Function at 0x412b50
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.0045dd50
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.00460af0
add esp, 0xc
mov ecx, esi
push edi
call fcn.0048d0c0
mov ebx, eax
test eax, eax
js 0x412bd5
mov dword [ebp - 0x2234], esi
cmp word [edi], 0x7d
je 0x412bd5
mov esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x412cfa
push eax
call fcn.0048d340
add esp, 4
mov ebx, eax
jmp 0x412bd5
mov ebx, 0x80020009
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x412be6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x412c54
sub esp, 0x1c
movaps xmm0, xmmword [0x4d17e0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.00413e20
test eax, eax
jne 0x412bc3
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d0c0
mov ebx, eax
test eax, eax
js 0x412bd5
movzx eax, word [esi]
cmp ax, 0x3d
je 0x412c7b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x412ca3
mov ecx, dword [ebp - 0x2234]
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00413980
mov ebx, eax
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
js 0x412bd5
movzx eax, word [esi]
cmp ax, 0x7b
jne 0x412cf0
push esi
call fcn.0047b6dc
add esp, 4
cmp eax, 1
jne 0x412cf0
mov edi, dword [ebp - 0x2234]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push esi
call fcn.00412b50
test eax, eax
js 0x412bcc
mov ecx, edi
push esi
call fcn.0048d0c0
mov ebx, eax
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
js 0x412bd5
cmp word [esi], 0x7d
je 0x412bd5
push str.Delete
push esi
call edi
mov ecx, edi
mov edi, eax
push 0x4d1278
push esi
call ecx
test eax, eax
je 0x4130c1
test edi, edi
je 0x4130c1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.NoRemove
push esi
call edi
mov dword [ebp - 0x2238], eax
test eax, eax
je 0x412d54
push 0x4d1270
push esi
call edi
test eax, eax
je 0x4131eb
test esi, esi
mov edi, dword [sym.imp.USER32.dll_CharNextW]
je 0x412d80
mov eax, esi
jmp 0x412d70
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d0c0
test eax, eax
jns 0x412d36
jmp 0x412bcc
test ecx, ecx
je 0x412d80
push eax
call edi
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x412d69
test eax, eax
jne 0x412bd0
cmp dword [ebp + 0x10], 0
je 0x412efe
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x412dad
cmp dword [edi], 0
jne 0x412e68
cmp dword [edi + 4], 0
je 0x412df8
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412df8
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x412e4d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x412c54
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x412e1f
cmp dword [edi], 0
jne 0x412eb1
cmp dword [edi + 4], 0
je 0x412c20
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412c20
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x412bff
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x412c54
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412df8
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412df8
mov ecx, eax
mov edi, dword [edi]
call dword [0x4e097c]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x412dc5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412c20
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412c20
mov ecx, eax
mov edi, dword [edi]
call dword [0x4e097c]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x412e37
mov edx, 2
cmp dword [ebp + 0x14], 0
jne 0x412fc6
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x412f7d
cmp dword [edi], 0
je 0x412f72
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x412fc6
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
je 0x412fc6
mov ecx, eax
mov edi, dword [edi]
call dword [0x4e097c]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x412f95
cmp dword [edi + 4], 0
mov edx, 1
je 0x412fc6
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x412fc6
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x412fb0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov dword [ebp - 0x2240], edx
test edx, edx
mov eax, 1
cmove eax, dword [ebp + 0x14]
mov dword [ebp - 0x223c], eax
push 0xffffffffffffffff
push esi
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0047bc03
add esp, 0x10
mov edi, esi
cmp eax, 0x15
jle 0x413005
cmp eax, 0x50
je 0x41300d
jmp 0x41370e
test eax, eax
jne 0x413722
mov esi, dword [ebp - 0x2234]
mov ecx, esi
push edi
call fcn.0048d0c0
test eax, eax
js 0x412bcc
mov ecx, esi
push edi
call fcn.0048d280
mov ebx, eax
test eax, eax
js 0x412bd5
mov esi, edi
cmp word [edi], 0x7b
jne 0x413095
push esi
call fcn.0047b6dc
add esp, 4
cmp eax, 1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jne 0x41309b
mov ecx, dword [ebp - 0x2234]
push dword [ebp - 0x223c]
push 0
push dword [ebp - 0x2224]
push esi
call fcn.00412b50
test eax, eax
jns 0x41307e
mov ebx, eax
cmp dword [ebp - 0x223c], 0
je 0x412bd5
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d0c0
mov ebx, eax
test eax, eax
jns 0x41309b
jmp 0x412bd5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2240]
cmp eax, 2
je 0x412cf0
test eax, eax
je 0x413244
cmp dword [ebp + 0x14], 0
jne 0x412cf0
jmp 0x413602
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d0c0
mov ebx, eax
test eax, eax
js 0x412bd5
cmp dword [ebp + 0x10], 0
je 0x412d1e
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test esi, esi
je 0x413126
mov eax, esi
jmp 0x413104
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test ecx, ecx
je 0x413126
cmp ecx, 0x5c
jne 0x4130fd
test eax, eax
je 0x413126
mov dword [ebp - 0x2244], 0x80020009
xor ecx, ecx
inc ecx
jmp 0x4131b5
push str.AppID
push esi
