Function at 0x1000b4c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b8b3
mov eax, dword fs:[0]
push eax
mov eax, 0x456c
call fcn.1001b130
mov eax, dword [0x10024018]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4578], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b560
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2270], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x2270]
jmp 0x1000bea4
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x7d
je 0x1000be86
mov dword [ebp - 0x10], 1
mov edx, dword [str.Delete]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x238], eax
mov ecx, dword [str.ForceRemove]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1000b5b6
cmp dword [ebp - 0x238], 0
je 0x1000b7df
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b5d3
jmp 0x1000be86
cmp dword [ebp + 0x10], 0
je 0x1000b7df
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x22cc], ecx
mov dword [ebp - 0x22c8], 0
cmp dword [ebp - 0x22cc], 0
jne 0x1000b623
mov dword [ebp - 0x22d0], 0
jmp 0x1000b674
mov edx, dword [ebp - 0x22cc]
movzx eax, word [edx]
test eax, eax
je 0x1000b668
mov ecx, dword [ebp - 0x22cc]
movzx edx, word [ecx]
mov eax, 0x5c
movzx ecx, ax
cmp edx, ecx
jne 0x1000b653
mov edx, dword [ebp - 0x22cc]
mov dword [ebp - 0x22c8], edx
jmp 0x1000b668
mov eax, dword [ebp - 0x22cc]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x22cc], eax
jmp 0x1000b623
mov ecx, dword [ebp - 0x22c8]
mov dword [ebp - 0x22d0], ecx
cmp dword [ebp - 0x22d0], 0
je 0x1000b6ac
mov dword [ebp - 0x2274], 0x80020009
lea ecx, [ebp - 0x244]
call fcn.1000aff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x2274]
jmp 0x1000bea4
mov dword [ebp - 0x22d4], 0
jmp 0x1000b6c7
mov edx, dword [ebp - 0x22d4]
add edx, 1
mov dword [ebp - 0x22d4], edx
cmp dword [ebp - 0x22d4], 0xc
jge 0x1000b6fa
mov eax, dword [ebp - 0x22d4]
mov ecx, dword [eax*4 + 0x1001f068]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000b6f8
mov dword [ebp - 0x22d8], 0
jmp 0x1000b704
jmp 0x1000b6b8
mov dword [ebp - 0x22d8], 1
cmp dword [ebp - 0x22d8], 0
je 0x1000b76b
xor eax, eax
jne 0x1000b70d
xor ecx, ecx
jne 0x1000b70d
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000ade0
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x2508], ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
cmp dword [ebp - 0x238], 0
je 0x1000b7d4
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b79c
lea ecx, [ebp - 0x244]
call fcn.1000aff0
jmp 0x1000be86
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000ab90
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b7c4
lea ecx, [ebp - 0x244]
call fcn.1000aff0
jmp 0x1000be86
lea ecx, [ebp - 0x244]
call fcn.1000aff0
jmp 0x1000be23
lea ecx, [ebp - 0x244]
call fcn.1000aff0
mov ecx, dword [str.NoRemove]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000b818
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b818
jmp 0x1000be86
mov ecx, dword [0x1001f058]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000ba72
lea eax, [ebp - 0x2244]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b851
jmp 0x1000be86
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000b86e
jmp 0x1000be86
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x3d
je 0x1000b89d
mov dword [ebp - 0x2278], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x2278]
jmp 0x1000bea4
cmp dword [ebp + 0x10], 0
je 0x1000b989
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov byte [ebp - 4], 1
xor ecx, ecx
jne 0x1000b8c9
xor edx, edx
jne 0x1000b8c9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2244]
push edx
lea eax, [ebp - 0x2250]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000a4c0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2250]
mov dword [ebp - 0x4568], ecx
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
cmp dword [ebp - 0x28], 0
jge 0x1000b970
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x227c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2250]
call fcn.1000aff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x227c]
jmp 0x1000bea4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2250]
call fcn.1000aff0
jmp 0x1000be23
cmp dword [ebp + 0x14], 0
jne 0x1000ba50
cmp dword [ebp - 0x10], 0
je 0x1000ba50
mov dword [ebp - 0x225c], 0
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
push 0x20006
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x225c]
call fcn.1000ad20
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1000ba26
xor ecx, ecx
jne 0x1000b9da
xor edx, edx
jne 0x1000b9da
lea eax, [ebp - 0x2244]
push eax
mov ecx, dword [ebp - 0x225c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000ba24
cmp dword [ebp - 0x20], 2
je 0x1000ba24
mov edx, dword [ebp - 0x20]
push edx
call fcn.1000b200
add esp, 4
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x225c]
call fcn.1000aff0
jmp 0x1000be86
jmp 0x1000ba45
mov eax, dword [ebp - 0x20]
push eax
call fcn.1000b200
add esp, 4
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x225c]
call fcn.1000aff0
jmp 0x1000be86
lea ecx, [ebp - 0x225c]
call fcn.1000aff0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.1000ab90
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000ba6d
jmp 0x1000be86
jmp 0x1000b560
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.10009f60
add esp, 8
test eax, eax
je 0x1000baa8
mov dword [ebp - 0x2280], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x2280]
jmp 0x1000bea4
cmp dword [ebp + 0x10], 0
je 0x1000bb90
push 0x2001f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1000ad20
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000bb40
push 0x20019
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000ad20
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000bb40
push 0
push 0
push 0x2001f
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x1c]
call fcn.10009fb0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000bb40
mov eax, dword [ebp - 0x20]
push eax
call fcn.1000b200
add esp, 4
mov dword [ebp - 0x2284], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x2284]
jmp 0x1000bea4
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000bb5d
jmp 0x1000be86
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x3d
jne 0x1000bb8b
mov ecx, dword [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x4578]
call fcn.1000a4c0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000bb8b
jmp 0x1000be86
jmp 0x1000be23
cmp dword [ebp + 0x14], 0
jne 0x1000bbb0
push 0x20019
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1000ad20
mov dword [ebp - 0x20], eax
jmp 0x1000bbb7
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], 0
je 0x1000bbc4
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
push eax
call fcn.1000aae0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000bc05
jmp 0x1000be86
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x4578]
call fcn.1000ab90
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000bc22
jmp 0x1000be86
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x7b
jne 0x1000bc88
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1000bc88
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000b4c0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000bc6b
cmp dword [ebp + 0x14], 0
jne 0x1000bc6b
jmp 0x1000be86
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000bc88
jmp 0x1000be86
mov edx, dword [ebp - 0x24]
mov dword [ebp + 0x14], edx
cmp dword [ebp - 0x20], 2
jne 0x1000bc99
jmp 0x1000b560
cmp dword [ebp - 0x20], 0
je 0x1000bcc0
cmp dword [ebp + 0x14], 0
je 0x1000bcac
jmp 0x1000b560
mov eax, dword [ebp - 0x20]
push eax
call fcn.1000b200
add esp, 4
mov dword [ebp - 0x28], eax
jmp 0x1000be86
cmp dword [ebp + 0x14], 0
je 0x1000bd15
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x456c], ecx
mov edx, dword [ebp - 0x456c]
push edx
mov ecx, dword [ebp - 0x4578]
call fcn.1000afa0
test eax, eax
je 0x1000bd15
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000ac30
test eax, eax
je 0x1000bd10
cmp dword [ebp - 0x10], 0
je 0x1000bd10
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1000ade0
jmp 0x1000b560
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x4570], edx
mov eax, dword [ebp - 0x4570]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000afa0
mov dword [ebp - 0x2260], eax
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000bd73
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.1000b200
add esp, 4
mov dword [ebp - 0x2288], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x2288]
jmp 0x1000bea4
cmp dword [ebp - 0x10], 0
je 0x1000be23
cmp dword [ebp - 0x2260], 0
jne 0x1000be23
mov dword [ebp - 0x226c], 0
mov dword [ebp - 0x2268], 0
mov dword [ebp - 0x2264], 0
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x226c]
call fcn.1000b080
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x226c]
call fcn.1000b150
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x226c]
mov dword [ebp - 0x4574], ecx
mov dword [ebp - 0x226c], 0
mov dword [ebp - 0x2268], 0
mov dword [ebp - 0x2264], 0
cmp dword [ebp - 0x20], 0
je 0x1000be18
mov edx, dword [ebp - 0x20]
push edx
call fcn.1000b200
add esp, 4
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x226c]
call fcn.1000aff0
jmp 0x1000be86
lea ecx, [ebp - 0x226c]
call fcn.1000aff0
cmp dword [ebp + 0x10], 0
je 0x1000be81
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x7b
jne 0x1000be81
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1000be81
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x4578]
call fcn.1000b4c0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000be67
jmp 0x1000be86
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.1000b240
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x1000be81
jmp 0x1000be86
jmp 0x1000b560
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x228c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1000aff0
mov eax, dword [ebp - 0x228c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.1001111a
mov esp, ebp
pop ebp
ret 0x10