Function at 0x411241
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437226
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.00421640
mov eax, dword [0x445610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x223c]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], eax
mov dword [ebp - 4], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2268], eax
push ebx
mov ecx, edi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
push 0x7d
pop eax
cmp word [ebx], ax
je 0x41183a
xor eax, eax
push str.Delete
inc eax
push ebx
mov dword [ebp - 0x2240], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x438554
sbb esi, esi
inc esi
push ebx
mov dword [ebp - 0x221c], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x411308
test esi, esi
je 0x4113e5
push ebx
mov ecx, edi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4113e7
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
push 0x5c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2230], esi
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
call fcn.00412401
pop ecx
pop ecx
test eax, eax
jne 0x41182a
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00406728
test eax, eax
je 0x41139c
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
push ebx
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
call fcn.00410b43
mov dword [ebp - 0x2230], esi
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
cmp dword [ebp - 0x221c], esi
je 0x4113d8
push ebx
mov ecx, edi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x411822
push ebx
mov ecx, edi
call fcn.00412135
lea ecx, [ebp - 0x2230]
mov esi, eax
call fcn.00406974
test esi, esi
js 0x41183a
jmp 0x4117de
lea ecx, [ebp - 0x2230]
call fcn.00406974
jmp 0x4113e7
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41140f
push ebx
mov ecx, edi
mov dword [ebp - 0x2240], esi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
push 0x43854c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x411562
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
push ebx
mov ecx, edi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x411835
cmp dword [ebp + 0x10], 0
je 0x4114d7
xor eax, eax
lea edi, [ebp - 0x2258]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x2224]
xor eax, eax
and dword [ebp - 0x2254], 0
inc eax
and dword [ebp - 0x2250], 0
mov ecx, edi
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2258]
push eax
call fcn.00404759
mov esi, eax
lea ecx, [ebp - 0x2258]
xor eax, eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
test esi, esi
js 0x411874
mov byte [ebp - 4], al
call fcn.00406974
jmp 0x4117de
cmp dword [ebp + 0x14], 0
jne 0x411555
cmp dword [ebp - 0x2240], 0
je 0x411555
xor eax, eax
lea edi, [ebp - 0x2264]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2264]
push 0x20006
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push dword [ebp - 0x2220]
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2260], eax
mov dword [ebp - 0x225c], eax
call fcn.0040edfe
test eax, eax
jne 0x411865
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2264]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x411544
cmp eax, 2
jne 0x411865
lea ecx, [ebp - 0x2264]
call fcn.00406974
mov edi, dword [ebp - 0x2224]
push ebx
mov ecx, edi
call fcn.00412135
jmp 0x4112ba
push 0x5c
push ebx
call fcn.00412401
pop ecx
pop ecx
test eax, eax
jne 0x411835
cmp dword [ebp + 0x10], eax
je 0x411605
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
push 0x2001f
push ebx
push esi
call fcn.0040edfe
test eax, eax
je 0x4115cf
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x223c]
call fcn.0040edfe
test eax, eax
je 0x4115cf
xor eax, eax
lea ecx, [ebp - 0x223c]
push eax
push eax
push 0x2001f
push eax
push eax
push ebx
push esi
call fcn.00406cc4
test eax, eax
jne 0x4116e7
push ebx
mov ecx, edi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x4117de
push ebx
push 0
lea eax, [ebp - 0x223c]
mov ecx, edi
push eax
call fcn.00404759
mov esi, eax
jmp 0x4113cb
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x411625
push 0x20019
push ebx
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
call fcn.0040edfe
jmp 0x411628
push 2
pop eax
push 1
test eax, eax
mov dword [ebp - 0x221c], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
lea eax, [ebp - 0x218]
push ebx
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.0041fce3
push eax
call fcn.00405491
add esp, 0x14
mov ecx, edi
push ebx
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
push ebx
mov ecx, edi
call fcn.00412135
mov esi, eax
test esi, esi
js 0x41183a
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4116c3
push ebx
call fcn.0041fcca
pop ecx
cmp eax, 1
jne 0x4116c3
push dword [ebp + 0x14]
mov ecx, edi
push 0
push dword [ebp - 0x223c]
push ebx
call fcn.00411241
mov esi, eax
test esi, esi
jns 0x4116b1
cmp dword [ebp + 0x14], 0
je 0x41183a
push ebx
mov ecx, edi
call fcn.0040d544
mov esi, eax
test esi, esi
js 0x41183a
mov eax, dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2268]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x4112c4
test eax, eax
je 0x4116f5
test ecx, ecx
jne 0x4112c4
push eax
call fcn.00405b8d
pop ecx
mov esi, eax
jmp 0x41183a
test ecx, ecx
je 0x411744
push dword [ebp - 0x223c]
mov ecx, edi
call fcn.0040caec
test eax, eax
je 0x411744
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00406728
test eax, eax
je 0x4112c4
cmp dword [ebp - 0x2240], 0
je 0x4112c4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x223c]
call fcn.00410b43
jmp 0x4112c4
push dword [ebp - 0x223c]
mov ecx, edi
call fcn.0040caec
lea ecx, [ebp - 0x223c]
mov dword [ebp - 0x221c], eax
call fcn.00406974
test eax, eax
jne 0x4116e7
cmp dword [ebp - 0x2240], eax
je 0x4112c4
cmp dword [ebp - 0x221c], eax
jne 0x4112c4
lea edi, [ebp - 0x224c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x224c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2220]
xor edi, edi
mov dword [ebp - 0x224c], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2248], edi
mov dword [ebp - 0x2244], edi
call fcn.004079e5
mov dword [ebp - 0x224c], edi
mov dword [ebp - 0x2248], edi
mov dword [ebp - 0x2244], edi
test eax, eax
jne 0x41187b
lea ecx, [ebp - 0x224c]
call fcn.00406974
mov edi, dword [ebp - 0x2224]
cmp dword [ebp + 0x10], 0
je 0x4112c4
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4112c4
push ebx
call fcn.0041fcca
pop ecx
cmp eax, 1
jne 0x4112c4
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x223c]
push ebx
call fcn.00411241
mov esi, eax
test esi, esi
js 0x41183a
jmp 0x4112b2
lea ecx, [ebp - 0x2230]
jmp 0x411874
lea ecx, [ebp - 0x2230]
call fcn.00406974
mov esi, 0x80020009
lea ecx, [ebp - 0x223c]
call fcn.00406974
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042109c
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.00405b8d
pop ecx
lea ecx, [ebp - 0x2264]
mov esi, eax
call fcn.00406974
jmp 0x41183a
push eax
call fcn.00405b8d
pop ecx
lea ecx, [ebp - 0x224c]
jmp 0x411872