Function at 0x10006e81
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x10051009
call fcn.100457f4
sub esp, 0x9c
push ebx
push esi
push edi
push 0x1a0
call fcn.1004540f
pop ecx
mov ecx, eax
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x10006eb9
call fcn.10007642
mov esi, eax
mov dword [ebp - 0x20], esi
jmp 0x10006ebe
mov dword [ebp - 0x20], ebx
mov esi, ebx
or dword [ebp - 4], 0xffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.TOOLBAR
call fcn.1000101a
push esi
lea ecx, [ebp - 0xa8]
call fcn.10022017
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 1
call fcn.10003dfc
pop ecx
mov edi, dword [eax]
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
mov byte [ebp - 0x38], al
call fcn.1002376b
push edi
call fcn.10045c20
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call fcn.100243fe
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.1001179b
mov ecx, dword [0x1006ce64]
cmp ecx, ebx
je 0x10006f34
call fcn.10001a3c
mov edi, eax
jmp 0x10006f36
xor edi, edi
push edi
call fcn.10045c20
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call fcn.100243a7
mov eax, dword [ebp - 0x34]
cmp eax, ebx
mov edi, 0x10057508
jne 0x10006f55
mov eax, edi
push eax
lea ecx, [ebp - 0x14]
call fcn.1000101a
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 5
call fcn.10043f13
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.100018b6
cmp dword [esi + 0x134], ebx
je 0x10006f9e
mov eax, dword [esi + 0x130]
cmp eax, ebx
jne 0x10006f93
mov eax, edi
push eax
mov ecx, 0x1006ce5c
call fcn.10002a36
cmp dword [esi + 0x18], ebx
je 0x10006fb7
mov eax, dword [esi + 0x14]
cmp eax, ebx
jne 0x10006fac
mov eax, edi
push eax
mov ecx, 0x1006ce58
call fcn.10002a36
push 0x10066b30
lea ecx, [ebp - 0x1c]
call fcn.1000101a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x1006ce54
mov byte [ebp - 4], 6
call fcn.100018c9
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.100018b6
xor edi, edi
mov eax, dword [esi + 0xfc]
cmp eax, ebx
je 0x1000700c
mov ecx, dword [esi + 0x100]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x1000700c
mov ecx, dword [eax + edi*4]
mov eax, dword [ecx]
call dword [eax + 0x10]
inc edi
jmp 0x10006fe8
cmp byte [ebp + 8], bl
je 0x1000735a
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
mov byte [ebp - 4], 9
je 0x1000702a
call fcn.10001a3c
jmp 0x1000702c
xor eax, eax
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp + 8]
push ecx
push ebx
mov esi, 0xf003f
push esi
push ebx
push ebx
push ebx
push eax
mov edi, SysReAllocStringLen
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10007060
lea ecx, [ebp - 0x10]
call fcn.100047cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
je 0x10007071
call fcn.10001a3c
jmp 0x10007073
xor eax, eax
push ebx
push eax
push 0x1006ceac
lea ecx, [ebp - 0x10]
call fcn.100074df
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x10007093
call fcn.10001a3c
jmp 0x10007095
xor eax, eax
push ebx
push eax
push str.CLSID
lea ecx, [ebp - 0x10]
call fcn.100074df
cmp dword [ebp - 0x10], ebx
je 0x100070b5
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov ecx, dword [0x1006ce54]
cmp ecx, ebx
je 0x100070c6
call fcn.10001a3c
jmp 0x100070c8
xor eax, eax
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
push ebx
push ebx
push ebx
push eax
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x100070f2
lea ecx, [ebp - 0x10]
call fcn.100047cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
je 0x10007103
call fcn.10001a3c
jmp 0x10007105
xor eax, eax
push ebx
push eax
push 0x1006ceac
lea ecx, [ebp - 0x10]
call fcn.100074df
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x10007125
call fcn.10001a3c
jmp 0x10007127
xor eax, eax
push ebx
push eax
push str.CLSID
lea ecx, [ebp - 0x10]
call fcn.100074df
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x10007144
call fcn.10001a3c
jmp 0x10007146
xor eax, eax
push ebx
push eax
push str.CurVer
lea ecx, [ebp - 0x10]
call fcn.100074df
cmp dword [ebp - 0x10], ebx
je 0x10007166
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push str.CLSID
