Function at 0x10006654
Capabilities:
Delete registry value

Disassembly:
push 0x268
mov eax, 0x1001c98c
call fcn.1001c65a
mov eax, ecx
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x244], esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x248], ecx
mov ecx, eax
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x240], 1
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c4a
jmp 0x10006d39
push 0x10001de0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x10001db4
sbb edi, edi
inc edi
push ebx
mov dword [ebp - 0x238], edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100066ff
test edi, edi
je 0x100067b5
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
cmp dword [ebp + 0x10], 0
je 0x100067b5
xor eax, eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
push 0x5c
pop edx
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.10005b2c
test eax, eax
jne 0x10006c34
push ebx
call fcn.10006275
test eax, eax
je 0x10006773
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x258]
push ebx
mov dword [ebp - 0x258], eax
call fcn.100062a6
xor eax, eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x238], 0
je 0x100067b1
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.1000648f
mov edi, eax
test edi, edi
js 0x10006c39
mov byte [ebp - 4], 1
jmp 0x10006cd6
mov byte [ebp - 4], 1
push 0x10001dcc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100067e1
mov ecx, dword [ebp - 0x21c]
push ebx
mov dword [ebp - 0x240], eax
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
push 0x10001dac
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100068fa
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x10006c34
cmp dword [ebp + 0x10], 0
je 0x1000687d
mov eax, dword [ebp - 0x224]
xor ecx, ecx
push ecx
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x218]
push ebx
push eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], ecx
mov ecx, dword [ebp - 0x21c]
push eax
call fcn.10005c7c
mov edi, eax
xor eax, eax
mov dword [ebp - 0x264], eax
jmp 0x10006cce
cmp dword [ebp + 0x14], 0
jne 0x100068e9
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0x20006
push ecx
push ecx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10006d71
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
push ecx
push eax
mov dword [ebp - 0x238], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x100068d8
cmp edi, 2
jne 0x10006d4a
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x100068e9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.1000648f
jmp 0x10006d2f
push 0x5c
pop edx
mov ecx, ebx
call fcn.10005b2c
test eax, eax
jne 0x10006c34
cmp dword [ebp + 0x10], eax
je 0x10006a73
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0xf003f
push ecx
push ebx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006966
mov ecx, eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x10006950
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x234], edi
test ecx, ecx
je 0x10006a04
jmp 0x1000696c
mov edi, dword [ebp - 0x234]
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0x20019
push ecx
push ebx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100069ad
test edi, edi
je 0x1000699d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x234], edi
test eax, eax
je 0x10006a04
lea eax, [ebp - 0x274]
xor ecx, ecx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], ecx
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10006c34
mov ecx, eax
test edi, edi
je 0x100069f0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x234], eax
test ecx, ecx
jne 0x10006c34
xor eax, eax
mov byte [ebp - 0x23c], al
movzx eax, word [ebx]
cmp eax, 0x4c
je 0x10006a19
cmp eax, 0x6c
jne 0x10006a30
push 0x10002420
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10006a30
mov byte [ebp - 0x23c], 1
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x10006cd6
push dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push ebx
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10005c7c
jmp 0x10006ccc
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x10006acb
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0x20019
push ecx
push ebx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006ac5
mov ecx, eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x10006ab5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x234], eax
test ecx, ecx
je 0x10006acb
xor edi, edi
inc edi
mov dword [ebp + 0x14], edi
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x10006b22
mov ecx, 0x208
call fcn.10006158
test al, al
je 0x10006af7
mov eax, 0x208
call fcn.1001c700
mov eax, esp
mov dword [ebp - 0x228], esp
jmp 0x10006b1a
push 0x210
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
test eax, eax
je 0x10006b14
mov dword [eax], esi
mov esi, eax
mov dword [ebp - 0x244], esi
add eax, 8
mov dword [ebp - 0x228], eax
test eax, eax
je 0x10006d85
push 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test edi, edi
jne 0x10006b51
mov edi, dword [ebp - 0x234]
push edi
call fcn.1000623c
test eax, eax
jne 0x10006b51
push edi
call fcn.100061b1
test eax, eax
je 0x10006c1b
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10010cac
mov edi, eax
test edi, edi
js 0x10006c39
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x10006bcd
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push eax
push dword [ebp - 0x234]
push ebx
call fcn.10006654
mov edi, eax
test edi, edi
js 0x10006c39
cmp dword [ebp + 0x14], 0
je 0x10006bd7
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x21c]
push ebx
mov dword [ebp + 0x14], eax
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
jmp 0x100068e9
cmp dword [ebp + 0x14], 0
jne 0x10006d39
push dword [ebp - 0x234]
call fcn.1000623c
test eax, eax
je 0x10006c0b
mov edi, dword [ebp - 0x228]
push edi
call fcn.10006275
test eax, eax
je 0x10006d23
push edi
lea ecx, [ebp - 0x234]
call fcn.100062a6
jmp 0x10006d23
cmp dword [ebp + 0x14], 0
jne 0x10006d39
mov edi, dword [ebp - 0x234]
test edi, edi
je 0x10006c65
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0x234], edi
test eax, eax
je 0x10006c67
mov edi, 0x80020009
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x10006c4a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x244]
call fcn.10005b68
mov eax, edi
lea esp, [ebp - 0x284]
call fcn.1001c618
ret 0x10
xor ecx, ecx
cmp dword [ebp - 0x240], 0
je 0x10006caa
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x270]
mov edi, dword [ebp - 0x228]
mov byte [ebp - 4], 3
push edi
mov dword [ebp - 0x270], eax
call fcn.100063e3
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.1000648f
mov edi, eax
test edi, edi
js 0x10006c39
cmp dword [ebp + 0x10], 0
je 0x10006d39
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x10006d39
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x24c]
jne 0x10006ce9
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x10006d39
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x234]
push ebx
call fcn.10006654
mov edi, eax
test edi, edi
js 0x10006c39
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.10006507
mov edi, eax
test edi, edi
js 0x10006c39
push 0x7d
pop eax
cmp word [ebx], ax
jne 0x100066d0
jmp 0x10006c39
test edi, edi
jle 0x10006d57
movzx edi, di
or edi, 0x80070000
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x10006c39
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006c39
jle 0x10006c39
movzx edi, di
or edi, 0x80070000
jmp 0x10006c39
mov edi, 0x8007000e
jmp 0x10006c39