Function at 0x414510
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1140
call fcn.0041e560
mov eax, dword [0x475aa8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x1110], ecx
mov ecx, eax
push ebx
mov dword [ebp - 0x1114], eax
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1118], 0
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e19
cmp byte [ebx], 0x7d
push edi
je 0x414e05
nop word [eax + eax]
push str.Delete
push ebx
mov dword [ebp - 0x1124], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4145b3
test edi, edi
je 0x4146b1
mov ecx, dword [ebp - 0x1114]
push ebx
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
cmp dword [ebp + 0x10], 0
je 0x4146b1
mov al, byte [ebx]
mov ecx, ebx
mov dword [ebp - 0x1130], 0
mov dword [ebp - 0x1128], 0
test al, al
je 0x41460d
nop
cmp al, 0x5c
je 0x414605
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x4145f0
jmp 0x41460d
test ecx, ecx
jne 0x414dee
mov esi, 0x4646b8
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41466a
add esi, 4
cmp esi, 0x4646e8
jl 0x414612
mov eax, dword [ebp - 0x1110]
lea ecx, [ebp - 0x1130]
push ebx
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], 0
mov dword [ebp - 0x1128], 0
call fcn.00413b70
mov dword [ebp - 0x1130], 0
mov dword [ebp - 0x1128], 0
test edi, edi
je 0x4146a7
mov edi, dword [ebp - 0x1114]
mov ecx, edi
push ebx
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
push ebx
mov ecx, edi
call fcn.00415710
mov esi, eax
test esi, esi
js 0x414e05
mov dword [ebp - 0x112c], 0
jmp 0x414ab9
mov dword [ebp - 0x112c], 0
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4146e1
mov ecx, dword [ebp - 0x1114]
xor edi, edi
push ebx
mov dword [ebp - 0x1124], edi
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
jmp 0x4146e7
mov edi, dword [ebp - 0x1124]
push 0x464688
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x414824
mov ecx, dword [ebp - 0x1114]
lea eax, [ebp - 0x1108]
push eax
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
mov ecx, dword [ebp - 0x1114]
push ebx
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
cmp byte [ebx], 0x3d
jne 0x414dee
cmp dword [ebp + 0x10], 0
je 0x4147a5
mov eax, dword [ebp - 0x1110]
mov edi, dword [ebp - 0x1114]
mov ecx, edi
mov dword [ebp - 0x1140], eax
lea eax, [ebp - 0x1108]
push ebx
push eax
lea eax, [ebp - 0x1140]
mov dword [ebp - 0x113c], 0
push eax
mov dword [ebp - 0x1138], 0
call fcn.0040d8c0
mov esi, eax
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x1138], 0
test esi, esi
js 0x414e05
mov dword [ebp - 0x113c], 0
jmp 0x414ab9
cmp dword [ebp + 0x14], 0
jne 0x414809
test edi, edi
je 0x414809
lea eax, [ebp - 0x1124]
mov dword [ebp - 0x1124], 0
push eax
push 0x20006
push 0
push 0
push dword [ebp - 0x1110]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414dfa
mov edi, dword [ebp - 0x1124]
lea eax, [ebp - 0x1108]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4147fe
cmp eax, 2
jne 0x414dd6
test edi, edi
je 0x414809
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1114]
push ebx
call fcn.00415710
mov esi, eax
test esi, esi
js 0x414e05
jmp 0x414dcb
mov al, byte [ebx]
mov ecx, ebx
test al, al
je 0x41484d
nop dword [eax]
cmp al, 0x5c
je 0x414845
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x414830
jmp 0x41484d
test ecx, ecx
jne 0x414dee
cmp dword [ebp + 0x10], 0
je 0x414b0d
mov esi, dword [ebp - 0x1118]
mov dword [ebp - 0x110c], 0
test esi, esi
je 0x4148bd
cmp dword [esi], 0
je 0x4148b0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41490d
push str.RegOpenKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4148b6
push 0
push dword [esi]
lea ecx, [ebp - 0x110c]
push ecx
push 0x2001f
push 0
push ebx
push dword [ebp - 0x1110]
call eax
jmp 0x4148d8
cmp dword [esi + 4], 0
jne 0x4148bd
mov eax, 1
jmp 0x4148d8
lea eax, [ebp - 0x110c]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp - 0x1110]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41490d
mov ecx, dword [ebp - 0x1120]
test ecx, ecx
je 0x4148ed
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x110c]
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1120], edi
test eax, eax
je 0x414a81
jmp 0x414913
mov edi, dword [ebp - 0x1120]
mov dword [ebp - 0x110c], 0
test esi, esi
je 0x414973
cmp dword [esi], 0
je 0x414966
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4149bb
push str.RegOpenKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41496c
push 0
push dword [esi]
lea ecx, [ebp - 0x110c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x1110]
call eax
jmp 0x41498e
cmp dword [esi + 4], 0
jne 0x414973
mov eax, 1
jmp 0x41498e
lea eax, [ebp - 0x110c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x1110]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4149bb
test edi, edi
je 0x41499d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x110c]
