Function at 0x10003020
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x222c
call fcn.10005f10
xor eax, eax
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], eax
call fcn.10002e70
mov ecx, dword [esi]
mov al, byte [ecx]
test al, al
je 0x10003a4d
cmp al, 0x27
jne 0x100030dc
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
je 0x100030c1
mov ecx, esi
call fcn.10003ca0
test eax, eax
jne 0x100030c1
mov eax, dword [esi]
cmp byte [eax], 0x27
jne 0x10003089
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, dword [ebp + 8]
lea edx, [edi + 2]
add ecx, 0x1000
mov dword [esi], eax
cmp edx, ecx
jae 0x10003a4d
cmp ebx, eax
jae 0x100030ba
mov eax, ebx
mov cl, byte [eax]
inc eax
mov byte [edi], cl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x100030ae
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x1000306e
mov eax, dword [esi]
cmp byte [eax], 0
je 0x10003a4d
mov byte [edi], 0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
jmp 0x10003110
push eax
mov ecx, esi
call fcn.10003cc0
test eax, eax
jne 0x1000310d
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
cmp ebx, eax
mov dword [esi], eax
jae 0x10003105
mov eax, ebx
mov dl, byte [eax]
inc eax
mov byte [edi], dl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x100030f9
mov eax, dword [esi]
mov al, byte [eax]
test al, al
jne 0x100030dc
mov byte [edi], 0
mov ecx, dword [ebp + 8]
xor edi, edi
cmp byte [ecx], 0x7d
je 0x10003a1a
mov edx, dword [str.Delete]
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edx
push eax
call ebx
mov ecx, dword [str.ForceRemove]
mov edx, dword [ebp + 8]
mov edi, eax
push ecx
neg edi
sbb edi, edi
push edx
inc edi
mov dword [ebp - 0x1c], edi
call ebx
test eax, eax
je 0x10003154
test edi, edi
je 0x100034a0
mov edi, dword [ebp + 8]
mov ecx, esi
call fcn.10002e70
mov ecx, dword [esi]
mov al, byte [ecx]
test al, al
je 0x10003a3e
cmp al, 0x27
jne 0x100031eb
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
je 0x100031d0
mov ecx, esi
call fcn.10003ca0
test eax, eax
jne 0x100031d0
mov eax, dword [esi]
cmp byte [eax], 0x27
jne 0x10003198
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
mov edx, dword [ebp + 8]
lea ecx, [edi + 2]
add edx, 0x1000
mov dword [esi], eax
cmp ecx, edx
jae 0x10003a3e
cmp ebx, eax
jae 0x100031c9
mov eax, ebx
mov cl, byte [eax]
inc eax
mov byte [edi], cl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x100031bd
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x1000317d
mov eax, dword [esi]
cmp byte [eax], 0
je 0x10003a3e
mov byte [edi], 0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
jmp 0x1000321f
push eax
mov ecx, esi
call fcn.10003cc0
test eax, eax
jne 0x1000321c
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
cmp ebx, eax
mov dword [esi], eax
jae 0x10003214
mov eax, ebx
mov dl, byte [eax]
inc eax
mov byte [edi], dl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x10003208
mov eax, dword [esi]
mov al, byte [eax]
test al, al
jne 0x100031eb
mov byte [edi], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100034a0
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0
mov eax, ebx
mov cl, byte [ebx]
test cl, cl
je 0x1000325a
mov edi, dword [sym.imp.USER32.dll_CharNextA]
cmp cl, 0x5c
je 0x10003252
push eax
call edi
mov cl, byte [eax]
test cl, cl
jne 0x10003242
jmp 0x1000325a
test eax, eax
jne 0x10003a45
mov edi, 0x1000e030
mov ecx, dword [edi]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10003321
add edi, 4
cmp edi, str.TYPELIB
jl 0x1000325f
mov eax, dword [ebp + 0xc]
push 0x2001f
push ebx
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
call fcn.10003b00
test eax, eax
jne 0x10003312
lea edx, [ebp - 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edx
