Function at 0x10563c9
Capabilities:
Delete registry value

Disassembly:
push 0x84
mov eax, 0x11abb25
call fcn.010b143d
mov edi, dword [ebp + 8]
push 0xf003f
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x38], ecx
call fcn.01055266
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push eax
push ecx
call fcn.01054903
lea ecx, [ebp - 0x30]
call fcn.01053caa
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0104a104
lea eax, [ebp - 0x30]
push eax
call fcn.010537eb
test al, al
je 0x10565cf
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x60]
push eax
mov esi, 0x1002a64
push esi
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], ebx
call fcn.0104c5eb
cmp eax, ebx
jne 0x105645c
cmp dword [ebp - 0x34], 4
jne 0x105645c
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x3c], eax
push 4
pop ecx
lea eax, [ebp - 0x3c]
push eax
push ecx
push ecx
push esi
push dword [ebp - 0x30]
call fcn.01049574
cmp dword [edi + 0x18], 8
push 4
pop ecx
lea eax, [ebp - 0x3c]
jb 0x105647f
mov edi, dword [edi + 4]
jmp 0x1056482
add edi, 4
push eax
push ecx
push ecx
push edi
push dword [ebp - 0x30]
call fcn.01049574
mov dword [ebp - 0x40], eax
cmp eax, ebx
jne 0x10565c7
mov edi, dword [ebp - 0x38]
mov ecx, edi
call fcn.010552b5
mov esi, eax
cmp esi, dword [edi + 0x28]
jbe 0x10565be
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x2c]
call fcn.010368a4
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov byte [ebp - 4], 4
mov dword [ebp - 0x38], ebx
cmp esi, ebx
jbe 0x1056560
cmp dword [ebp - 0x40], ebx
jne 0x1056560
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], ebx
call fcn.01036917
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x30]
call fcn.01055098
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
cmp eax, ebx
jne 0x1056554
cmp dword [ebp - 0x34], 4
jne 0x105651a
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x90]
call fcn.01038630
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.01080d7f
push ebx
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 4
call fcn.010362ea
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jb 0x10564d7
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x4c]
push 0x10529fe
sar eax, 5
push eax
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.0105629a
sub esi, dword [edi + 0x28]
je 0x10565a3
mov edi, dword [ebp - 0x4c]
add edi, 4
cmp dword [edi + 0x14], 8
jb 0x105658f
mov eax, dword [edi]
jmp 0x1056591
mov eax, edi
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec esi
add edi, 0x20
cmp esi, ebx
jne 0x1056585
lea ecx, [ebp - 0x70]
call fcn.0112c1e2
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.010362ea
lea ecx, [ebp - 0x50]
call fcn.0107f711
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea ecx, [ebp - 0x60]
call fcn.0112c1e2
lea eax, [ebp - 0x30]
push eax
call fcn.0104a104
call fcn.010b14cf
ret 4