001af0f
inc esi
jmp 0x1001b02a
push 6
push str.dword:
push esi
call fcn.10046116
add esp, 0xc
test eax, eax
jne 0x1001af3b
lea eax, [ebp - 0x18]
add esi, 6
push eax
push 0x10081140
push esi
call fcn.1000102f
add esp, 0xc
push dword [ebp - 0x18]
push edi
push dword [ebp - 0xc]
call fcn.10029150
cmp eax, 1
je 0x1001b02a
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
cmp esi, dword [ebp - 0x14]
jb 0x1001aca0
push edi
call fcn.100455e5
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 8
push str.MultString
push esi
call fcn.10046116
add esp, 0xc
test eax, eax
je 0x1001b02a
push 4
push str.hex_
push ebx
mov esi, ebx
call fcn.10046116
add esp, 0xc
test eax, eax
je 0x1001b02a
push 4
push str.hex:
push ebx
call fcn.10046116
add esp, 0xc
test eax, eax
jne 0x1001b00a
push 0xd
push ebx
lea edi, [ebx + 4]
call fcn.1002b1c0
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1001b07b
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x2ee0
jge 0x1001b07b
xor esi, esi
cmp edi, eax
jae 0x1001afe7
cmp esi, 0x1000
ja 0x1001afe2
lea eax, [ebp - 0x1c]
push eax
push str._02X
push edi
call fcn.1000102f
mov ecx, dword [ebp - 0x10]
add edi, 3
mov al, byte [ebp - 0x1c]
add esp, 0xc
mov byte [esi + ecx], al
inc esi
cmp edi, dword [ebp - 0x20]
jb 0x1001afb4
jmp 0x1001afe7
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [ebp - 8]
push esi
push dword [ebp - 0x10]
push edi
push dword [ebp - 0xc]
call fcn.100290f0
mov esi, ebx
cmp eax, 1
je 0x1001b02a
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], eax
jmp 0x1001af14
push 4
push str.dele
push ebx
call fcn.10046116
add esp, 0xc
test eax, eax
jne 0x1001b07b
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ebx
push 0xd
push esi
call fcn.1002b1c0
add esp, 8
test eax, eax
jne 0x1001b04c
push 0xa
push esi
call fcn.1002b1c0
add esp, 8
test eax, eax
je 0x1001af0f
mov cl, byte [eax + 1]
inc eax
cmp cl, 0xd
je 0x1001b05a
cmp cl, 0xa
jne 0x1001b05b
inc eax
mov ebx, dword [ebp - 4]
mov ecx, 0xa0d
mov esi, eax
cmp word [eax], cx
je 0x1001af14
test ebx, ebx
jne 0x1001ae14
jmp 0x1001af14
xor eax, eax
mov esi, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
jmp 0x1001af14
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
push edi
call fcn.100455e5
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret