Function at 0x10178aa0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x61c], ebx
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x620], edi
test edi, edi
je 0x10178ae5
push dword [ebp + 0x14]
mov eax, dword [edi]
push 0x200
push esi
push ebx
push edi
call dword [eax + 0x10]
push esi
push ebx
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b380
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 0x624], eax
test eax, eax
je 0x10178d9e
push 0x400
lea eax, [ebp - 0x60c]
mov dword [ebp - 0x618], 0
push 0
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x618]
push eax
push 0x200
lea eax, [ebp - 0x60c]
push eax
push ebx
call fcn.1001bd90
add esp, 0x28
test eax, eax
je 0x10178d26
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0x610]
call fcn.10002490
mov edi, dword [ebp - 0x610]
xor esi, esi
mov ebx, edi
movzx eax, word [edi]
test ax, ax
je 0x10178be1
mov ecx, eax
push ecx
push 0x10202944
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
je 0x10178b9d
test esi, esi
jne 0x10178b9f
mov esi, ebx
jmp 0x10178b9f
xor esi, esi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x10178b83
test esi, esi
je 0x10178be1
mov eax, dword [edi - 8]
sub esi, edi
sar esi, 1
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or ecx, eax
jge 0x10178bd8
push esi
lea ecx, [ebp - 0x610]
call fcn.10003310
mov edi, dword [ebp - 0x610]
xor eax, eax
mov dword [edi - 0xc], esi
mov word [edi + esi*2], ax
push dword [ebp - 0x614]
lea ecx, [ebp - 0x610]
call fcn.10002490
mov esi, dword [ebp - 0x610]
mov ebx, esi
movzx eax, word [esi]
test ax, ax
je 0x10178cca
mov ecx, eax
jmp 0x10178c10
push ecx
push 0x10202944
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
je 0x10178c30
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x10178c10
cmp ebx, esi
je 0x10178cca
mov eax, dword [esi - 8]
sub ebx, esi
mov edx, dword [esi - 0xc]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
sar ebx, 1
or ecx, eax
jge 0x10178c62
push edx
lea ecx, [ebp - 0x610]
call fcn.10003310
mov esi, dword [ebp - 0x610]
mov eax, dword [esi - 0xc]
lea edx, [esi + ebx*2]
mov ecx, eax
sub ecx, ebx
mov dword [ebp - 0x610], ecx
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10178cbb
test edx, edx
jne 0x10178c93
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.101e6c20
jmp 0x10178cbb
lea eax, [eax*2 + 2]
cmp eax, ecx
jae 0x10178cb0
call sub.msvcrt.dll__errno
mov dword [eax], 0x22
call fcn.101e6c20
jmp 0x10178cbb
push ecx
push edx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 0x610]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
push esi
push edi
push 0x102040c0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1000aa70
lea edx, [esi - 0x10]
add esp, 0x14
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10178cff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x10178d14
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x620]
mov esi, dword [ebp - 0x614]
mov ebx, dword [ebp - 0x61c]
cmp dword [ebp - 0x624], 5
jne 0x10178d6c
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x10178d6c
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jle 0x10178d62
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x618]
jmp 0x10178d64
push esi
push ebx
call fcn.100dc890
add esp, 8
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push edi
push eax
push esi
push ebx
push dword [ebp - 0x618]
call fcn.10179390
add esp, 0x18
test eax, eax
je 0x10178d9e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret