Function at 0x3a286763
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x224
mov eax, 0x3a28b06c
call fcn.3a28a0cc
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [ebp - 0x230], eax
jmp 0x3a286c5b
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiA]
push 0x3a281440
push edi
mov dword [ebp - 0x228], 1
call esi
mov ebx, eax
neg ebx
push 0x3a281454
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x3a2867d0
test ebx, ebx
je 0x3a286883
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
cmp dword [ebp + 0x10], 0
je 0x3a286883
and dword [ebp - 0x220], 0
push 0x5c
push edi
call fcn.3a28394a
test eax, eax
pop ecx
pop ecx
jne 0x3a286c72
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
test eax, eax
je 0x3a286838
mov eax, dword [ebp - 0x22c]
push edi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], eax
call fcn.3a28394a
and dword [ebp - 0x220], 0
test ebx, ebx
je 0x3a286878
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286c84
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
lea ecx, [ebp - 0x220]
mov esi, eax
call fcn.3a283fe3
test esi, esi
jl 0x3a286cd1
jmp 0x3a286c21
lea ecx, [ebp - 0x220]
call fcn.3a283fe3
push 0x3a281448
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x3a2868af
mov ecx, dword [ebp - 0x21c]
and dword [ebp - 0x228], eax
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
push 0x3a281460
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x3a2869bf
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call fcn.3a28394a
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x3a286cd1
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
cmp esi, ebx
jl 0x3a286cd1
cmp byte [edi], 0x3d
jne 0x3a286c7d
cmp dword [ebp + 0x10], ebx
je 0x3a28694d
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x228], eax
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 1
call fcn.3a28394a
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x228], ebx
lea ecx, [ebp - 0x228]
jl 0x3a286ccc
mov byte [ebp - 4], bl
jmp 0x3a286c1c
cmp dword [ebp + 0x14], ebx
jne 0x3a2869aa
cmp dword [ebp - 0x228], ebx
je 0x3a2869aa
push 0x20006
push ebx
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
call fcn.3a28394a
cmp eax, ebx
jne 0x3a286c8c
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x3a28699f
cmp eax, 2
jne 0x3a286c8c
lea ecx, [ebp - 0x220]
call fcn.3a283fe3
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
cmp esi, ebx
jmp 0x3a286c65
push 0x5c
push edi
call fcn.3a28394a
test eax, eax
pop ecx
pop ecx
jne 0x3a286c7d
cmp dword [ebp + 0x10], eax
je 0x3a286a6f
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.3a28394a
test eax, eax
je 0x3a286a34
push 0x20019
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.3a28394a
test eax, eax
je 0x3a286a34
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.3a28394a
mov esi, eax
cmp esi, ebx
jne 0x3a286c9b
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
cmp byte [edi], 0x3d
jne 0x3a286c21
mov ecx, dword [ebp - 0x21c]
push edi
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.3a28394a
mov esi, eax
jmp 0x3a28686b
cmp dword [ebp + 0x14], 0
jne 0x3a286a90
push 0x20019
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.3a28394a
mov ebx, eax
jmp 0x3a286a93
push 2
pop ebx
test ebx, ebx
je 0x3a286a9e
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll__mbsnbcpy_s]
push eax
call fcn.3a28394a
mov ecx, dword [ebp - 0x21c]
add esp, 0x14
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
cmp byte [edi], 0x7b
jne 0x3a286b36
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 1
jne 0x3a286b36
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
push 0
push dword [ebp - 0x224]
push edi
call fcn.3a286763
mov esi, eax
test esi, esi
jge 0x3a286b20
cmp dword [ebp + 0x14], 0
je 0x3a286cd1
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
cmp ebx, 2
mov eax, dword [ebp - 0x230]
mov dword [ebp + 0x14], eax
je 0x3a286c67
test ebx, ebx
je 0x3a286b62
test eax, eax
jne 0x3a286c67
push ebx
call fcn.3a28394a
pop ecx
mov esi, eax
jmp 0x3a286cd1
test eax, eax
je 0x3a286bb9
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x21c]
call fcn.3a28394a
test eax, eax
je 0x3a286bb9
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x114]
push eax
call fcn.3a28394a
test eax, eax
je 0x3a286c67
cmp dword [ebp - 0x228], 0
je 0x3a286c67
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x224]
call fcn.3a28394a
jmp 0x3a286c67
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x21c]
call fcn.3a28394a
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x220], eax
call fcn.3a283fe3
mov ebx, eax
test ebx, ebx
jne 0x3a286caf
cmp dword [ebp - 0x228], eax
je 0x3a286c67
cmp dword [ebp - 0x220], eax
jne 0x3a286c67
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp - 0x228], ebx
test eax, eax
jne 0x3a286cbd
lea ecx, [ebp - 0x228]
call fcn.3a283fe3
cmp dword [ebp + 0x10], 0
je 0x3a286c67
cmp byte [edi], 0x7b
jne 0x3a286c67
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 1
jne 0x3a286c67
mov ecx, dword [ebp - 0x21c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x224]
push edi
call fcn.3a286763
mov esi, eax
test esi, esi
jl 0x3a286cd1
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.3a28394a
mov esi, eax
test esi, esi
jl 0x3a286cd1
cmp byte [edi], 0x7d
jne 0x3a28679d
jmp 0x3a286cd1
lea ecx, [ebp - 0x220]
call fcn.3a283fe3
mov esi, 0x80020009
jmp 0x3a286cd1
lea ecx, [ebp - 0x220]
jmp 0x3a286ccc
push eax
call fcn.3a28394a
pop ecx
lea ecx, [ebp - 0x220]
jmp 0x3a286cca
lea ecx, [ebp - 0x224]
call fcn.3a283fe3
push esi
call fcn.3a28394a
pop ecx
jmp 0x3a286cde
lea ecx, [ebp - 0x224]
call fcn.3a283fe3
push ebx
jmp 0x3a286ca7
push eax
call fcn.3a28394a
pop ecx
lea ecx, [ebp - 0x228]
mov esi, eax
call fcn.3a283fe3
lea ecx, [ebp - 0x224]
call fcn.3a283fe3
mov eax, esi
call fcn.3a28a14f
ret 0x10