Function at 0x1000260c
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], eax
call fcn.10002357
mov esi, eax
cmp esi, ebx
jl 0x10002ae6
cmp word [edi], 0x7d
je 0x10002ac2
push dword [0x10009228]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
call esi
push dword [0x10009220]
mov ebx, eax
neg ebx
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x10002678
test ebx, ebx
je 0x1000273f
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
cmp dword [ebp + 0x10], 0
je 0x1000273f
and dword [ebp + 8], 0
mov cx, word [edi]
mov eax, edi
test cx, cx
je 0x100026bd
cmp cx, 0x5c
je 0x100026b5
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
jmp 0x1000269e
test eax, eax
jne 0x10002a9c
mov esi, 0x1000b040
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100026ed
add esi, 4
cmp esi, str.TYPELIB
jl 0x100026c2
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.10002b3e
and dword [ebp + 8], 0
test ebx, ebx
je 0x10002730
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x10002ab4
mov ecx, dword [ebp - 8]
push edi
call fcn.10002f18
mov esi, eax
cmp esi, ebx
jl 0x10002ab4
cmp dword [ebp + 8], ebx
je 0x10002a4d
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10002a4d
cmp dword [ebp + 8], 0
je 0x1000273f
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x10009224]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10002766
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], eax
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
push dword [0x1000921c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000280b
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x220]
push eax
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
cmp word [edi], 0x3d
jne 0x10002ae0
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x100027e4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x220]
push edi
push eax
lea eax, [ebp + 8]
push eax
call fcn.10002c22
mov esi, eax
mov dword [ebp + 8], ebx
cmp esi, ebx
jl 0x10002ae6
jmp 0x10002a4d
cmp dword [ebp + 0x14], ebx
jne 0x100027f9
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 8]
push edi
call fcn.10002f18
mov esi, eax
cmp esi, ebx
jmp 0x10002a95
mov cx, word [edi]
mov eax, edi
xor ebx, ebx
cmp cx, bx
je 0x10002831
cmp cx, 0x5c
je 0x10002829
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
jmp 0x10002812
cmp eax, ebx
jne 0x10002aeb
cmp dword [ebp + 0x10], ebx
je 0x100028d6
mov esi, 0xf003f
lea ecx, [ebp - 4]
push esi
push edi
push dword [ebp + 0xc]
call fcn.10002b00
test eax, eax
je 0x100028a5
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.10002b00
test eax, eax
je 0x100028a5
lea eax, [ebp - 0x18]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10002aeb
xor eax, eax
cmp dword [ebp - 4], ebx
je 0x10002897
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 4], ecx
jne 0x10002aeb
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
cmp word [edi], 0x3d
jne 0x10002a4d
mov ecx, dword [ebp - 8]
push edi
lea eax, [ebp - 4]
push 0
push eax
call fcn.10002c22
jmp 0x10002a47
cmp dword [ebp + 0x14], ebx
jne 0x100028f7
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.10002b00
test eax, eax
je 0x100028f7
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0xc], ebx
jne 0x10002909
mov eax, 0x208
call fcn.10004680
mov dword [ebp - 0xc], esp
push 0x104
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x14], ebx
jne 0x1000293f
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.10002e6b
test eax, eax
jne 0x1000293f
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.10002ea0
test eax, eax
je 0x100029ff
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
mov ecx, dword [ebp - 8]
push edi
call fcn.10002f18
mov esi, eax
test esi, esi
jl 0x10002ac2
cmp word [edi], 0x7b
jne 0x100029b3
push dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
push 0
push dword [ebp - 4]
push edi
call fcn.1000260c
mov esi, eax
test esi, esi
jl 0x10002ac2
cmp dword [ebp + 0x14], 0
je 0x100029bd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
push edi
mov dword [ebp + 0x14], eax
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
mov ecx, dword [ebp - 8]
push edi
call fcn.10002f18
jmp 0x10002a91
cmp dword [ebp + 0x14], 0
jne 0x10002643
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.10002e6b
test eax, eax
je 0x100029ff
mov esi, 0x1000b040
push dword [esi]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10002a88
add esi, 4
cmp esi, str.TYPELIB
jl 0x100029d1
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.10002b3e
jmp 0x10002a88
xor esi, esi
cmp dword [ebp - 4], esi
je 0x10002a1a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
mov dword [ebp - 4], esi
jne 0x10002af9
cmp dword [ebp - 0x10], esi
je 0x10002a2b
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
mov ecx, dword [ebp - 8]
push edi
call fcn.10002f18
mov esi, eax
test esi, esi
jl 0x10002ac2
cmp dword [ebp + 0x10], 0
je 0x10002643
cmp word [edi], 0x7b
jne 0x10002643
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10002643
push 0
mov ecx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 4]
push edi
call fcn.1000260c
mov esi, eax
test esi, esi
jl 0x10002ac2
mov ecx, dword [ebp - 8]
push edi
call fcn.10002357
mov esi, eax
test esi, esi
jl 0x10002ac2
jmp 0x10002643
xor esi, esi
cmp dword [ebp + 8], esi
je 0x10002aaf
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], esi
cmp dword [ebp - 4], esi
jmp 0x10002aee
cmp dword [ebp + 8], ebx
je 0x10002ac2
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x10002ad1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea esp, [ebp - 0x22c]
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp - 4], 0
jmp 0x10002aee
cmp dword [ebp - 4], ebx
jmp 0x10002ac6
cmp dword [ebp - 4], ebx
je 0x10002af9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x10002ad3