mov edx, dword [ebp - 0xc]
push eax
push eax
push eax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x22c]
push eax
push ecx
push 0
push edx
mov dword [ebp - 0x14], pe_nt_image_headers32
call edi
test eax, eax
jne 0x100032ff
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0xc]
push eax
call fcn.10003b50
test eax, eax
jne 0x10003312
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0xc]
push eax
push eax
push eax
lea eax, [ebp - 0x22c]
push edx
push eax
push 0
push ecx
mov dword [ebp - 0x14], pe_nt_image_headers32
call edi
test eax, eax
je 0x100032c7
lea ecx, [ebp - 0xc]
call fcn.10003a70
mov edx, dword [ebp - 8]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0xc]
call fcn.10003a70
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10003498
mov ecx, esi
mov edi, ebx
call fcn.10002e70
mov ecx, dword [esi]
mov al, byte [ecx]
test al, al
je 0x10003a37
cmp al, 0x27
jne 0x100033c2
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
je 0x100033a7
mov ecx, esi
call fcn.10003ca0
test eax, eax
jne 0x100033a7
mov eax, dword [esi]
cmp byte [eax], 0x27
jne 0x1000336f
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
mov edx, dword [ebp + 8]
lea ecx, [edi + 2]
add edx, 0x1000
mov dword [esi], eax
cmp ecx, edx
jae 0x10003a37
cmp ebx, eax
jae 0x100033a0
mov eax, ebx
mov cl, byte [eax]
inc eax
mov byte [edi], cl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x10003394
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x10003354
mov eax, dword [esi]
cmp byte [eax], 0
je 0x10003a37
mov byte [edi], 0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
jmp 0x100033f6
push eax
mov ecx, esi
call fcn.10003cc0
test eax, eax
jne 0x100033f3
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
cmp ebx, eax
mov dword [esi], eax
jae 0x100033eb
mov eax, ebx
mov dl, byte [eax]
inc eax
mov byte [edi], dl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x100033df
mov eax, dword [esi]
mov al, byte [eax]
test al, al
jne 0x100033c2
mov byte [edi], 0
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0x3d
jne 0x1000343b
push ebx
mov ecx, esi
call fcn.10002ec0
test eax, eax
jl 0x10003a10
mov ecx, esi
call fcn.10002e70
lea ecx, [ebp - 0x122c]
push ecx
mov ecx, esi
call fcn.10002ec0
test eax, eax
jl 0x10003a10
push ebx
mov ecx, esi
call fcn.10002ec0
test eax, eax
jl 0x10003a10
xor edi, edi
lea ecx, [ebp - 8]
call fcn.10003a70
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0x7b
jne 0x10003487
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x10003487
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
push 0
push edx
push eax
push ebx
mov ecx, esi
call fcn.10003020
mov edi, eax
test edi, edi
jl 0x10003a1a
push ebx
mov ecx, esi
call fcn.10002ec0
mov edi, eax
test edi, edi
jl 0x10003a1a
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0x7d
je 0x10003a1a
jmp 0x1000311e
lea ecx, [ebp - 8]
call fcn.10003a70
mov edx, dword [str.NoRemove]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10003587
mov edi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x18], eax
call fcn.10002e70
mov ecx, dword [esi]
mov al, byte [ecx]
test al, al
je 0x10003a3e
cmp al, 0x27
jne 0x10003553
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
je 0x10003538
mov ecx, esi
call fcn.10003ca0
test eax, eax
jne 0x10003538
mov eax, dword [esi]
cmp byte [eax], 0x27
jne 0x10003500
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
mov edx, dword [ebp + 8]
lea ecx, [edi + 2]
add edx, 0x1000
mov dword [esi], eax
cmp ecx, edx
jae 0x10003a3e
cmp ebx, eax
jae 0x10003531
mov eax, ebx
mov cl, byte [eax]
inc eax
mov byte [edi], cl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x10003525
