Function at 0x1006a3e
Capabilities:
Delete registry value

Disassembly:
push 0x164
mov eax, 0x10137ac
call fcn.01008318
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 1
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x170], eax
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jge 0x1007022
lea ecx, [ebp - 0x12c]
call fcn.01005138
lea ecx, [ebp - 0x140]
call fcn.01005d67
mov eax, esi
lea esp, [ebp - 0x180]
call fcn.0100836c
ret 0x10
push 0x1001440
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
neg esi
sbb esi, esi
push 0x1001454
inc esi
push edi
mov dword [ebp - 0x160], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006b00
cmp esi, ebx
je 0x1006bc6
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
cmp dword [ebp + 0x10], ebx
je 0x1006bc6
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
push 0x5c
push edi
mov byte [ebp - 4], 2
call fcn.0100557d
test eax, eax
jne 0x1007030
mov ecx, dword [ebp - 0x118]
push edi
call fcn.01005781
test eax, eax
je 0x1006b6f
mov eax, dword [ebp - 0x120]
push edi
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x138], eax
call fcn.01006009
mov dword [ebp - 0x138], ebx
cmp dword [ebp - 0x160], ebx
je 0x1006bb7
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1007045
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100587a
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x138]
jl 0x1007063
mov byte [ebp - 4], 1
call fcn.01005138
jmp 0x1006fe1
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 1
call fcn.01005138
push 0x1001448
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1006bf2
mov ecx, dword [ebp - 0x118]
push edi
mov dword [ebp - 0x13c], ebx
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x1001460
push edi
call esi
test eax, eax
jne 0x1006d06
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
push eax
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
cmp byte [edi], 0x3d
jne 0x100703b
cmp dword [ebp + 0x10], ebx
je 0x1006c93
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x118]
push ebx
mov dword [ebp - 0x15c], eax
push edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x15c]
push eax
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
call fcn.01006527
lea ecx, [ebp - 0x15c]
mov esi, eax
mov dword [ebp - 0x15c], ebx
call fcn.01005138
jmp 0x1006fd9
cmp dword [ebp + 0x14], ebx
jne 0x1006cf5
push ebx
push 0x20006
push ebx
push dword [ebp - 0x120]
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
call fcn.010051ab
cmp eax, ebx
jne 0x100704f
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x1006cea
cmp eax, 2
jne 0x100704d
lea ecx, [ebp - 0x150]
call fcn.01005138
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100587a
jmp 0x1006a9f
push 0x5c
push edi
call fcn.0100557d
test eax, eax
jne 0x100703b
cmp dword [ebp + 0x10], ebx
je 0x1006ddb
push ebx
push 0xf003f
push edi
push dword [ebp - 0x120]
lea ecx, [ebp - 0x12c]
call fcn.010051ab
test eax, eax
je 0x1006d7a
push ebx
push 0x20019
push edi
push dword [ebp - 0x120]
lea ecx, [ebp - 0x12c]
call fcn.010051ab
test eax, eax
je 0x1006d7a
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push edi
push dword [ebp - 0x120]
lea ecx, [ebp - 0x12c]
call fcn.01005156
test eax, eax
jne 0x100703b
mov al, byte [edi]
mov byte [ebp - 0x144], bl
cmp al, 0x4c
je 0x1006d8a
cmp al, 0x6c
jne 0x1006d9d
push 0x1001854
push edi
call esi
test eax, eax
jne 0x1006d9d
mov byte [ebp - 0x144], 1
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
cmp byte [edi], 0x3d
jne 0x1006fe1
push dword [ebp - 0x144]
mov ecx, dword [ebp - 0x118]
push edi
push ebx
lea eax, [ebp - 0x12c]
push eax
call fcn.01006527
jmp 0x1006fd7
cmp dword [ebp + 0x14], ebx
jne 0x1006e03
push ebx
push 0x20019
push edi
push dword [ebp - 0x120]
lea ecx, [ebp - 0x12c]
call fcn.010051ab
test eax, eax
je 0x1006e03
mov dword [ebp + 0x14], 1
mov esi, 0x104
cmp dword [ebp - 0x11c], ebx
jne 0x1006e47
push esi
call fcn.01004e4c
test al, al
je 0x1006e29
mov eax, esi
call fcn.01008500
mov dword [ebp - 0x11c], esp
jmp 0x1006e3b
push esi
lea ecx, [ebp - 0x140]
call fcn.0100620b
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], ebx
je 0x100706d
push esi
push edi
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp + 0x14], ebx
jne 0x1006e88
push dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x118]
call fcn.010057b7
test eax, eax
jne 0x1006e88
push dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x118]
call fcn.010057f3
test eax, eax
je 0x1006f58
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100587a
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
cmp byte [edi], 0x7b
jne 0x1006f02
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x118]
push ebx
push dword [ebp - 0x12c]
push edi
call fcn.01006a3e
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
cmp dword [ebp + 0x14], ebx
je 0x1006f0b
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x118]
push edi
mov dword [ebp + 0x14], eax
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
jmp 0x1006cf5
cmp dword [ebp + 0x14], ebx
jne 0x1007022
push dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x118]
call fcn.010057b7
test eax, eax
je 0x1006f4f
push dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
call fcn.01005781
test eax, eax
je 0x1007017
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x12c]
call fcn.01006009
jmp 0x1007017
cmp dword [ebp + 0x14], ebx
jne 0x1007022
lea ecx, [ebp - 0x12c]
call fcn.01005138
test eax, eax
jne 0x100703b
cmp dword [ebp - 0x13c], ebx
je 0x1006fb5
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov eax, dword [ebp - 0x120]
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x16c], eax
call fcn.010050b2
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x16c], ebx
mov byte [ebp - 4], 1
call fcn.01005138
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100568c
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
mov ecx, dword [ebp - 0x118]
push edi
call fcn.0100587a
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
cmp dword [ebp + 0x10], ebx
je 0x1007022
cmp byte [edi], 0x7b
jne 0x1007022
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x1007022
mov ecx, dword [ebp - 0x118]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x12c]
push edi
call fcn.01006a3e
mov esi, eax
cmp esi, ebx
jl 0x1006aa9
mov ecx, dword [ebp - 0x118]
jmp 0x1006a99
cmp byte [edi], 0x7d
jne 0x1006acf
jmp 0x1006aa9
lea ecx, [ebp - 0x138]
call fcn.01005138
mov esi, 0x80020009
jmp 0x1006aa9
lea ecx, [ebp - 0x138]
jmp 0x1007063
cmp eax, ebx
jle 0x100705b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x150]
call fcn.01005138
jmp 0x1006aa9
mov esi, 0x8007000e
jmp 0x1006aa9