Function at 0x10018938
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073197
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10018aa2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x10018a87
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x54], 0x17a5
cmp dword [ebp - 0x54], 0x592
jge 0x10018a4b
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x10663c90
call fcn.1002d0b9
lea ecx, [ebp - 0xa0]
call fcn.1002cf04
and dword [ebp - 4], 0
and dword [ebp - 0x24], 0
jmp 0x100189c0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jge 0x100189d7
push 0x61
lea ecx, [ebp - 0xa0]
call fcn.1002cf96
jmp 0x100189b9
mov dword [ebp - 0x18], 2
jmp 0x100189e9
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jge 0x10018a20
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa0]
call fcn.1002cfd8
mov byte [eax], 0x62
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, dword [ebp - 0x2c]
jge 0x10018a1e
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.1002cfd8
mov byte [eax], 0x62
jmp 0x100189e0
push fcn.10031f18
lea edx, [ebp - 0xa0]
mov ecx, 0x10663bd8
call fcn.10032001
mov ecx, eax
call fcn.1002d4d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.1002cf8c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 2
jmp 0x10018a67
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jl 0x10018a85
mov byte [ebp - 0x13], 0
movzx eax, byte [ebp - 0x13]
test eax, eax
je 0x10018a83
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
jmp 0x10018a5c
jmp 0x10018a9d
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10018a9d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10018c68
mov dword [ebp - 0x10], 0xbd035c57
mov dword [ebp - 0x6c], 0x6fda0246
mov dword [ebp - 0x40], 0xbc35
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x84], 0x7f17245c
mov dword [ebp - 0x80], 0x7f17245c
mov dword [ebp - 0x7c], 0x7f17245c
mov dword [ebp - 0x78], 0x7f17245c
lea ecx, [ebp - 0x25]
call fcn.1002d803
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0xb4]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xac]
call fcn.1002d7c0
cmp dword [ebp - 0x10], 0
je 0x10018b2b
mov eax, 0xffff
test eax, eax
je 0x10018b2b
mov dword [ebp - 0x38], 1
jmp 0x10018b2f
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 4
jne 0x10018b3e
mov dword [ebp - 0x44], 1
jmp 0x10018b42
and dword [ebp - 0x44], 0
cmp dword [ebp - 0x44], 0x52aa
jg 0x10018b54
mov dword [ebp - 0x3c], 1
jmp 0x10018b58
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jg 0x10018b7c
mov dword [ebp - 0x34], 1
jmp 0x10018b80
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x34]
je 0x10018b91
mov dword [ebp - 0x30], 1
jmp 0x10018b95
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 0xfffffffa
jge 0x10018ba4
mov dword [ebp - 0x68], 1
jmp 0x10018ba8
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x1c], 0
jne 0x10018bbb
cmp dword [ebp - 0x10], 0
cmp dword [ebp - 0x1c], 0
je 0x10018bd0
cmp dword [ebp - 0x40], 0
je 0x10018bd0
mov dword [ebp - 0x48], 1
jmp 0x10018bd4
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x48], eax
jle 0x10018be5
mov dword [ebp - 0x50], 1
jmp 0x10018be9
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
jmp 0x10018bff
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10018c4f
mov dword [ebp - 0x58], 0xfffe
mov dword [ebp - 0x5c], 0xfffffffe
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10018c27
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x10], 0
jmp 0x10018c37
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x10018c4d
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x5c], 1
jmp 0x10018c30
jmp 0x10018bf8
lea ecx, [ebp - 0xac]
call fcn.1002d7e6
push 0
push 0x482a
call fcn.100148bc
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret