Function at 0x10005b20
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100147f6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2264
call fcn.10013eb0
mov eax, dword [0x1001c048]
xor eax, esp
mov dword [esp + 0x2260], eax
push ebx
push esi
push edi
mov eax, dword [0x1001c048]
xor eax, esp
push eax
lea eax, [esp + 0x2278]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov edx, dword [ebp + 0x14]
mov eax, ebx
mov edi, ecx
mov dword [esp + 0x2280], esi
mov dword [esp + 0x38], edx
call fcn.10005980
mov edi, eax
cmp edi, esi
jl 0x100061c0
cmp word [ebx], 0x7d
je 0x100061be
lea esp, [esp]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [esp + 0x20], 1
call edi
neg eax
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x10005bdf
test esi, esi
je 0x10005d17
mov edi, dword [esp + 0x10]
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
xor edx, edx
cmp dword [ebp + 0x10], edx
je 0x10005d17
movzx ecx, word [ebx]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov eax, ebx
cmp cx, dx
je 0x10005c36
mov edi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x10005c2e
push eax
call edi
movzx ecx, word [eax]
test cx, cx
jne 0x10005c1b
jmp 0x10005c36
test eax, eax
jne 0x1000618d
mov edi, 0x10017b98
jmp 0x10005c40
mov eax, dword [edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10005c81
add edi, 4
cmp edi, 0x10017bc8
jl 0x10005c40
mov ecx, dword [esp + 0x14]
xor edi, edi
mov dword [esp + 0x2c], ecx
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call fcn.10005680
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
test esi, esi
je 0x10005d0f
mov esi, dword [esp + 0x10]
mov eax, ebx
mov edi, esi
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061a6
push ebx
mov ecx, esi
call fcn.100054f0
mov edi, eax
test edi, edi
js 0x100061a6
mov dword [esp + 0x30], 0
cmp word [ebx], 0x7b
jne 0x10005d00
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10005d00
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push 0
push edx
push eax
push ebx
call fcn.10005b20
mov edi, eax
test edi, edi
js 0x100061af
mov edi, dword [esp + 0x10]
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
cmp word [ebx], 0x7d
jne 0x10005bb0
jmp 0x100061af
mov dword [esp + 0x30], 0
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10005d40
mov edi, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
push 0x100176a8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10005e6b
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x26c]
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
mov edi, dword [esp + 0x10]
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
cmp word [ebx], 0x3d
jne 0x10006196
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x10005deb
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x26c]
mov byte [esp + 0x2280], 1
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x14]
push ecx
mov ecx, ebx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
call fcn.10005030
mov edi, eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
cmp edi, esi
jl 0x100061e6
mov byte [esp + 0x2280], 0
mov dword [esp + 0x40], esi
jmp 0x10005cba
cmp dword [ebp + 0x14], esi
jne 0x10005e52
cmp dword [esp + 0x18], esi
je 0x10005e52
mov ecx, dword [esp + 0x14]
push 0x20006
lea edx, [esp + 0x58]
push edx
xor eax, eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
call fcn.10005610
cmp eax, esi
jne 0x100061fa
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x26c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x10005e3f
cmp eax, 2
jne 0x100061fa
cmp edi, esi
je 0x10005e4e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov ecx, dword [esp + 0x10]
push ebx
call fcn.100054f0
mov edi, eax
cmp edi, esi
jl 0x100061af
jmp 0x10005d00
movzx ecx, word [ebx]
xor edi, edi
mov eax, ebx
cmp cx, di
je 0x10005e96
cmp cx, 0x5c
je 0x10005e8e
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, di
jne 0x10005e77
jmp 0x10005e96
cmp eax, edi
jne 0x10006196
cmp dword [ebp + 0x10], edi
je 0x10005fb5
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], edi
cmp esi, edi
je 0x10005f06
cmp dword [esi], edi
je 0x10005eee
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
jne 0x10005ec5
mov eax, 1
jmp 0x10005f1d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10005ebe
mov ecx, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push 0x2001f
