Function at 0x10032ec
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1006060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
push edi
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x230], eax
call fcn.01002024
mov esi, eax
cmp esi, ebx
jge 0x1003892
lea ecx, [ebp - 0x218]
call fcn.01001af3
lea ecx, [ebp - 0x228]
call fcn.0100270c
mov eax, esi
lea esp, [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01004723
leave
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x10011f8
push edi
call esi
mov ebx, eax
neg ebx
push 0x100121c
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x10033a5
test ebx, ebx
je 0x100344b
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x100344d
push 0x5c
push edi
mov dword [ebp - 0x210], esi
call fcn.01001eff
test eax, eax
jne 0x10038a1
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002134
test eax, eax
je 0x1003406
mov eax, dword [ebp - 0x21c]
push edi
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], eax
call fcn.010027b8
mov dword [ebp - 0x210], esi
cmp ebx, esi
je 0x100343e
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x10038c6
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002231
lea ecx, [ebp - 0x210]
mov esi, eax
call fcn.01001af3
jmp 0x100383b
lea ecx, [ebp - 0x210]
call fcn.01001af3
jmp 0x100344d
xor esi, esi
push 0x1001208
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100347b
mov ecx, dword [ebp - 0x214]
and dword [ebp - 0x22c], eax
push edi
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001234
push edi
call ebx
test eax, eax
jne 0x1003580
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
call fcn.01002024
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x100334d
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002024
mov esi, eax
cmp esi, ebx
jl 0x100334d
cmp word [edi], 0x3d
jne 0x10038ac
cmp dword [ebp + 0x10], ebx
je 0x1003515
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x214]
push ebx
mov dword [ebp - 0x210], eax
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.01002ff8
lea ecx, [ebp - 0x210]
mov esi, eax
mov dword [ebp - 0x210], ebx
call fcn.01001af3
cmp esi, ebx
jmp 0x100383d
cmp dword [ebp + 0x14], ebx
jne 0x100356b
push ebx
push 0x20006
push ebx
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
call fcn.01001b66
cmp eax, ebx
jne 0x10038b8
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x1003560
cmp eax, 2
jne 0x10038b6
lea ecx, [ebp - 0x210]
call fcn.01001af3
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002231
mov esi, eax
cmp esi, ebx
jmp 0x100388c
push 0x5c
push edi
call fcn.01001eff
test eax, eax
jne 0x10038ac
cmp dword [ebp + 0x10], esi
je 0x100365d
push esi
push 0xf003f
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.01001b66
test eax, eax
je 0x10035f4
push esi
push 0x20019
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.01001b66
test eax, eax
je 0x10035f4
push esi
push esi
push 0x2001f
push esi
push esi
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.01001b11
test eax, eax
jne 0x10038ac
movzx eax, word [edi]
cmp ax, 0x4c
mov byte [ebp - 0x224], 0
je 0x100360a
cmp ax, 0x6c
jne 0x100361d
push 0x10014b8
push edi
call ebx
test eax, eax
jne 0x100361d
mov byte [ebp - 0x224], 1
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
cmp word [edi], 0x3d
jne 0x1003843
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x214]
push edi
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.01002ff8
jmp 0x1003839
cmp dword [ebp + 0x14], esi
jne 0x1003685
push esi
push 0x20019
push edi
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.01001b66
test eax, eax
je 0x1003685
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0x220], esi
jne 0x10036c9
mov ebx, 0x208
push ebx
call fcn.01001930
test al, al
je 0x10036ab
mov eax, ebx
call fcn.01004810
mov dword [ebp - 0x220], esp
jmp 0x10036bd
push ebx
lea ecx, [ebp - 0x228]
call fcn.01002faa
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], esi
je 0x10038d6
push 0x104
push edi
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x14], esi
jne 0x100370e
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
call fcn.0100216a
test eax, eax
jne 0x100370e
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
call fcn.010021a6
test eax, eax
je 0x10037d9
mov ebx, dword [ebp - 0x214]
push edi
mov ecx, ebx
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
push edi
mov ecx, ebx
call fcn.01002231
mov esi, eax
test esi, esi
jl 0x100334d
cmp word [edi], 0x7b
jne 0x1003789
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x218]
push edi
call fcn.010032ec
mov esi, eax
test esi, esi
jl 0x100334d
cmp dword [ebp + 0x14], 0
je 0x1003793
mov eax, dword [ebp - 0x230]
push edi
mov ecx, ebx
mov dword [ebp + 0x14], eax
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
push edi
mov ecx, ebx
call fcn.01002231
jmp 0x1003888
cmp dword [ebp + 0x14], 0
jne 0x1003892
push dword [ebp - 0x218]
mov ecx, ebx
call fcn.0100216a
test eax, eax
je 0x10037cd
push dword [ebp - 0x220]
mov ecx, ebx
call fcn.01002134
test eax, eax
je 0x10037c6
push dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
call fcn.010027b8
mov ecx, ebx
jmp 0x1003882
cmp dword [ebp + 0x14], 0
jne 0x1003892
xor esi, esi
lea ecx, [ebp - 0x218]
call fcn.01001af3
test eax, eax
jne 0x10038ac
cmp dword [ebp - 0x22c], esi
je 0x1003817
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], esi
call fcn.01001af3
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002231
mov esi, eax
test esi, esi
jl 0x100334d
cmp dword [ebp + 0x10], 0
je 0x1003892
cmp word [edi], 0x7b
jne 0x1003892
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1003892
mov ecx, dword [ebp - 0x214]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x218]
push edi
call fcn.010032ec
mov esi, eax
test esi, esi
jl 0x100334d
mov ecx, dword [ebp - 0x214]
push edi
call fcn.01002024
mov esi, eax
test esi, esi
jl 0x100334d
cmp word [edi], 0x7d
jne 0x100337c
jmp 0x100334d
lea ecx, [ebp - 0x210]
call fcn.01001af3
mov esi, 0x80020009
jmp 0x100334d
cmp eax, ebx
jle 0x10038c4
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x210]
call fcn.01001af3
jmp 0x100334d
mov esi, 0x8007000e
jmp 0x100334d