Function at 0x10004fc0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x2254
call fcn.10096d00
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x224c], eax
mov eax, dword [esp + 0x225c]
mov edx, dword [esp + 0x2264]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2268]
mov dword [esp + 0x20], eax
xor ebx, ebx
mov eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x4c], edx
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005633
cmp word [edi], 0x7d
je 0x10005631
jmp 0x10005030
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
push 0x100a6e48
push edi
mov dword [esp + 0x34], 1
call ebp
mov esi, eax
neg esi
push 0x100a6e6c
sbb esi, esi
push edi
inc esi
call ebp
test eax, eax
je 0x10005061
cmp esi, ebx
je 0x1000518e
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
cmp dword [esp + 0x2270], ebx
je 0x1000518e
movzx ecx, word [edi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov eax, edi
cmp cx, bx
je 0x100050bb
mov ebp, dword [sym.imp.USER32.DLL_CharNextW]
movzx ecx, cx
mov edi, edi
cmp cx, 0x5c
je 0x100050b3
push eax
call ebp
movzx ecx, word [eax]
cmp cx, bx
jne 0x100050a0
jmp 0x100050bb
cmp eax, ebx
jne 0x100055b0
mov ebp, 0x100a7504
mov eax, dword [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x100050f8
add ebp, 4
cmp ebp, 0x100a7534
jl 0x100050c0
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], ebx
call fcn.10003d00
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
cmp esi, ebx
je 0x1000518a
mov esi, dword [esp + 0x10]
mov eax, edi
mov ecx, esi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x100055c9
mov ecx, esi
call fcn.10004b00
mov ebp, eax
cmp ebp, ebx
jl 0x100055c9
mov dword [esp + 0x28], ebx
cmp word [edi], 0x7b
jne 0x10005175
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x10005175
mov eax, dword [esp + 0x2270]
mov ecx, dword [esp + 0x18]
push ebx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push edi
call fcn.10004fc0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
mov edi, dword [esp + 0x48]
xor ebx, ebx
cmp word [edi], 0x7d
jne 0x10005030
jmp 0x10005622
mov dword [esp + 0x28], ebx
push 0x100a6e58
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x100051b7
mov ecx, dword [esp + 0x10]
mov eax, edi
mov dword [esp + 0x2c], ebx
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
push 0x100a6e84
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x100052be
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x258]
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
cmp word [edi], 0x3d
jne 0x100055b9
cmp dword [esp + 0x2270], ebx
je 0x1000524a
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], edx
push eax
lea edx, [esp + 0x260]
mov dword [esp + 0x44], ebx
call fcn.10004760
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
jl 0x100055cf
mov dword [esp + 0x3c], ebx
jmp 0x1000512c
cmp dword [esp + 0x2274], ebx
jne 0x100052b0
cmp dword [esp + 0x2c], ebx
je 0x100052b0
mov edx, dword [esp + 0x20]
mov eax, 0x20006
xor ecx, ecx
lea esi, [esp + 0x30]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.10003c60
cmp eax, ebx
jne 0x100055e3
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x258]
push ecx
push esi
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
cmp eax, ebx
je 0x1000529d
cmp eax, 2
jne 0x100055e3
cmp esi, ebx
je 0x100052ac
push esi
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x10]
call fcn.10004b00
jmp 0x1000516b
movzx ecx, word [edi]
mov eax, edi
cmp cx, bx
je 0x100052ec
mov esi, dword [sym.imp.USER32.DLL_CharNextW]
movzx ecx, cx
cmp cx, 0x5c
je 0x100052e4
push eax
call esi
movzx ecx, word [eax]
cmp cx, bx
jne 0x100052d1
jmp 0x100052ec
cmp eax, ebx
jne 0x100055b9
cmp dword [esp + 0x2270], ebx
je 0x100053d2
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebx
push edi
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x10005339
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x10005329
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x10005393
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push edi
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x10005379
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x10005369
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x10005393
mov edx, dword [esp + 0x20]
push edx
mov edx, edi
lea esi, [esp + 0x1c]
call fcn.10003c00
mov ebp, eax
cmp ebp, ebx
jne 0x100055ee
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
cmp word [edi], 0x3d
jne 0x1000512c
mov ecx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x1c]
push eax
xor edx, edx
call fcn.10004760
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
jmp 0x1000512c
cmp dword [esp + 0x2274], ebx
jne 0x100054f2
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push edi
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x1000541b
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x1000540f
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov esi, eax
mov dword [esp + 0x14], esi
cmp eax, ebx
je 0x10005430
mov dword [esp + 0x2274], 1
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x58]
push 0x104
push edx
call fcn.10084bef
push eax
call fcn.10001f10
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov eax, edi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
mov ecx, dword [esp + 0x10]
call fcn.10004b00
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
cmp word [edi], 0x7b
jne 0x100054c4
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x100054c4
mov esi, dword [esp + 0x2274]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push esi
push ebx
push eax
push edi
call fcn.10004fc0
mov ebp, eax
cmp ebp, ebx
jge 0x100054ab
cmp esi, ebx
je 0x10005622
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.100045f0
mov ebp, eax
cmp ebp, ebx
jl 0x10005622
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2274], eax
cmp esi, 2
je 0x10005175
cmp esi, ebx
je 0x10005503
cmp eax, ebx
jne 0x10005175
mov eax, esi
call fcn.10003980
mov ebp, eax
jmp 0x10005622
mov dword [esp + 0x14], 2
mov esi, dword [esp + 0x14]
jmp 0x10005425
mov esi, dword [esp + 0x18]
cmp eax, ebx
je 0x10005543
mov ecx, esi
call fcn.10004ac0
test eax, eax
je 0x10005543
lea ebx, [esp + 0x50]
call fcn.10004a80
test eax, eax
je 0x10005175
cmp dword [esp + 0x2c], 0
je 0x10005175
mov ecx, ebx
push ecx
lea ecx, [esp + 0x1c]
call fcn.10003d00
jmp 0x10005175
mov ecx, esi
call fcn.10004ac0
xor edi, edi
mov dword [esp + 0x14], eax
cmp esi, ebx
je 0x10005561
push esi
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov edi, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
cmp edi, ebx
jne 0x10005600
cmp dword [esp + 0x2c], ebx
je 0x10005175
cmp dword [esp + 0x14], ebx
jne 0x10005175
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x50]
lea esi, [esp + 0x40]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
call fcn.10003ba0
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
cmp eax, ebx
jne 0x10005612
call fcn.10003b80
jmp 0x10005175
lea esi, [esp + 0x24]
call fcn.10003b80
lea esi, [esp + 0x18]
call fcn.10003b80
mov eax, 0x80020009
jmp 0x10005633
lea esi, [esp + 0x24]
jmp 0x1000561d
lea esi, [esp + 0x38]
call fcn.10003b80
lea esi, [esp + 0x18]
call fcn.10003b80
jmp 0x10005631
call fcn.10003980
lea esi, [esp + 0x30]
jmp 0x1000561b
lea esi, [esp + 0x18]
call fcn.10003b80
mov eax, ebp
call fcn.10003980
jmp 0x10005633
lea esi, [esp + 0x18]
call fcn.10003b80
mov eax, edi
call fcn.10003980
jmp 0x10005633
call fcn.10003980
lea esi, [esp + 0x40]
mov ebp, eax
call fcn.10003b80
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10005631
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x225c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x2254
ret 0x10