Function at 0x433bb0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454f7e
mov eax, dword fs:[0]
push eax
mov eax, 0x2368
call fcn.004425c0
mov eax, dword [0x465b00]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2374], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433c49
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1164], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x1164]
jmp 0x4345a7
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x7d
je 0x434589
mov dword [ebp - 0x10], 1
mov edx, dword [str.Delete]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x138], eax
mov ecx, dword [str.ForceRemove]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x433c9f
cmp dword [ebp - 0x138], 0
je 0x433ebb
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433cbc
jmp 0x434589
cmp dword [ebp + 0x10], 0
je 0x433ebb
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x11c0], ecx
mov dword [ebp - 0x11bc], 0
cmp dword [ebp - 0x11c0], 0
jne 0x433d06
mov dword [ebp - 0x11c4], 0
jmp 0x433d50
mov edx, dword [ebp - 0x11c0]
movsx eax, byte [edx]
test eax, eax
je 0x433d44
mov ecx, dword [ebp - 0x11c0]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x433d2f
mov eax, dword [ebp - 0x11c0]
mov dword [ebp - 0x11bc], eax
jmp 0x433d44
mov ecx, dword [ebp - 0x11c0]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x11c0], eax
jmp 0x433d06
mov edx, dword [ebp - 0x11bc]
mov dword [ebp - 0x11c4], edx
cmp dword [ebp - 0x11c4], 0
je 0x433d8c
mov dword [ebp - 0x1168], 0x80020009
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.004347c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x1168]
jmp 0x4345a7
mov dword [ebp - 0x11c8], 0
jmp 0x433da7
mov eax, dword [ebp - 0x11c8]
add eax, 1
mov dword [ebp - 0x11c8], eax
cmp dword [ebp - 0x11c8], 0xc
jge 0x433dda
mov ecx, dword [ebp - 0x11c8]
mov edx, dword [ecx*4 + 0x4576f8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x433dd8
mov dword [ebp - 0x11cc], 0
jmp 0x433de4
jmp 0x433d98
mov dword [ebp - 0x11cc], 1
cmp dword [ebp - 0x11cc], 0
je 0x433e37
xor ecx, ecx
jne 0x433ded
xor edx, edx
jne 0x433ded
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x140]
call fcn.00434950
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x12f8], edx
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
cmp dword [ebp - 0x138], 0
je 0x433eac
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433e6c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.004347c0
jmp 0x434589
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00435760
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433e98
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.004347c0
jmp 0x434589
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.004347c0
jmp 0x434526
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.004347c0
mov edx, dword [str.NoRemove]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x433ef4
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433ef4
jmp 0x434589
mov edx, dword [0x45957c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x43417e
lea ecx, [ebp - 0x1144]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433f2d
jmp 0x434589
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x433f4a
jmp 0x434589
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x3d
je 0x433f79
mov dword [ebp - 0x116c], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x116c]
jmp 0x4345a7
cmp dword [ebp + 0x10], 0
je 0x434047
mov dword [ebp - 0x114c], 0
mov dword [ebp - 0x1148], 0
mov byte [ebp - 4], 2
xor edx, edx
jne 0x433f9b
xor eax, eax
jne 0x433f9b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1148], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x1144]
push eax
lea ecx, [ebp - 0x114c]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00434b50
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x114c]
mov dword [ebp - 0x2358], edx
mov dword [ebp - 0x114c], 0
mov dword [ebp - 0x1148], 0
cmp dword [ebp - 0x24], 0
jge 0x43402e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1170], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x114c]
call fcn.004347c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x1170]
jmp 0x4345a7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x114c]
call fcn.004347c0
jmp 0x434526
cmp dword [ebp + 0x14], 0
jne 0x43415c
cmp dword [ebp - 0x10], 0
je 0x43415c
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
xor ecx, ecx
jne 0x43406f
xor edx, edx
jne 0x43406f
mov dword [ebp - 0x235c], 0
lea eax, [ebp - 0x235c]
push eax
push 0x20006
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2360], eax
cmp dword [ebp - 0x2360], 0
jne 0x4340d7
lea ecx, [ebp - 0x1154]
call fcn.004347c0
mov dword [ebp - 0x2360], eax
mov edx, dword [ebp - 0x235c]
mov dword [ebp - 0x1154], edx
mov eax, 0x20006
and eax, 0x300
mov dword [ebp - 0x1150], eax
mov ecx, dword [ebp - 0x2360]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x434132
xor edx, edx
jne 0x4340e6
xor eax, eax
jne 0x4340e6
lea ecx, [ebp - 0x1144]
push ecx
mov edx, dword [ebp - 0x1154]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x434130
cmp dword [ebp - 0x1c], 2
je 0x434130
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00434680
add esp, 4
