Function at 0x1000b010
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x2254
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x2250], eax
mov eax, dword [esp + 0x225c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x2264]
mov ebp, ecx
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b649
cmp word [edi], 0x7d
push ebx
je 0x1000b637
nop word [eax + eax]
push str.Delete
push edi
mov dword [esp + 0x2c], 1
call dword [sym.imp.kernel32.dll_lstrcmpiW]
neg eax
push 0x1003e6d0
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x1000b0b1
test ebx, ebx
je 0x1000b1af
push edi
mov ecx, ebp
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
cmp dword [esp + 0x2270], 0
je 0x1000b1af
movzx ecx, word [edi]
mov eax, edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
test cx, cx
je 0x1000b116
mov edx, ecx
cmp dx, 0x5c
je 0x1000b10e
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x1000b0f5
jmp 0x1000b116
test eax, eax
jne 0x1000b5fb
mov esi, 0x100402b8
nop dword [eax + eax]
push dword [esi]
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x1000b172
add esi, 4
cmp esi, 0x100402e8
jl 0x1000b120
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call fcn.10003b40
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
test ebx, ebx
je 0x1000b1a7
push edi
mov ecx, ebp
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b60b
push edi
mov ecx, ebp
call fcn.1000b6c0
mov esi, eax
test esi, esi
js 0x1000b60b
mov dword [esp + 0x2c], 0
jmp 0x1000b3dc
mov dword [esp + 0x2c], 0
push str.NoRemove
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
jne 0x1000b1d9
xor ebx, ebx
mov ecx, ebp
push edi
mov dword [esp + 0x28], ebx
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
jmp 0x1000b1dd
mov ebx, dword [esp + 0x24]
push 0x1003e6c8
push edi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
jne 0x1000b321
lea eax, [esp + 0x260]
mov ecx, ebp
push eax
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
push edi
mov ecx, ebp
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
cmp word [edi], 0x3d
jne 0x1000b604
cmp dword [esp + 0x2270], 0
je 0x1000b28d
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x260]
push edi
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], ebx
push eax
mov ecx, ebp
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.10009f90
mov esi, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
test esi, esi
jns 0x1000b3dc
lea ecx, [esp + 0x40]
call fcn.100036e0
jmp 0x1000b637
cmp dword [esp + 0x2274], 0
jne 0x1000b30a
test ebx, ebx
je 0x1000b30a
push 0x20006
push 0
push dword [esp + 0x1c]
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.10003a10
test eax, eax
jne 0x1000b616
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x260]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1000b2ef
cmp eax, 2
jne 0x1000b616
test esi, esi
je 0x1000b302
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
push edi
mov ecx, ebp
call fcn.1000b6c0
mov esi, eax
test esi, esi
js 0x1000b637
jmp 0x1000b5ef
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x1000b351
mov edx, ecx
nop dword [eax]
cmp dx, 0x5c
je 0x1000b349
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x1000b330
jmp 0x1000b351
test eax, eax
jne 0x1000b604
cmp dword [esp + 0x2270], 0
je 0x1000b43e
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0x2001f
push edi
push ebx
call fcn.10003a10
test eax, eax
je 0x1000b3ab
push 0x20019
push edi
push ebx
lea ecx, [esp + 0x24]
call fcn.10003a10
test eax, eax
je 0x1000b3ab
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push ebx
lea ecx, [esp + 0x34]
call fcn.10006260
test eax, eax
jne 0x1000b62c
push edi
mov ecx, ebp
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
cmp word [edi], 0x3d
jne 0x1000b3dc
push edi
push 0
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
call fcn.10009f90
mov esi, eax
test esi, esi
js 0x1000b637
cmp word [edi], 0x7b
jne 0x1000b5ef
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000b3f0
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x1000b5ef
push 0
push dword [esp + 0x2274]
mov ecx, ebp
push dword [esp + 0x20]
push edi
call fcn.1000b010
mov esi, eax
test esi, esi
js 0x1000b637
push edi
mov ecx, ebp
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
jmp 0x1000b5ef
mov ebp, dword [esp + 0x2274]
test ebp, ebp
jne 0x1000b460
push 0x20019
push edi
push dword [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.10003a10
mov ebx, eax
jmp 0x1000b465
mov ebx, 2
push 0xffffffffffffffff
test ebx, ebx
mov eax, 1
push edi
cmovne ebp, eax
lea eax, [esp + 0x60]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push eax
call fcn.1000a520
mov ecx, dword [esp + 0x24]
add esp, 0x14
push edi
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
mov ecx, dword [esp + 0x10]
push edi
call fcn.1000b6c0
mov esi, eax
test esi, esi
js 0x1000b637
cmp word [edi], 0x7b
jne 0x1000b50b
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000b4c0
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x1000b50b
mov ecx, dword [esp + 0x10]
push ebp
push 0
push dword [esp + 0x20]
push edi
call fcn.1000b010
mov esi, eax
test esi, esi
jns 0x1000b4f3
test ebp, ebp
je 0x1000b637
mov ebp, dword [esp + 0x10]
mov ecx, ebp
push edi
call fcn.1000a830
mov esi, eax
test esi, esi
js 0x1000b637
jmp 0x1000b50f
mov ebp, dword [esp + 0x10]
cmp ebx, 2
je 0x1000b5ef
test ebx, ebx
je 0x1000b530
cmp dword [esp + 0x2274], 0
jne 0x1000b5ef
push ebx
jmp 0x1000b62d
cmp dword [esp + 0x2274], 0
je 0x1000b578
push dword [esp + 0x18]
mov ecx, ebp
call fcn.1000a7d0
test eax, eax
je 0x1000b578
lea eax, [esp + 0x58]
mov ecx, ebp
push eax
call fcn.1000a600
test eax, eax
je 0x1000b5ef
cmp dword [esp + 0x24], 0
je 0x1000b5ef
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003b40
jmp 0x1000b5ef
push dword [esp + 0x18]
mov ecx, ebp
call fcn.1000a7d0
mov ecx, dword [esp + 0x18]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x1000b59c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x1000b62c
cmp dword [esp + 0x24], eax
je 0x1000b5ef
test ebx, ebx
jne 0x1000b5ef
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.10003850
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov ebx, eax
call fcn.100036e0
test ebx, ebx
jne 0x1000b52a
cmp word [edi], 0x7d
jne 0x1000b080
jmp 0x1000b637
lea ecx, [esp + 0x28]
call fcn.100036e0
mov esi, 0x80020009
jmp 0x1000b637
lea ecx, [esp + 0x28]
call fcn.100036e0
jmp 0x1000b637
push eax
call fcn.1000a5e0
add esp, 4
lea ecx, [esp + 0x34]
mov esi, eax
call fcn.100036e0
jmp 0x1000b637
push eax
call fcn.1000a5e0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x18]
pop ebx
test eax, eax
je 0x1000b647
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x225c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2254
ret 0x10