Function at 0x1d75fac
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x1d75fdd
mov esi, 0x100
push esi
push ebx
call fcn.01e79cee
add esp, 8
cmp eax, esi
je 0x1d7606b
cmp byte [0x1f0f364], 0
jne 0x1d75fef
call fcn.01d764df
test al, al
je 0x1d7606b
xor edi, edi
cmp byte [0x1f0f365], 1
mov edx, dword [ebp + 0x10]
mov esi, 0
adc esi, 1
mov eax, dword [ebp + 8]
test eax, eax
cmovne esi, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], edi
test ebx, ebx
je 0x1d7603b
lea ecx, [ebp - 0x30]
push ebx
mov ebx, edx
call fcn.01cdab1e
lea ecx, [ebp - 0x30]
call fcn.01d7664b
mov ecx, esi
mov edx, ebx
lea eax, [ebp - 0x30]
push eax
call fcn.01d7676f
add esp, 4
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
lea edi, [ebp - 0x54]
mov ecx, edi
mov edx, esi
call fcn.01d76911
cmp byte [ebp - 0x31], 0
js 0x1d76072
mov word [ebp - 0x3c], 0
mov byte [ebp - 0x31], 0
jmp 0x1d76081
xor ebx, ebx
jmp 0x1d76497
mov eax, dword [ebp - 0x3c]
mov word [eax], 0
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x44]
cmp ebx, esi
je 0x1d76099
add ebx, 0xfffffff4
push ebx
call fcn.01cd55c9
add esp, 4
jmp 0x1d76087
mov dword [ebp - 0x44], esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
movzx eax, word [0x1f0f366]
or ax, word [0x1f0f566]
je 0x1d760cf
movzx eax, byte [ebp - 0x49]
test al, al
jns 0x1d760c2
mov eax, dword [ebp - 0x50]
dec eax
lea ecx, [ebp - 0x1c]
push eax
push 1
push edi
call fcn.01d74a48
lea eax, [ebp - 0x30]
movzx edx, byte [eax + 0xb]
test dl, dl
cmovs edx, dword [eax + 4]
cmovs eax, dword [eax]
lea esi, [ebp - 0x1c]
mov ecx, esi
push edx
push eax
call fcn.01d74480
mov dword [ebp - 0x20], 0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1d76100
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
test eax, eax
je 0x1d761a1
xor ecx, ecx
xor ebx, ebx
cmp word [esi + ecx*2], 0x5c
je 0x1d7611d
add ebx, 0xfffffffe
inc ecx
cmp eax, ecx
jne 0x1d7610c
jmp 0x1d76191
cmp esi, ebx
je 0x1d76191
cmp ebx, 2
je 0x1d76191
neg ebx
xor esi, esi
sar ebx, 1
mov eax, ebx
sub eax, esi
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea edi, [ebp - 0x1c]
push edi
call fcn.01d76fe6
lea esi, [ebx + 1]
mov dword [ebp - 0x20], esi
movzx eax, byte [ebp - 0x11]
mov ecx, edi
test al, al
jns 0x1d7615d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp eax, esi
jbe 0x1d7618a
lea edi, [ebp - 0x54]
je 0x1d76191
lea edx, [ebx + ebx]
sub ebx, eax
inc ebx
cmp word [ecx + edx + 2], 0x5c
je 0x1d7617c
add edx, 2
inc ebx
jne 0x1d7616c
jmp 0x1d76191
lea ebx, [edx + 2]
add ecx, ebx
je 0x1d76191
cmp edx, 0xfffffffc
jne 0x1d7612a
jmp 0x1d76191
test eax, eax
lea edi, [ebp - 0x54]
je 0x1d761a1
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x48]
push eax
push edx
call fcn.01d770ee
movzx eax, word [0x1f0f366]
or ax, word [0x1f0f566]
je 0x1d76264
xor eax, eax
lea ecx, [ebp - 0x1c]
push str.REGISTRYUSER_
push 0xe
push eax
call fcn.01d74b98
xor ecx, ecx
cmp eax, 1
mov edx, 0
adc edx, 2
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 2
imul eax, eax, 0xaaaaaaab
mov dword [ebp - 0x5c], edx
cmp eax, edx
mov edi, dword [ebp + 0x10]
jb 0x1d76272
xor edi, edi
lea esi, [ebp - 0x3c]
mov ecx, esi
push 0x5c
call fcn.01d748c4
xor ebx, ebx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, ebx
jbe 0x1d764ae
movzx edx, byte [eax + edi + 0xb]
test dl, dl
jns 0x1d7622c
mov edx, dword [eax + edi + 4]
mov eax, dword [eax + edi]
jmp 0x1d7622e
add eax, edi
mov ecx, esi
push edx
push eax
call fcn.01d74480
mov ecx, esi
push 0x5c
call fcn.01d748c4
inc ebx
add edi, 0xc
cmp dword [ebp - 0x5c], ebx
jne 0x1d76201
lea ecx, [ebp - 0x48]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x5c]
lea edx, [edx + edx*2]
lea edx, [eax + edx*4]
lea esi, [ebp - 0x24]
push edx
push eax
push esi
call fcn.01d771f0
jmp 0x1d7626d
lea ecx, [ebp - 0x3c]
push edi
call fcn.01cd2db4
mov cl, 1
mov edi, dword [ebp + 0x10]
cmp byte [ebp - 0x11], 0
jns 0x1d76287
push dword [ebp - 0x1c]
mov esi, ecx
call fcn.01e5f36c
mov ecx, esi
add esp, 4
cmp byte [ebp - 0x49], 0
jns 0x1d7629c
push dword [ebp - 0x54]
mov esi, ecx
call fcn.01e5f36c
mov ecx, esi
add esp, 4
test cl, cl
je 0x1d763ff
lea eax, [ebp - 0x20]
mov dword [eax], 0xffffffff
lea ecx, [ebp - 0x3c]
mov edx, edi
push 0
push eax
call fcn.01d769b0
add esp, 8
test eax, eax
js 0x1d763ff
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
sub eax, ecx
je 0x1d76403
sar eax, 2
imul esi, eax, 0xaaaaaaab
push dword [ebp - 0x20]
call sub.ntdll.dll_NtClose
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi - 1]
mov dword [ebp - 0x68], eax
cmp esi, 1
mov dword [ebp - 0x64], esi
adc esi, edi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0
xor ebx, ebx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, ebx
jbe 0x1d764ae
movzx edx, byte [eax + edi + 0xb]
test dl, dl
jns 0x1d76336
mov edx, dword [eax + edi + 4]
mov eax, dword [eax + edi]
jmp 0x1d76338
add eax, edi
lea esi, [ebp - 0x3c]
mov ecx, esi
push edx
push eax
call fcn.01d74480
mov ecx, esi
push 0x5c
call fcn.01d748c4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x58], 0xffffffff
cmp byte [ebp - 0x31], 0
mov eax, esi
jns 0x1d76366
mov eax, dword [ebp - 0x3c]
lea esi, [ebp - 0x54]
mov ecx, esi
push eax
call fcn.01cd2ef8
mov ecx, esi
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.01d769b0
add esp, 8
mov esi, eax
cmp byte [ebp - 0x49], 0
jns 0x1d76399
push dword [ebp - 0x54]
call fcn.01e5f36c
add esp, 4
test esi, esi
js 0x1d7643f
cmp dword [ebp - 0x68], ebx
jne 0x1d763ae
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x20], eax
jmp 0x1d763e7
cmp dword [ebp - 0x24], 1
jne 0x1d763ce
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jae 0x1d763d8
test eax, eax
je 0x1d764cc
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
add eax, 4
jmp 0x1d763e4
push dword [ebp - 0x58]
call sub.ntdll.dll_NtClose
jmp 0x1d763e7
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x58]
push eax
call fcn.01cd9258
mov dword [ebp - 0x18], eax
inc ebx
cmp ebx, dword [ebp - 0x64]
setae al
mov dword [ebp - 0x5c], eax
add edi, 0xc
cmp dword [ebp - 0x60], ebx
jne 0x1d7630b
jmp 0x1d76413
xor ebx, ebx
jmp 0x1d76468
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov al, 1
mov dword [ebp - 0x5c], eax
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
cmp esi, edi
je 0x1d76429
push dword [esi]
call sub.ntdll.dll_NtClose
add esi, 4
jmp 0x1d76419
mov ebx, dword [ebp - 0x5c]
test bl, 1
je 0x1d7645b
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x20]
test ecx, ecx
je 0x1d76455
mov dword [ecx], eax
jmp 0x1d7645b
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
cmp esi, edi
je 0x1d76413
push dword [esi]
call sub.ntdll.dll_NtDeleteKey
add esi, 4
jmp 0x1d76445
push eax
call sub.ntdll.dll_NtClose
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x54]
mov dword [ecx], eax
call fcn.01cd9584
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
call fcn.01cd5586
cmp byte [ebp - 0x31], 0
jns 0x1d76486
push dword [ebp - 0x3c]
call fcn.01e5f36c
add esp, 4
cmp byte [ebp - 0x25], 0
jns 0x1d76497
push dword [ebp - 0x30]
call fcn.01e5f36c
add esp, 4
and bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
push str.vector___index_out_of_bounds
push str.__n___size__
push 0x601
push str....._third_partylibc_srcinclude_vector
push str._s:_d:_assertion__s_failed:__s_n
call fcn.01ce782c
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
jmp 0x1d764c2