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10007194
lea ecx, [ebp - 0x10]
call fcn.100047cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
je 0x100071a8
call fcn.10001a3c
mov dword [ebp + 8], eax
jmp 0x100071ab
mov dword [ebp + 8], ebx
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x100071bc
call fcn.10001a3c
jmp 0x100071be
xor eax, eax
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.100074df
cmp dword [ebp - 0x10], ebx
je 0x100071dc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
push str.CLSID_
lea ecx, [ebp - 0x14]
call fcn.1000101a
push 0x1006ce68
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.1000192e
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x10007208
call fcn.10001a3c
jmp 0x1000720a
xor eax, eax
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
push ebx
push ebx
push ebx
push eax
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10007234
lea ecx, [ebp - 0x10]
call fcn.100047cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x10007242
call fcn.10001a3c
jmp 0x10007244
xor eax, eax
push ebx
push eax
push str.ProgID
lea ecx, [ebp - 0x10]
call fcn.100074df
mov ecx, dword [0x1006ce54]
cmp ecx, ebx
je 0x10007264
call fcn.10001a3c
jmp 0x10007266
xor eax, eax
push ebx
push eax
push str.VersionIndependentProgID
lea ecx, [ebp - 0x10]
call fcn.100074df
push ebx
push str.AAACB30A_6ED9_4c62_9A8A_7DE9FA234608
push str.TypeLib
lea ecx, [ebp - 0x10]
call fcn.100074df
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp + 0xb]
push eax
mov edi, 0x3e8
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp + 0xb], bl
call fcn.10022ebd
mov eax, dword [0x1006cfa4]
push edi
push dword [ebp - 0x44]
mov byte [ebp - 4], 0xb
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x21]
push eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
call fcn.10021d5b
mov eax, dword [ebp - 0x54]
cmp eax, ebx
mov byte [ebp - 4], 0xc
jne 0x100072d4
mov eax, 0x10057508
push ebx
push eax
mov edi, str.InprocServer32
push edi
lea ecx, [ebp - 0x10]
call fcn.100074df
push str.ThreadingModel
push str.Apartment
push edi
lea ecx, [ebp - 0x10]
call fcn.100074df
lea ecx, [ebp - 0x10]
call fcn.100047cf
push ebx
push ebx
push esi
push ebx
push ebx
push str.SYSTEMCurrentControlSetControlSession_Manager_
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.1000744a
push str.PendingFileRenameOperations
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x10]
call fcn.100047cf
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.1002376b
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xa
call fcn.100223c8
lea ecx, [ebp - 0x14]
call fcn.100018b6
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10]
jmp 0x10007404
mov dword [ebp + 8], ebx
push ebx
push ebx
mov esi, 0xf003f
push esi
push ebx
push ebx
push str.CLSID_
mov edi, SysReAllocStringLen
push edi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xd
call fcn.1000744a
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x1000738f
call fcn.10001a3c
jmp 0x10007391
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.1000754a
lea ecx, [ebp + 8]
call fcn.100047cf
push esi
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.100074a1
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x100073bb
call fcn.10001a3c
jmp 0x100073bd
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.1000754a
lea ecx, [ebp + 8]
call fcn.100047cf
push esi
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.100074a1
mov ecx, dword [0x1006ce54]
cmp ecx, ebx
je 0x100073ea
call fcn.10001a3c
jmp 0x100073ec
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.1000754a
lea ecx, [ebp + 8]
call fcn.100047cf
mov byte [ebp - 4], 8
lea ecx, [ebp + 8]
call fcn.100047cf
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x10007416
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x18]
call fcn.100018b6
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.1002376b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10022087
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret