Function at 0x100273b3
Capabilities:
Delete registry value

Disassembly:
push 0x2c
mov eax, 0x100baa88
call fcn.100587f7
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x1c], esi
inc eax
lea ecx, [ebp - 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
mov dword [ebp - 0x10], eax
mov ebx, esi
mov byte [ebp - 4], al
call fcn.10001727
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001727
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x18]
call fcn.1000187c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x10027420
call fcn.10001b26
call fcn.10034efb
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x10027474
call fcn.10033ab7
mov ebx, eax
test ebx, ebx
je 0x100274ae
push ebx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x100274a7
lea eax, [ebp - 0x1c]
push eax
push 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x100274a1
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
test edi, edi
je 0x10027469
mov eax, dword [edi]
jmp 0x1002746b
mov eax, esi
push 0x20019
push eax
push ecx
jmp 0x10027489
test edi, edi
je 0x1002747c
mov eax, dword [edi]
jmp 0x1002747e
mov eax, esi
push 0x2001f
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
call fcn.100754f1
test eax, eax
je 0x100274b6
test ebx, ebx
je 0x100274ae
lea ecx, [ebp - 0x38]
call fcn.10017ea6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x10027648
push str.Flags
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1002756f
cmp eax, 2
je 0x1002756f
push 0x100d0cb4
lea ecx, [ebp - 0x10]
call fcn.10001727
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.10001727
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.1000187c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10027514
call fcn.10001b26
push str._Flags
lea ecx, [ebp - 0x14]
call fcn.10001727
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.1000187c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10027541
call fcn.10001b26
mov esi, dword [ebp - 0x10]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10027551
lock inc dword [esi + 8]
push dword [ebp - 0x20]
call fcn.1001d0b0
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], eax
pop ecx
pop ecx
test esi, esi
je 0x1002756f
mov ecx, esi
call fcn.10001b26
push str.Version
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10027624
cmp eax, 2
je 0x10027624
push str.cleanupSSVDisabledEntry_error
lea ecx, [ebp - 0x10]
call fcn.10001727
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.10001727
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x10]
call fcn.1000187c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x100275cd
call fcn.10001b26
push str._Version
lea ecx, [ebp - 0x14]
call fcn.10001727
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x10]
call fcn.1000187c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x100275fa
call fcn.10001b26
mov esi, dword [ebp - 0x10]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1002760a
lock inc dword [esi + 8]
push dword [ebp - 0x20]
call fcn.1001d0b0
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
pop ecx
test esi, esi
je 0x10027624
mov ecx, esi
call fcn.10001b26
lea ecx, [ebp - 0x2c]
call fcn.10017ea6
test ebx, ebx
je 0x10027645
lea ecx, [ebp - 0x38]
call fcn.10017ea6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x10027653
mov ecx, edi
call fcn.10001b26
lea ecx, [ebp - 0x2c]
call fcn.10017ea6
lea ecx, [ebp - 0x38]
call fcn.10017ea6
mov eax, ebx
call fcn.100587c0
ret