Function at 0x7001b8b2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0c
cmp dword [ebp + 8], 0xffffffff
jne 0x7001b8cb
mov eax, 0x80004005
jmp 0x7001bbe8
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x20b
lea edi, [ebp - 0xe0c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
xor esi, esi
inc esi
push ebx
push esi
push dword [ebp + 8]
mov dword [ebp - 0xe0c], 0x82c
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
call fcn.7001878b
mov edi, eax
cmp edi, ebx
jl 0x7001b950
push ebx
push 0x200
lea eax, [ebp - 0x458]
push eax
push esi
push dword [ebp + 8]
push 0x70001ba0
push dword [ebp - 4]
call fcn.700188b2
push ebx
push 0x70
lea eax, [ebp - 0x4cc]
push eax
push 3
push dword [ebp + 8]
push 0x70001ffc
push dword [ebp - 4]
call fcn.700188b2
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7001b957
mov word [ebp - 0x458], bx
cmp edi, ebx
jge 0x7001b961
mov dword [ebp - 0x464], ebx
push dword [ebp + 8]
call fcn.7001b885
cmp eax, ebx
je 0x7001ba9b
mov dx, word [eax + 0x28]
cmp dx, 0x45e
jne 0x7001b9dc
movzx ecx, word [eax + 0x2a]
cmp cx, 0x102
jb 0x7001b9dc
cmp cx, 0x10c
jae 0x7001b9dc
mov edx, dword [ebp - 0x464]
movzx ecx, cx
add edx, 0x100
cmp edx, ecx
mov dword [ebp - 0xc], ebx
jne 0x7001b9ac
mov dword [ebp - 8], ebx
jmp 0x7001ba5d
mov word [ebp - 0x34], 0x23
mov ax, word [eax + 0x2a]
sub ax, 0xd0
mov word [ebp - 0x32], ax
push 0xff
lea eax, [ebp - 0xe0c]
push eax
lea eax, [ebp - 0x34]
push eax
mov word [ebp - 0x30], bx
call fcn.700191b5
jmp 0x7001ba5d
movzx eax, word [eax + 0x2a]
push eax
xor eax, eax
mov ax, dx
push eax
lea eax, [ebp - 0x48]
push 0x70001ae0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push 0x12
lea eax, [ebp - 0x34]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x458]
push eax
call fcn.7001a46a
push 9
pop ecx
lea edi, [ebp - 0x34]
lea esi, [ebp - 0x458]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x7001ba41
cmp dword [ebp - 0x464], 0xc
jb 0x7001ba41
mov dword [ebp - 8], ebx
push 0xff
lea eax, [ebp - 0xe0c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.70018263
test eax, eax
jl 0x7001ba5d
mov dword [ebp - 0xc], ebx
xor esi, esi
cmp dword [ebp - 0xc], ebx
jne 0x7001ba6d
cmp dword [ebp - 8], ebx
je 0x7001bb4f
cmp dword [ebp - 8], ebx
je 0x7001bab8
xor eax, eax
mov ecx, 0x126
lea edi, [ebp - 0x4e0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe0c]
push eax
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4e0], 0x498
push eax
jmp 0x7001bac0
cmp dword [ebp - 0x464], ebx
jne 0x7001bab0
cmp word [ebp - 0x458], bx
je 0x7001ba17
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], ebx
jmp 0x7001ba5a
lea eax, [ebp - 0xe0c]
push eax
push ebx
push ebx
push dword [ebp + 8]
call fcn.7001c119
mov esi, eax
cmp esi, ebx
jl 0x7001bb48
cmp dword [ebp - 0xc], 1
jne 0x7001bb17
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push 0x70001b18
push 0x80000002
call fcn.7001af2c
mov esi, eax
cmp esi, ebx
jl 0x7001bb17
push 0x15
lea eax, [ebp - 0xe0c]
push eax
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 4]
call fcn.70018491
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x7001bb4f
push 0x1e
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4cc]
push eax
push dword [ebp + 8]
call fcn.70018e2e
mov esi, eax
cmp esi, ebx
jl 0x7001bb4f
mov eax, dword [0x70025240]
cmp eax, ebx
je 0x7001bb4f
push ebx
call eax
jmp 0x7001bb4f
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
je 0x7001bbe3
xor eax, eax
mov ecx, 0x126
lea edi, [ebp - 0x4e0]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
push 0x1f
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4cc]
push eax
push edi
mov dword [ebp - 0x4e0], 0x498
mov dword [ebp - 0x45c], 0x2710
call fcn.70018e2e
mov esi, eax
cmp esi, ebx
jl 0x7001bbe3
lea eax, [ebp - 4]
push eax
push 1
push 0x2000000
push edi
call fcn.7001878b
mov esi, eax
cmp esi, ebx
jl 0x7001bbe3
inc edi
push edi
lea eax, [ebp - 0x5e0]
push 0x70001b9c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5e0]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4