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call eax
test eax, eax
je 0x4131ab
push str.CLSID
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.Component_Categories
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.FileType
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.Interface
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.Hardware
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.Mime
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push 0x4d1334
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41360d
xor ecx, ecx
test edi, edi
je 0x413491
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x4131d8
push eax
mov dword [ebp - 0x2238], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2238]
cmp ecx, 4
je 0x412ca0
test ecx, ecx
je 0x412d24
jmp 0x41321f
push 0x2000
push 0xff
lea ebx, [ebp - 0x2218]
push ebx
call fcn.00460af0
add esp, 0xc
mov ecx, dword [ebp - 0x2234]
push ebx
call fcn.0048d0c0
mov ecx, 3
test eax, eax
jns 0x4134ce
mov ebx, eax
test ecx, ecx
je 0x412cf0
cmp ecx, 2
je 0x412cf0
cmp ecx, 3
je 0x412bd5
mov ebx, dword [ebp - 0x2244]
jmp 0x412bd5
cmp dword [ebp + 0x14], 0
mov edi, 0
je 0x413391
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x413391
cmp dword [ebp - 0x2218], 0
je 0x413391
push str.AppID
lea edi, [ebp - 0x218]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x412cf0
push str.CLSID
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.Component_Categories
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.FileType
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.Interface
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.Hardware
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.Mime
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push 0x4d1334
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.SECURITY
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.SYSTEM
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x413699
jmp 0x412cf0
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
setne cl
cmp dword [ebp - 0x2218], edi
sete dl
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x413485
push eax
mov byte [ebp - 0x2240], cl
mov byte [ebp - 0x223c], dl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dl, byte [ebp - 0x223c]
mov cl, byte [ebp - 0x2240]
xor edi, edi
mov dword [ebp - 0x2224], edi
mov dword [ebp - 0x2220], edi
test eax, eax
jne 0x412bc3
or cl, dl
cmp dword [ebp - 0x2238], 0
sete al
xor cl, 1
or cl, al
jne 0x41347a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor edi, edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
lea ecx, [ebp - 0x2218]
lea eax, [ebp - 0x218]
push eax
call fcn.00413f30
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
test eax, eax
jne 0x4136e9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x412cf0
mov dword [ebp - 0x2220], 0
jmp 0x413424
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d0c0
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x4134b3
mov ebx, eax
mov ecx, 3
jmp 0x4131bb
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d280
mov ebx, eax
mov ecx, eax
sar ecx, 0x1f
add ecx, 4
jmp 0x4131bb
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d0c0
mov ebx, eax
test eax, eax
js 0x4134f8
cmp word [esi], 0x3d
je 0x413502
mov dword [ebp - 0x2244], 0x80020009
xor ecx, ecx
inc ecx
jmp 0x41321f
mov ecx, 3
jmp 0x41321f
cmp dword [ebp + 0x10], 0
je 0x41354b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2234]
push esi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00413980
mov ebx, eax
test eax, eax
jns 0x412ca0
mov dword [ebp - 0x2244], ebx
jmp 0x4134f0
cmp dword [ebp + 0x14], 0
jne 0x4135ea
cmp dword [ebp - 0x2238], 0
je 0x4135ea
xor eax, eax
mov dword [ebp - 0x2230], eax
lea ecx, [ebp - 0x2230]
push ecx
push 0x20006
push eax
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x2230]
mov edi, 0
test eax, eax
cmove edi, ecx
jne 0x4135d6
lea eax, [ebp - 0x2218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x4135d6
xor ecx, ecx
mov al, 1
test edi, edi
je 0x4135c7
push edi
mov dword [ebp - 0x2238], ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0x2238]
test al, al
jne 0x4135ea
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x41321f
push eax
call fcn.0048d340
mov ecx, 3
add esp, 4
mov ebx, eax
xor eax, eax
jmp 0x4135ac
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0048d280
mov ebx, eax
mov ecx, eax
shr ecx, 0x1f
or ecx, 2
jmp 0x4135cb
push dword [ebp - 0x2240]
jmp 0x412bc4
push str.SECURITY
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.SYSTEM
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
push str.TypeLib
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131ab
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor eax, eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
lea ecx, [ebp - 0x2218]
push esi
call fcn.00413830
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
jmp 0x4131ab
push str.Software
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
push str.TypeLib
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412cf0
cmp dword [ebp - 0x2238], 0
je 0x412cf0
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.00413830
jmp 0x412cf0
push eax
call fcn.0048d340
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x412bd5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412bd5
cmp eax, 0x16
je 0x413718
cmp eax, 0x22
jne 0x413731
push 0x80070057
call fcn.004a7480
cmp eax, 0xc
jne 0x413731
push 0x8007000e
call fcn.004a7480
push 0x80004005
call fcn.004a7480
int3