Function at 0x10006a80
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
mov esi, edx
mov dword [esp + 0x1c], esi
push edi
test cl, cl
je 0x10006cbc
mov dword [esp + 0x1c], 0x6b06
cmp dword [esp + 0x1c], 0x6c6e
push 0
pop ebx
jle 0x10006b3b
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ebx
mov edi, ebx
mov dword [esp + 0x18], ebx
mov eax, ebx
mov dword [esp + 0x14], ebx
add eax, edi
mov dword [esp + 0x10], 0x12ac
mov dword [esp + 0x24], eax
mov edi, eax
mov eax, edi
lea ecx, [esp + 0x28]
xor eax, esi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006af3
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.1000d197
dec edi
dec dword [esp + 0x10]
jne 0x10006ad9
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x39f8
jl 0x10006ac9
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x3d65
jl 0x10006ac3
inc esi
cmp esi, 0x56dd
jl 0x10006abd
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x1c], 0x67c1
jge 0x10006b50
push str.ugi_dcxwc_uiinmfjwb_nhfisws_datlaegjb_qssuepmn_ipgpl_gvgmqfsn_cprb_axdj_fwbnwypeq_kquv_vpnolohgu
call fcn.1004d87c
pop ecx
cmp byte [ebp + 0x10], 0
je 0x10006c02
mov esi, dword [ebp + 8]
mov dword [esi], 0xb
jmp 0x10006bf4
push 1
push 1
push 0x418e
push 0x4425
mov edx, 0x95b
mov cl, 1
call fcn.100031a0
mov dword [esp + 0x2c], 0xb2f
add esp, 0x10
cmp dword [esp + 0x1c], 0xca7
jle 0x10006bc4
mov edi, ebx
mov esi, ebx
mov eax, edi
mov ecx, 0x1007bbb8
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000cbc0
inc esi
cmp esi, 0x5ad7
jl 0x10006b9b
inc edi
cmp edi, 0x870
jl 0x10006b99
mov esi, dword [ebp + 8]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10006bd9
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
cmp dword [esp + 0x1c], 0xad5
jge 0x10006bf2
mov edx, str.orai_beb_nytqni_shylyex_wehijtxp_dswocerel
mov ecx, 0x1007bbb8
call fcn.1000ee07
inc dword [esi]
cmp dword [esi], 0x19
je 0x10006b68
jmp 0x10006ce6
mov dword [esp + 0x18], 0x3b8f
cmp dword [esp + 0x18], 0x3bea
jle 0x10006c8a
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [esp + 0x10], ebx
mov ecx, ebx
mov dword [esp + 0x1c], ebx
shl eax, cl
lea ecx, [esp + 0x40]
xor eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006c40
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [esp + 0x48]
call fcn.1000d197
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, 0x1f09
jl 0x10006c24
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x3ad9
jl 0x10006c1e
inc esi
cmp esi, 0x2b7a
jl 0x10006c18
inc edi
cmp edi, 0x2f24
jl 0x10006c16
mov esi, dword [esp + 0x20]
mov dword [esi], ebx
cmp dword [esi], 2
jge 0x10006ca6
mov edx, dword [ebp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x59ff446c
inc dword [esi]
cmp dword [esi], 2
jl 0x10006c94
cmp dword [esp + 0x18], 0x3b5f
jge 0x10006ce6
push str.kmjytwgl_cjtrhu_lyehpftjy_habecu_xaktwonl_nqqjeace
call fcn.1004d87c
jmp 0x10006cd9
cmp byte [ebp + 0x14], 0
je 0x10006cdc
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10006ce6
push 0x187d
mov ecx, 0x3a43
call fcn.100050e4
pop ecx
jmp 0x10006ce6
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret