Function at 0x1000a5a5
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1003b164]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x230], eax
call fcn.100084f7
mov esi, eax
cmp esi, ebx
jl 0x1000a606
cmp word [edi], 0x7d
jne 0x1000a633
lea ecx, [ebp - 0x218]
call fcn.10007f3c
lea ecx, [ebp - 0x22c]
call fcn.10008ada
mov eax, esi
lea esp, [ebp - 0x23c]
mov ecx, dword [ebp - 4]
call fcn.10023cf0
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1000a758
push edi
call esi
mov ebx, eax
neg ebx
push 0x1000a768
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x1000a65c
test ebx, ebx
je 0x1000a78b
mov ecx, dword [ebp - 0x214]
push edi
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000a606
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1000a78b
push 0x5c
push edi
mov dword [ebp - 0x210], esi
call fcn.100083d4
test eax, eax
jne 0x1000ab9b
mov ecx, dword [ebp - 0x214]
push edi
call fcn.10008610
test eax, eax
je 0x1000a6bd
mov eax, dword [ebp - 0x21c]
push edi
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], eax
call fcn.1000927c
mov dword [ebp - 0x210], esi
cmp ebx, esi
je 0x1000a780
mov ecx, dword [ebp - 0x214]
push edi
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000abc0
mov ecx, dword [ebp - 0x214]
push edi
call fcn.1000870d
lea ecx, [ebp - 0x210]
mov esi, eax
call fcn.10007f3c
test esi, esi
jl 0x1000a606
cmp dword [ebp + 0x10], 0
je 0x1000a600
cmp word [edi], 0x7b
jne 0x1000a600
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1000a600
mov ecx, dword [ebp - 0x214]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x218]
push edi
call fcn.1000a5a5
mov esi, eax
test esi, esi
jl 0x1000a606
mov ecx, dword [ebp - 0x214]
push edi
call fcn.100084f7
mov esi, eax
test esi, esi
jmp 0x1000a5fe
lea ecx, [ebp - 0x210]
call fcn.10007f3c
push 0x1000a854
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000a7b7
mov ecx, dword [ebp - 0x214]
and dword [ebp - 0x228], eax
push edi
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000a606
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1000a868
push edi
xor ebx, ebx
call esi
test eax, eax
jne 0x1000a8d6
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
call fcn.100084f7
mov esi, eax
cmp esi, ebx
jl 0x1000a606
mov ecx, dword [ebp - 0x214]
push edi
call fcn.100084f7
mov esi, eax
cmp esi, ebx
jl 0x1000a606
cmp word [edi], 0x3d
jne 0x1000aba6
cmp dword [ebp + 0x10], ebx
je 0x1000a870
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x214]
push ebx
mov dword [ebp - 0x210], eax
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000a302
lea ecx, [ebp - 0x210]
mov esi, eax
mov dword [ebp - 0x210], ebx
call fcn.10007f3c
cmp esi, ebx
jmp 0x1000a6f6
cmp dword [ebp + 0x14], ebx
jne 0x1000a8c5
push 0x20006
push ebx
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
call fcn.10007faf
cmp eax, ebx
jne 0x1000abb2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x1000a8ba
cmp eax, 2
jne 0x1000abb0
lea ecx, [ebp - 0x210]
call fcn.10007f3c
mov ecx, dword [ebp - 0x214]
push edi
call fcn.1000870d
jmp 0x1000a5fa
push 0x5c
push edi
call fcn.100083d4
test eax, eax
jne 0x1000aba6
cmp dword [ebp + 0x10], ebx
je 0x1000a9b3
push 0xf003f
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.10007faf
test eax, eax
je 0x1000a948
push 0x20019
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.10007faf
test eax, eax
je 0x1000a948
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.10007f5a
test eax, eax
jne 0x1000aba6
mov ax, word [edi]
cmp ax, 0x4c
mov byte [ebp - 0x224], 0
je 0x1000a95e
cmp ax, 0x6c
jne 0x1000a971
push 0x100020a4
push edi
call esi
test eax, eax
jne 0x1000a971
mov byte [ebp - 0x224], 1
mov ecx, dword [ebp - 0x214]
push edi
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000a606
cmp word [edi], 0x3d
jne 0x1000a6fc
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x214]
push edi
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1000a302
mov esi, eax
jmp 0x1000a6f4
cmp dword [ebp + 0x14], ebx
jne 0x1000a9da
push 0x20019
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.10007faf
test eax, eax
je 0x1000a9da
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0x220], ebx
jne 0x1000aa0e
mov esi, 0x208
push esi
call fcn.10007cb7
test al, al
je 0x1000aace
mov eax, esi
call fcn.10001a44
mov dword [ebp - 0x220], esp
cmp dword [ebp - 0x220], ebx
je 0x1000abd0
push 0x104
push edi
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x14], ebx
jne 0x1000aa53
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
call fcn.10008646
test eax, eax
jne 0x1000aa53
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
call fcn.10008682
test eax, eax
je 0x1000ab39
mov ebx, dword [ebp - 0x214]
push edi
mov ecx, ebx
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000a606
push edi
mov ecx, ebx
call fcn.1000870d
mov esi, eax
test esi, esi
jl 0x1000a606
cmp word [edi], 0x7b
jne 0x1000aae5
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x218]
push edi
call fcn.1000a5a5
mov esi, eax
test esi, esi
jl 0x1000a606
cmp dword [ebp + 0x14], 0
je 0x1000aaf5
mov eax, dword [ebp - 0x230]
push edi
mov ecx, ebx
mov dword [ebp + 0x14], eax
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000a606
push edi
mov ecx, ebx
call fcn.1000870d
jmp 0x1000a74d
push esi
lea ecx, [ebp - 0x22c]
call fcn.10009e94
mov dword [ebp - 0x220], eax
jmp 0x1000aa02
cmp dword [ebp + 0x14], 0
jne 0x1000a600
mov ebx, dword [ebp - 0x214]
push dword [ebp - 0x218]
mov ecx, ebx
call fcn.10008646
test eax, eax
je 0x1000ab2f
push dword [ebp - 0x220]
mov ecx, ebx
call fcn.10008610
test eax, eax
je 0x1000ab28
push dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
call fcn.1000927c
mov ecx, ebx
jmp 0x1000a747
cmp dword [ebp + 0x14], 0
jne 0x1000a600
lea ecx, [ebp - 0x218]
call fcn.10007f3c
test eax, eax
jne 0x1000aba6
cmp dword [ebp - 0x228], eax
je 0x1000ab74
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0x210], 0
lea ecx, [ebp - 0x210]
call fcn.10007f3c
mov ecx, dword [ebp - 0x214]
push edi
call fcn.100084f7
mov esi, eax
test esi, esi
jl 0x1000a606
mov ecx, dword [ebp - 0x214]
push edi
call fcn.1000870d
jmp 0x1000a9ac
lea ecx, [ebp - 0x210]
call fcn.10007f3c
mov esi, 0x80020009
jmp 0x1000a606
cmp eax, ebx
jle 0x1000abbe
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x210]
call fcn.10007f3c
jmp 0x1000a606
mov esi, 0x8007000e
jmp 0x1000a606