Function at 0x1006a9c
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x10180ac]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x12c], eax
call fcn.0100581e
jmp 0x1006ced
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x100146c
push edi
call esi
mov ebx, eax
neg ebx
push 0x1001480
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x1006b1f
test ebx, ebx
je 0x1006bc7
mov ecx, dword [ebp - 0x110]
push edi
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1006bc7
push 0x5c
push edi
mov dword [ebp - 0x10c], esi
call fcn.0100570f
test eax, eax
jne 0x1006ff9
mov ecx, dword [ebp - 0x110]
push edi
call fcn.01005914
test eax, eax
je 0x1006b84
mov eax, dword [ebp - 0x118]
push edi
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
call fcn.0100603e
mov dword [ebp - 0x10c], esi
cmp ebx, esi
je 0x1006bbc
mov ecx, dword [ebp - 0x110]
push edi
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007046
mov ecx, dword [ebp - 0x110]
push edi
call fcn.01005a0d
lea ecx, [ebp - 0x10c]
mov esi, eax
call fcn.010052cb
jmp 0x1006fa4
lea ecx, [ebp - 0x10c]
call fcn.010052cb
push 0x1001474
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1006bf3
mov ecx, dword [ebp - 0x110]
and dword [ebp - 0x124], eax
push edi
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x100148c
push edi
xor ebx, ebx
call esi
test eax, eax
jne 0x1006cf6
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x108]
push eax
call fcn.0100581e
mov esi, eax
cmp esi, ebx
jl 0x1007009
mov ecx, dword [ebp - 0x110]
push edi
call fcn.0100581e
mov esi, eax
cmp esi, ebx
jl 0x1007009
cmp byte [edi], 0x3d
jne 0x1007004
cmp dword [ebp + 0x10], ebx
je 0x1006c8c
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x110]
push ebx
mov dword [ebp - 0x10c], eax
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.010065e7
lea ecx, [ebp - 0x10c]
mov esi, eax
mov dword [ebp - 0x10c], ebx
call fcn.010052cb
cmp esi, ebx
jmp 0x1006fa6
cmp dword [ebp + 0x14], ebx
jne 0x1006ce1
push 0x20006
push ebx
push dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], ebx
call fcn.0100533e
cmp eax, ebx
jne 0x1007038
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x1006cd6
cmp eax, 2
jne 0x1007036
lea ecx, [ebp - 0x10c]
call fcn.010052cb
mov ecx, dword [ebp - 0x110]
push edi
call fcn.01005a0d
mov esi, eax
cmp esi, ebx
jmp 0x1006fec
push 0x5c
push edi
call fcn.0100570f
test eax, eax
jne 0x1007004
cmp dword [ebp + 0x10], ebx
je 0x1006dcb
push 0xf003f
push edi
push dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
call fcn.0100533e
test eax, eax
je 0x1006d68
push 0x20019
push edi
push dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
call fcn.0100533e
test eax, eax
je 0x1006d68
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push edi
push dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
call fcn.010052e9
test eax, eax
jne 0x1007004
mov al, byte [edi]
cmp al, 0x4c
mov byte [ebp - 0x120], 0
je 0x1006d79
cmp al, 0x6c
jne 0x1006d8c
push 0x1001834
push edi
call esi
test eax, eax
jne 0x1006d8c
mov byte [ebp - 0x120], 1
mov ecx, dword [ebp - 0x110]
push edi
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
cmp byte [edi], 0x3d
jne 0x1006fa8
push dword [ebp - 0x120]
mov ecx, dword [ebp - 0x110]
push edi
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.010065e7
jmp 0x1006fa2
cmp dword [ebp + 0x14], ebx
jne 0x1006df2
push 0x20019
push edi
push dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
call fcn.0100533e
test eax, eax
je 0x1006df2
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0x11c], ebx
mov esi, 0x104
jne 0x1006e36
push esi
call fcn.01005062
test al, al
je 0x1006e18
mov eax, esi
call fcn.01008280
mov dword [ebp - 0x11c], esp
jmp 0x1006e2a
push esi
lea ecx, [ebp - 0x128]
call fcn.010061d3
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], ebx
je 0x1007053
push esi
push edi
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp + 0x14], ebx
jne 0x1006e77
push dword [ebp - 0x114]
mov ecx, dword [ebp - 0x110]
call fcn.0100594a
test eax, eax
jne 0x1006e77
push dword [ebp - 0x114]
mov ecx, dword [ebp - 0x110]
call fcn.01005986
test eax, eax
je 0x1006f45
mov ebx, dword [ebp - 0x110]
push edi
mov ecx, ebx
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
push edi
mov ecx, ebx
call fcn.01005a0d
mov esi, eax
test esi, esi
jl 0x1007009
cmp byte [edi], 0x7b
jne 0x1006ef1
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x114]
push edi
call fcn.01006a9c
mov esi, eax
test esi, esi
jl 0x1007009
cmp dword [ebp + 0x14], 0
je 0x1006f01
mov eax, dword [ebp - 0x12c]
push edi
mov ecx, ebx
mov dword [ebp + 0x14], eax
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
push edi
mov ecx, ebx
call fcn.01005a0d
jmp 0x1006fe8
cmp dword [ebp + 0x14], 0
jne 0x1006fee
mov ebx, dword [ebp - 0x110]
push dword [ebp - 0x114]
mov ecx, ebx
call fcn.0100594a
test eax, eax
je 0x1006f3b
push dword [ebp - 0x11c]
mov ecx, ebx
call fcn.01005914
test eax, eax
je 0x1006f34
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x114]
call fcn.0100603e
mov ecx, ebx
jmp 0x1006fe2
cmp dword [ebp + 0x14], 0
jne 0x1006fee
lea ecx, [ebp - 0x114]
call fcn.010052cb
test eax, eax
jne 0x1007004
cmp dword [ebp - 0x124], eax
je 0x1006f84
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp - 0x10c], 0
lea ecx, [ebp - 0x10c]
call fcn.010052cb
mov ecx, dword [ebp - 0x110]
push edi
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
mov ecx, dword [ebp - 0x110]
push edi
call fcn.01005a0d
mov esi, eax
test esi, esi
jl 0x1007009
cmp dword [ebp + 0x10], 0
je 0x1006fee
cmp byte [edi], 0x7b
jne 0x1006fee
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x1006fee
mov ecx, dword [ebp - 0x110]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push edi
call fcn.01006a9c
mov esi, eax
test esi, esi
jl 0x1007009
mov ecx, dword [ebp - 0x110]
push edi
call fcn.0100581e
mov esi, eax
test esi, esi
jl 0x1007009
cmp byte [edi], 0x7d
jne 0x1006af6
jmp 0x1007009
lea ecx, [ebp - 0x10c]
call fcn.010052cb
mov esi, 0x80020009
lea ecx, [ebp - 0x114]
call fcn.010052cb
lea ecx, [ebp - 0x128]
call fcn.01005ed3
mov eax, esi
lea esp, [ebp - 0x138]
mov ecx, dword [ebp - 4]
call fcn.01007f54
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp eax, ebx
jle 0x1007044
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x10c]
call fcn.010052cb
jmp 0x1007009
mov esi, 0x8007000e
jmp 0x1007009