Function at 0x1005500
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x1024311
call fcn.0101d5b8
sub esp, 0x430
mov eax, dword [0x10290ac]
and dword [ebp - 0x428], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
push edi
mov dword [ebp - 0x438], eax
call fcn.010050aa
mov esi, eax
test esi, esi
jge 0x100555e
lea ecx, [ebp - 0x428]
call fcn.01005b81
mov eax, esi
jmp 0x1005ae5
push ebx
jmp 0x10056bc
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001638
push edi
mov dword [ebp - 0x430], 1
call esi
mov ebx, eax
neg ebx
push 0x100165c
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x1005597
test ebx, ebx
je 0x10056e4
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
cmp dword [ebp + 0x10], 0
je 0x10056e4
and dword [ebp - 0x424], 0
xor ecx, ecx
mov cx, word [edi]
mov byte [ebp - 4], 1
mov eax, edi
jmp 0x10055db
cmp cx, 0x5c
je 0x10055e2
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
test cx, cx
jne 0x10055cb
jmp 0x10055ea
test eax, eax
jne 0x1005afd
mov esi, 0x100150c
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1005626
add esi, 4
cmp esi, 0x100153c
jl 0x10055ef
mov eax, dword [ebp - 0x434]
push edi
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], eax
call fcn.01005c89
and dword [ebp - 0x424], 0
test ebx, ebx
je 0x10056cb
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.010050aa
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x1005b45
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01005c17
mov esi, eax
cmp esi, ebx
jl 0x1005b45
cmp dword [ebp - 0x424], ebx
mov byte [ebp - 4], bl
je 0x1005673
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [edi], 0x7b
jne 0x10056bc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10056bc
mov ecx, dword [ebp - 0x42c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x428]
push edi
call fcn.01005500
mov esi, eax
test esi, esi
jl 0x1005acd
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
cmp word [edi], 0x7d
jne 0x1005564
jmp 0x1005acd
cmp dword [ebp - 0x424], 0
mov byte [ebp - 4], 0
je 0x10056e4
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1001648
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005710
mov ecx, dword [ebp - 0x42c]
and dword [ebp - 0x430], eax
push edi
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
push 0x1001674
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005824
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x420]
push eax
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
cmp word [edi], 0x3d
jne 0x1005b34
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x10057a9
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], eax
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x430]
push eax
mov byte [ebp - 4], 2
call fcn.01005d4c
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x430], ebx
jl 0x1005b66
mov byte [ebp - 4], bl
jmp 0x1005673
cmp dword [ebp + 0x14], ebx
jne 0x100580f
cmp dword [ebp - 0x430], ebx
je 0x100580f
push 0x20006
push ebx
push dword [ebp - 0x434]
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], ebx
call fcn.01005b9f
cmp eax, ebx
jne 0x1005b3d
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x10057fb
cmp eax, 2
jne 0x1005b3d
cmp dword [ebp - 0x424], ebx
je 0x100580f
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.01005c17
mov esi, eax
cmp esi, ebx
jmp 0x10056b6
xor ecx, ecx
mov cx, word [edi]
mov eax, edi
xor esi, esi
jmp 0x100583f
cmp cx, 0x5c
je 0x1005846
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
cmp cx, si
jne 0x100582f
jmp 0x100584e
cmp eax, esi
jne 0x1005b19
cmp dword [ebp + 0x10], esi
je 0x100592c
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
call fcn.01005b9f
test eax, eax
je 0x10058e8
push 0x20019
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
call fcn.01005b9f
test eax, eax
je 0x10058e8
lea eax, [ebp - 0x43c]
push eax
xor ebx, ebx
lea eax, [ebp - 0x430]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x434]
mov dword [ebp - 0x430], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x1005b5e
xor eax, eax
cmp dword [ebp - 0x428], ebx
je 0x10058d4
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [ebp - 0x430]
mov dword [ebp - 0x428], ecx
jne 0x1005b5e
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
cmp word [edi], 0x3d
jne 0x1005673
mov ecx, dword [ebp - 0x42c]
push edi
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.01005d4c
mov esi, eax
test esi, esi
jl 0x1005acd
jmp 0x1005673
cmp dword [ebp + 0x14], esi
jne 0x1005950
push 0x20019
push edi
push dword [ebp - 0x434]
lea ecx, [ebp - 0x428]
call fcn.01005b9f
mov dword [ebp - 0x424], eax
jmp 0x100595a
mov dword [ebp - 0x424], 2
cmp dword [ebp - 0x424], esi
je 0x1005969
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ebx, dword [ebp - 0x42c]
push edi
mov ecx, ebx
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
push edi
mov ecx, ebx
call fcn.01005c17
mov esi, eax
test esi, esi
jl 0x1005acd
cmp word [edi], 0x7b
jne 0x10059e1
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x428]
push edi
call fcn.01005500
mov esi, eax
test esi, esi
jge 0x10059cf
cmp dword [ebp + 0x14], 0
je 0x1005acd
push edi
mov ecx, ebx
call fcn.010050aa
mov esi, eax
test esi, esi
jl 0x1005acd
cmp dword [ebp - 0x424], 2
mov eax, dword [ebp - 0x438]
mov dword [ebp + 0x14], eax
je 0x10056bc
xor ebx, ebx
cmp dword [ebp - 0x424], ebx
je 0x1005a14
cmp eax, ebx
jne 0x10056bc
push dword [ebp - 0x424]
jmp 0x1005ac6
cmp dword [ebp - 0x438], ebx
je 0x1005a7c
push dword [ebp - 0x428]
mov ecx, dword [ebp - 0x42c]
call fcn.01005bdb
test eax, eax
je 0x1005a7c
mov ebx, 0x100150c
push dword [ebx]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10056bc
add ebx, 4
cmp ebx, 0x100153c
jl 0x1005a36
cmp dword [ebp - 0x430], 0
je 0x10056bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.01005c89
jmp 0x10056bc
cmp dword [ebp - 0x428], ebx
je 0x1005a9e
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov dword [ebp - 0x428], ebx
jne 0x1005b71
cmp dword [ebp - 0x430], ebx
je 0x10056bc
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x10056bc
push eax
call fcn.01002ee0
mov esi, eax
cmp dword [ebp - 0x428], 0
je 0x1005ae2
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0101d1cf
leave
ret 0x10
xor esi, esi
cmp dword [ebp - 0x424], esi
je 0x1005b19
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x424], esi
cmp dword [ebp - 0x428], esi
je 0x1005b2d
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x1005ae4
cmp dword [ebp - 0x428], 0
jmp 0x1005b1f
push eax
call fcn.01002ee0
mov esi, eax
cmp dword [ebp - 0x424], ebx
je 0x1005acd
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1005acd
push eax
call fcn.01002ee0
mov esi, eax
cmp dword [ebp - 0x428], ebx
jmp 0x1005ad4
push eax
call fcn.01002ee0
jmp 0x1005ae4