push edi
push ebx
push ecx
call eax
jmp 0x10005f1d
cmp dword [esi + 4], edi
je 0x10005ebe
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x2001f
push edi
push ebx
push eax
jmp 0x10005f17
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push edi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10005f42
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, edi
je 0x10005f32
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x10005f75
mov esi, dword [esp + 0x14]
push 0x20019
lea edx, [esp + 0x20]
push edx
mov eax, ebx
mov ecx, esi
call fcn.10005610
test eax, eax
je 0x10005f75
lea eax, [esp + 0x1c]
push eax
mov eax, ebx
mov ecx, esi
call fcn.10004e30
mov edi, eax
test edi, edi
jne 0x10006207
mov edi, dword [esp + 0x10]
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
cmp word [ebx], 0x3d
jne 0x10005cba
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.10005030
mov edi, eax
test edi, edi
js 0x100061af
jmp 0x10005cba
cmp dword [ebp + 0x14], edi
jne 0x1000600d
mov ecx, dword [esp + 0x14]
push 0x20019
lea edx, [esp + 0x20]
push edx
mov eax, ebx
call fcn.10005610
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, edi
je 0x10005fe0
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x6c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
cmp eax, 0x50
ja case.0x10006006.107
movzx ecx, byte [eax + 0x10006270]
jmp dword [ecx*4 + 0x10006260]
mov dword [esp + 0x28], 2
mov esi, dword [esp + 0x28]
jmp 0x10005fd9
mov edi, dword [esp + 0x10]
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
mov ecx, dword [esp + 0x10]
push ebx
call fcn.100054f0
mov edi, eax
test edi, edi
js 0x100061af
cmp word [ebx], 0x7b
jne 0x10006092
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10006092
mov esi, dword [ebp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push esi
push 0
push edx
push ebx
call fcn.10005b20
mov edi, eax
test edi, edi
jns 0x10006079
test esi, esi
je 0x100061af
mov edi, dword [esp + 0x10]
mov eax, ebx
call fcn.10005980
mov edi, eax
test edi, edi
js 0x100061af
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x14], eax
cmp esi, 2
je 0x10005d00
test esi, esi
je 0x100060bc
test eax, eax
jne 0x10005d00
mov eax, esi
call fcn.10005940
mov edi, eax
jmp 0x100061af
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x100060ff
mov ecx, esi
call fcn.100057e0
test eax, eax
je 0x100060ff
lea ecx, [esp + 0x64]
push ecx
call fcn.10005560
test eax, eax
je 0x10005d00
cmp dword [esp + 0x18], 0
je 0x10005d00
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x20]
call fcn.10005680
jmp 0x10005d00
mov ecx, esi
call fcn.100057e0
mov dword [esp + 0x60], eax
xor eax, eax
mov dword [esp + 0x28], eax
test esi, esi
je 0x10006127
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test eax, eax
jne 0x1000622d
cmp dword [esp + 0x18], eax
je 0x10005d00
cmp dword [esp + 0x60], eax
jne 0x10005d00
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x64]
mov dword [esp + 0x48], eax
xor esi, esi
push ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
call fcn.10005870
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
cmp eax, esi
jne 0x10006244
lea esi, [esp + 0x48]
call fcn.10005850
jmp 0x10005d00
lea esi, [esp + 0x2c]
call fcn.10005850
lea esi, [esp + 0x1c]
call fcn.10005850
mov eax, 0x80020009
jmp 0x100061c0
lea esi, [esp + 0x2c]
call fcn.10005850
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100061be
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x2278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2260]
xor ecx, esp
call fcn.100134d2
mov esp, ebp
pop ebp
ret 0x10
lea esi, [esp + 0x3c]
call fcn.10005850
lea esi, [esp + 0x1c]
call fcn.10005850
jmp 0x100061be
call fcn.10005940
mov edi, eax
lea esi, [esp + 0x54]
jmp 0x100061aa
lea esi, [esp + 0x1c]
call fcn.10005850
mov eax, edi
call fcn.10005940
jmp 0x100061c0
push 0x8007000e
call fcn.10005420
push 0x80070057
call fcn.10005420
lea esi, [esp + 0x1c]
call fcn.10005850
mov eax, dword [esp + 0x28]
call fcn.10005940
jmp 0x100061c0
call fcn.10005940
mov edi, eax
lea esi, [esp + 0x48]
jmp 0x100061aa
push 0x80004005
call fcn.10005420
mov edi, edi
sbb esp, dword [eax]
adc byte [ecx], bl
bound eax, qword [eax]
adc byte [ebx], ah
bound eax, qword [eax]
adc byte [edx], dl
adc byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3