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1154]
call fcn.004347c0
jmp 0x434589
jmp 0x434151
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00434680
add esp, 4
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1154]
call fcn.004347c0
jmp 0x434589
lea ecx, [ebp - 0x1154]
call fcn.004347c0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.00435760
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x434179
jmp 0x434589
jmp 0x433c49
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.00434b00
add esp, 8
test eax, eax
je 0x4341b4
mov dword [ebp - 0x1174], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x1174]
jmp 0x4345a7
cmp dword [ebp + 0x10], 0
je 0x43429c
push 0x2001f
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x18]
call fcn.004348c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43424c
push 0x20019
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004348c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43424c
push 0
push 0
push 0x2001f
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.00434810
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43424c
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00434680
add esp, 4
mov dword [ebp - 0x1178], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x1178]
jmp 0x4345a7
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x434269
jmp 0x434589
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x3d
jne 0x434297
mov edx, dword [ebp + 8]
push edx
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2374]
call fcn.00434b50
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x434297
jmp 0x434589
jmp 0x434526
cmp dword [ebp + 0x14], 0
jne 0x4342bc
push 0x20019
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x18]
call fcn.004348c0
mov dword [ebp - 0x1c], eax
jmp 0x4342c3
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], 0
je 0x4342d0
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x134]
push ecx
call fcn.004440fa
add esp, 0x10
mov dword [ebp - 0x2364], eax
mov edx, dword [ebp - 0x2364]
push edx
call fcn.004345d0
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x43431c
jmp 0x434589
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00435760
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x434339
jmp 0x434589
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x7b
jne 0x43439f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x43439f
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.00433bb0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x434382
cmp dword [ebp + 0x14], 0
jne 0x434382
jmp 0x434589
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x43439f
jmp 0x434589
mov ecx, dword [ebp - 0x20]
mov dword [ebp + 0x14], ecx
cmp dword [ebp - 0x1c], 2
jne 0x4343b0
jmp 0x433c49
cmp dword [ebp - 0x1c], 0
je 0x4343d7
cmp dword [ebp + 0x14], 0
je 0x4343c3
jmp 0x433c49
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00434680
add esp, 4
mov dword [ebp - 0x24], eax
jmp 0x434589
cmp dword [ebp + 0x14], 0
je 0x43442c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2368], eax
mov ecx, dword [ebp - 0x2368]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00435710
test eax, eax
je 0x43442c
lea edx, [ebp - 0x134]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.004356c0
test eax, eax
je 0x434427
cmp dword [ebp - 0x10], 0
je 0x434427
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x18]
call fcn.00434950
jmp 0x433c49
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x236c], ecx
mov edx, dword [ebp - 0x236c]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.00435710
mov dword [ebp - 0x1158], eax
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43448a
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00434680
add esp, 4
mov dword [ebp - 0x117c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x117c]
jmp 0x4345a7
cmp dword [ebp - 0x10], 0
je 0x434526
cmp dword [ebp - 0x1158], 0
jne 0x434526
mov dword [ebp - 0x1160], 0
mov dword [ebp - 0x115c], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1160]
call fcn.00434700
lea edx, [ebp - 0x134]
push edx
lea ecx, [ebp - 0x1160]
call fcn.00434730
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1160]
mov dword [ebp - 0x2370], eax
mov dword [ebp - 0x1160], 0
mov dword [ebp - 0x115c], 0
cmp dword [ebp - 0x1c], 0
je 0x43451b
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00434680
add esp, 4
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1160]
call fcn.004347c0
jmp 0x434589
lea ecx, [ebp - 0x1160]
call fcn.004347c0
cmp dword [ebp + 0x10], 0
je 0x434584
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x7b
jne 0x434584
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x434584
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2374]
call fcn.00433bb0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x43456a
jmp 0x434589
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2374]
call fcn.00432cf0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x434584
jmp 0x434589
jmp 0x433c49
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1180], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004347c0
mov eax, dword [ebp - 0x1180]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004401a3
mov esp, ebp
pop ebp
ret 0x10