Function at 0x10114a1b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017b294
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.1012ba20
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x2220], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x221c], ecx
xor ecx, ecx
mov dword [ebp - 0x2240], ecx
mov dword [ebp - 0x223c], ecx
mov dword [ebp - 0x2238], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
jmp 0x10114fd8
push str.Delete
push edi
mov dword [ebp - 0x2224], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x101be86c
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10114ab2
test ebx, ebx
je 0x10114b93
mov ecx, dword [ebp - 0x2220]
push edi
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
cmp dword [ebp + 0x10], 0
je 0x10114b93
xor eax, eax
mov dword [ebp - 0x2234], eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov byte [ebp - 4], 1
push 0x5c
push edi
call fcn.10115538
pop ecx
pop ecx
test eax, eax
jne 0x10114ffe
mov ecx, dword [ebp - 0x2220]
push edi
call fcn.1011257b
test eax, eax
je 0x10114b47
mov eax, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2234]
and dword [ebp - 0x2230], 0
and dword [ebp - 0x222c], 0
push edi
mov dword [ebp - 0x2234], eax
call fcn.101145ec
and dword [ebp - 0x2234], 0
and dword [ebp - 0x2230], 0
and dword [ebp - 0x222c], 0
test ebx, ebx
je 0x10114b84
mov ebx, dword [ebp - 0x2220]
mov ecx, ebx
push edi
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10114ff2
push edi
mov ecx, ebx
call fcn.101154b1
mov esi, eax
test esi, esi
js 0x10114ff2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2234]
jmp 0x10114f9e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2234]
call fcn.100643a8
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x2220]
test eax, eax
jne 0x10114bc1
and dword [ebp - 0x2224], eax
mov ecx, ebx
push edi
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
push 0x101be864
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10114d05
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
push edi
mov ecx, ebx
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
push 0x3d
pop eax
cmp word [edi], ax
jne 0x1011500d
cmp dword [ebp + 0x10], 0
je 0x10114c83
xor ecx, ecx
mov dword [ebp - 0x2250], ecx
mov dword [ebp - 0x224c], ecx
mov dword [ebp - 0x2248], ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x2250], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2250]
mov dword [ebp - 0x224c], ecx
mov dword [ebp - 0x2248], ecx
mov ecx, ebx
push eax
call fcn.10111d0f
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
test esi, esi
js 0x1011503f
mov byte [ebp - 4], al
lea ecx, [ebp - 0x2250]
jmp 0x10114f9e
cmp dword [ebp + 0x14], 0
jne 0x10114cf8
cmp dword [ebp - 0x2224], 0
je 0x10114cf8
xor eax, eax
mov dword [ebp - 0x2268], eax
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2260], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2268]
push 0x20006
push eax
push dword [ebp - 0x221c]
call fcn.10068561
test eax, eax
jne 0x1011504a
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2268]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10114ce9
cmp eax, 2
jne 0x1011504a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2268]
call fcn.100643a8
push edi
mov ecx, ebx
call fcn.101154b1
jmp 0x10114fde
push 0x5c
push edi
call fcn.10115538
pop ecx
pop ecx
test eax, eax
jne 0x1011500d
cmp dword [ebp + 0x10], eax
je 0x10114db0
mov esi, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2240]
push 0x2001f
push edi
push esi
call fcn.10068561
test eax, eax
je 0x10114d72
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2240]
call fcn.10068561
test eax, eax
je 0x10114d72
xor eax, eax
lea ecx, [ebp - 0x2240]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.101126f3
test eax, eax
jne 0x10114e9a
push edi
mov ecx, ebx
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
push 0x3d
pop eax
cmp word [edi], ax
jne 0x10114fa3
push edi
push 0
lea eax, [ebp - 0x2240]
mov ecx, ebx
push eax
call fcn.10111d0f
mov esi, eax
test esi, esi
js 0x10115012
jmp 0x10114fa3
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x10114dd0
push 0x20019
push edi
push dword [ebp - 0x221c]
lea ecx, [ebp - 0x2240]
call fcn.10068561
jmp 0x10114dd3
push 2
pop eax
mov dword [ebp - 0x2228], eax
mov dword [ebp - 0x2244], esi
test eax, eax
je 0x10114ded
mov dword [ebp - 0x2244], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.101378ba
push eax
call fcn.100074fe
add esp, 0x14
mov ecx, ebx
push edi
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
push edi
mov ecx, ebx
call fcn.101154b1
mov esi, eax
test esi, esi
js 0x10115012
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10114e7d
push edi
call fcn.10130fe5
pop ecx
cmp eax, 1
jne 0x10114e7d
push dword [ebp - 0x2244]
mov ecx, ebx
push 0
push dword [ebp - 0x2240]
push edi
call fcn.10114a1b
mov esi, eax
test esi, esi
jns 0x10114e6b
cmp dword [ebp - 0x2244], 0
je 0x10115012
push edi
mov ecx, ebx
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
mov eax, dword [ebp - 0x2228]
cmp eax, 2
je 0x10114fe4
test eax, eax
je 0x10114ea8
cmp dword [ebp + 0x14], 0
jne 0x10114fe4
push eax
call fcn.1011233b
pop ecx
mov esi, eax
jmp 0x10115012
cmp dword [ebp + 0x14], 0
je 0x10114ef9
push dword [ebp - 0x2240]
mov ecx, ebx
call fcn.101134b6
test eax, eax
je 0x10114ef9
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.1011257b
test eax, eax
je 0x10114fe4
cmp dword [ebp - 0x2224], 0
je 0x10114fe4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2240]
call fcn.101145ec
jmp 0x10114fe4
push dword [ebp - 0x2240]
mov ecx, ebx
call fcn.101134b6
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2228], eax
call fcn.100643a8
test eax, eax
jne 0x10114e9a
cmp dword [ebp - 0x2224], eax
je 0x10114fe4
cmp dword [ebp - 0x2228], eax
jne 0x10114fe4
xor ecx, ecx
mov dword [ebp - 0x225c], ecx
mov dword [ebp - 0x2258], ecx
mov dword [ebp - 0x2254], ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x225c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2258], ecx
mov dword [ebp - 0x2254], ecx
lea ecx, [ebp - 0x225c]
push eax
call fcn.10112bb2
xor ecx, ecx
mov dword [ebp - 0x225c], ecx
mov dword [ebp - 0x2258], ecx
mov dword [ebp - 0x2254], ecx
test eax, eax
jne 0x10115064
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x225c]
call fcn.100643a8
cmp dword [ebp + 0x10], 0
je 0x10114fe4
push 0x7b
pop eax
cmp word [edi], ax
jne 0x10114fe4
push edi
call fcn.10130fe5
pop ecx
cmp eax, 1
jne 0x10114fe4
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2240]
push edi
call fcn.10114a1b
mov esi, eax
test esi, esi
js 0x10115012
mov ecx, ebx
push edi
call fcn.1011414f
mov esi, eax
test esi, esi
js 0x10115012
push 0x7d
pop eax
cmp word [edi], ax
jne 0x10114a7f
jmp 0x10115012
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2234]
jmp 0x1011505d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2234]
call fcn.100643a8
mov esi, 0x80020009
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2240]
call fcn.100643a8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012b632
leave
ret 0x10
mov byte [ebp - 4], al
lea ecx, [ebp - 0x2250]
jmp 0x1011505d
push eax
call fcn.1011233b
pop ecx
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2268]
call fcn.100643a8
jmp 0x10115012
push eax
call fcn.1011233b
pop ecx
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x225c]
jmp 0x1011505d