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x100034e5
mov eax, dword [esi]
cmp byte [eax], 0
je 0x10003a3e
mov byte [edi], 0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
jmp 0x10003587
push eax
mov ecx, esi
call fcn.10003cc0
test eax, eax
jne 0x10003584
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
cmp ebx, eax
mov dword [esi], eax
jae 0x1000357c
mov eax, ebx
mov dl, byte [eax]
inc eax
mov byte [edi], dl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x10003570
mov eax, dword [esi]
mov al, byte [eax]
test al, al
jne 0x10003553
mov byte [edi], 0
mov ecx, dword [0x1000c1ac]
mov ebx, dword [ebp + 8]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100037e2
mov ecx, esi
lea edi, [ebp - 0x12c]
call fcn.10002e70
mov ecx, dword [esi]
mov al, byte [ecx]
test al, al
je 0x10003a3e
cmp al, 0x27
jne 0x10003635
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
je 0x1000361c
mov ecx, esi
call fcn.10003ca0
test eax, eax
jne 0x1000361c
mov eax, dword [esi]
cmp byte [eax], 0x27
jne 0x100035e7
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
lea edx, [edi + 2]
lea ecx, [ebp + 0xed4]
cmp edx, ecx
mov dword [esi], eax
jae 0x10003a3e
cmp ebx, eax
jae 0x10003613
mov ecx, ebx
mov dl, byte [ecx]
inc ecx
mov byte [edi], dl
inc edi
cmp ecx, eax
jb 0x10003609
mov cl, byte [eax]
mov ebx, dword [ebp + 8]
test cl, cl
jne 0x100035cc
mov eax, dword [esi]
cmp byte [eax], 0
je 0x10003a3e
push eax
mov byte [edi], 0
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
jmp 0x10003668
push eax
mov ecx, esi
call fcn.10003cc0
test eax, eax
jne 0x10003665
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
cmp ebx, eax
mov dword [esi], eax
jae 0x1000365c
mov ecx, ebx
mov dl, byte [ecx]
inc ecx
mov byte [edi], dl
inc edi
cmp ecx, eax
jb 0x10003652
mov al, byte [eax]
mov ebx, dword [ebp + 8]
test al, al
jne 0x10003635
mov byte [edi], 0
mov ecx, esi
mov edi, ebx
call fcn.10002e70
mov ecx, dword [esi]
mov al, byte [ecx]
test al, al
je 0x10003a3e
cmp al, 0x27
jne 0x100036fe
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
je 0x100036e3
mov ecx, esi
call fcn.10003ca0
test eax, eax
jne 0x100036e3
mov eax, dword [esi]
cmp byte [eax], 0x27
jne 0x100036ab
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
mov edx, dword [ebp + 8]
lea ecx, [edi + 2]
add edx, 0x1000
mov dword [esi], eax
cmp ecx, edx
jae 0x10003a3e
cmp ebx, eax
jae 0x100036dc
mov eax, ebx
mov cl, byte [eax]
inc eax
mov byte [edi], cl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x100036d0
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x10003690
mov eax, dword [esi]
cmp byte [eax], 0
je 0x10003a3e
mov byte [edi], 0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esi], eax
jmp 0x10003732
push eax
mov ecx, esi
call fcn.10003cc0
test eax, eax
jne 0x1000372f
mov ebx, dword [esi]
push ebx
call dword [sym.imp.USER32.dll_CharNextA]
cmp ebx, eax
mov dword [esi], eax
jae 0x10003727
mov eax, ebx
mov dl, byte [eax]
inc eax
mov byte [edi], dl
mov ecx, dword [esi]
inc edi
cmp eax, ecx
jb 0x1000371b
mov eax, dword [esi]
mov al, byte [eax]
test al, al
jne 0x100036fe
mov byte [edi], 0
mov edi, dword [ebp + 8]
cmp byte [edi], 0x3d
jne 0x10003a4d
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, ebx
je 0x10003775
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x12c]
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push edx
push eax
mov ecx, esi
call fcn.10003d10
mov edi, eax
mov dword [ebp - 8], ebx
cmp edi, ebx
lea ecx, [ebp - 8]
jl 0x10003a15
jmp 0x10003440
cmp dword [ebp + 0x14], ebx
jne 0x10003799
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x12c]
push ecx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.10003a70
cmp byte [edi], 0x3d
jne 0x100037db
push edi
mov ecx, esi
call fcn.10002ec0
cmp eax, ebx
jl 0x10003a33
mov ecx, esi
call fcn.10002e70
lea edx, [ebp - 0x222c]
mov ecx, esi
push edx
call fcn.10002ec0
cmp eax, ebx
jl 0x10003a33
push edi
mov ecx, esi
call fcn.10002ec0
cmp eax, ebx
jl 0x10003a33
xor edi, edi
jmp 0x10003487
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x10003808
mov edi, dword [sym.imp.USER32.dll_CharNextA]
cmp cl, 0x5c
je 0x10003800
push eax
call edi
mov cl, byte [eax]
test cl, cl
jne 0x100037f0
jmp 0x10003808
test eax, eax
jne 0x10003a4d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10003896
mov edi, dword [ebp + 0xc]
push 0xf003f
push ebx
push edi
lea ecx, [ebp - 4]
call fcn.10003b00
test eax, eax
je 0x1000385b
push 0x20019
push ebx
push edi
lea ecx, [ebp - 4]
call fcn.10003b00
test eax, eax
je 0x1000385b
push 0
push 0
push 0xf003f
push 0
push 0
push ebx
push edi
lea ecx, [ebp - 4]
call fcn.10003a90
test eax, eax
jne 0x10003a4d
push ebx
mov ecx, esi
call fcn.10002ec0
mov edi, eax
test edi, edi
jl 0x10003a1a
cmp byte [ebx], 0x3d
jne 0x10003445
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push eax
push 0
push ecx
mov ecx, esi
call fcn.10003d10
mov edi, eax
test edi, edi
jl 0x10003a1a
jmp 0x10003445
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x100038bb
mov edx, dword [ebp + 0xc]
push 0x20019
push ebx
push edx
lea ecx, [ebp - 4]
call fcn.10003b00
test eax, eax
je 0x100038bb
mov edi, 1
mov dword [ebp + 0x14], edi
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100038d1
mov eax, 0x104
call fcn.10005f10
mov eax, esp
mov dword [ebp - 0x10], eax
push 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
test edi, edi
jne 0x10003904
mov eax, dword [ebp - 4]
mov ecx, esi
push eax
call fcn.10004120
test eax, eax
jne 0x10003904
mov ecx, dword [ebp - 4]
push ecx
mov ecx, esi
call fcn.10004170
test eax, eax
je 0x100039b8
push ebx
mov ecx, esi
call fcn.10002ec0
mov edi, eax
test edi, edi
jl 0x10003a1a
push ebx
mov ecx, esi
call fcn.10004220
mov edi, eax
test edi, edi
jl 0x10003a1a
cmp byte [ebx], 0x7b
jne 0x1000395b
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push edx
push 0
push eax
push ebx
mov ecx, esi
call fcn.10003020
mov edi, eax
test edi, edi
jl 0x10003a1a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10003969
mov ecx, dword [ebp - 0x20]
mov dword [ebp + 0x14], ecx
jmp 0x100039ef
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x10003487
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, esi
push edx
call fcn.10004120
test eax, eax
je 0x100039b8
mov edi, 0x1000e030
mov eax, dword [edi]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100039a5
add edi, 4
cmp edi, str.TYPELIB
jl 0x1000397d
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push edx
call fcn.10003b50
push ebx
mov ecx, esi
call fcn.10002ec0
mov edi, eax
test edi, edi
jl 0x10003a1a
jmp 0x10003487
lea ecx, [ebp - 4]
call fcn.10003a70
test eax, eax
jne 0x10003a4d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100039ef
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
call fcn.10003a70
push ebx
mov ecx, esi
call fcn.10002ec0
mov edi, eax
test edi, edi
jl 0x10003a1a
push ebx
mov ecx, esi
call fcn.10004220
mov edi, eax
test edi, edi
jl 0x10003a1a
jmp 0x10003487
mov edi, eax
lea ecx, [ebp - 8]
call fcn.10003a70
lea ecx, [ebp - 4]
call fcn.10003a70
mov eax, edi
lea esp, [ebp - 0x2238]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, eax
jmp 0x10003a1a
mov edi, 0x80020009
jmp 0x10003a12
mov edi, 0x80020009
jmp 0x10003a1a
lea ecx, [ebp - 8]
call fcn.10003a70
lea ecx, [ebp - 4]
call fcn.10003a70
lea esp, [ebp - 0x2238]
mov eax, 0x80020009
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10