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1120], edi
test eax, eax
je 0x414a81
mov dword [ebp - 0x110c], 0
test esi, esi
je 0x414a28
cmp dword [esi], 0
je 0x414a1b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x414df5
push str.RegCreateKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414a21
push 0
push dword [esi]
lea ecx, [ebp - 0x1134]
push ecx
lea ecx, [ebp - 0x110c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x1110]
call eax
jmp 0x414a50
cmp dword [esi + 4], 0
jne 0x414a28
mov eax, 1
jmp 0x414a50
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x110c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x1110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x414dfa
test edi, edi
je 0x414a63
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1120], ecx
test eax, eax
jne 0x414dfa
mov edi, dword [ebp - 0x1114]
mov ecx, edi
push ebx
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
cmp byte [ebx], 0x3d
jne 0x414ab9
push ebx
push 0
lea eax, [ebp - 0x1120]
mov ecx, edi
push eax
call fcn.0040d8c0
mov esi, eax
test esi, esi
js 0x414e05
cmp byte [ebx], 0x7b
jne 0x414dcb
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414ac7
sub ecx, edx
cmp ecx, 1
jne 0x414dcb
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x1120]
push ebx
call fcn.00414510
mov esi, eax
test esi, esi
js 0x414e05
push ebx
mov ecx, edi
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
jmp 0x414dcb
cmp dword [ebp + 0x14], 0
jne 0x414bcd
mov esi, dword [ebp - 0x1118]
mov dword [ebp - 0x110c], 0
test esi, esi
je 0x414b81
cmp dword [esi], 0
je 0x414b74
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x414b47
lea edi, [eax + 1]
jmp 0x414bd2
push str.RegOpenKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414b7a
push 0
push dword [esi]
lea ecx, [ebp - 0x110c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x1110]
call eax
jmp 0x414b9c
cmp dword [esi + 4], 0
jne 0x414b81
mov edi, 1
jmp 0x414b9e
lea eax, [ebp - 0x110c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x1110]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x414bd2
mov eax, dword [ebp - 0x1120]
test eax, eax
je 0x414bb5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov eax, dword [ebp - 0x110c]
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1120], eax
jmp 0x414bd2
mov edi, 2
test edi, edi
mov eax, 1
push 0xffffffffffffffff
cmove eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x110c], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0043b4f9
push eax
call fcn.0040df60
mov ecx, dword [ebp - 0x1114]
add esp, 0x14
push ebx
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
mov ecx, dword [ebp - 0x1114]
push ebx
call fcn.00415710
mov esi, eax
test esi, esi
js 0x414e05
cmp byte [ebx], 0x7b
jne 0x414c87
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414c36
sub ecx, edx
cmp ecx, 1
jne 0x414c87
push dword [ebp - 0x110c]
mov ecx, dword [ebp - 0x1114]
push 0
push dword [ebp - 0x1120]
push ebx
call fcn.00414510
mov esi, eax
test esi, esi
jns 0x414c71
cmp dword [ebp - 0x110c], 0
je 0x414e05
mov ecx, dword [ebp - 0x1114]
push ebx
call fcn.00410490
mov esi, eax
test esi, esi
js 0x414e05
cmp edi, 2
je 0x414dcb
test edi, edi
je 0x414ca4
cmp dword [ebp + 0x14], 0
jne 0x414dcb
push edi
jmp 0x414dfb
cmp dword [ebp + 0x14], 0
je 0x414d3a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110c]
mov dword [ebp - 0x110c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x1120]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x414d3a
cmp eax, dword [ebp - 0x110c]
sbb eax, eax
neg eax
je 0x414d3a
mov edi, 0x4646b8
push dword [edi]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x414dcb
add edi, 4
cmp edi, 0x4646e8
jl 0x414cf4
cmp dword [ebp - 0x1124], 0
je 0x414dcb
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x1120]
call fcn.00413b70
jmp 0x414dcb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110c]
mov dword [ebp - 0x110c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x1120]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x414d73
xor edi, edi
jmp 0x414d7f
xor eax, eax
cmp eax, dword [ebp - 0x110c]
sbb edi, edi
neg edi
mov ecx, dword [ebp - 0x1120]
xor eax, eax
test ecx, ecx
je 0x414d9a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x1120], ecx
mov dword [ebp - 0x111c], 0
test eax, eax
jne 0x414dfa
cmp dword [ebp - 0x1124], eax
je 0x414dcb
test edi, edi
jne 0x414dcb
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x1110]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x414dfa
cmp byte [ebx], 0x7d
jne 0x414580
jmp 0x414e05
push eax
call fcn.0040e020
add esp, 4
mov esi, eax
test edi, edi
je 0x414e05
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414e05
mov esi, 0x80020009
jmp 0x414e05
mov eax, 1
push eax
call fcn.0040e020
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1120]
pop edi
test eax, eax
je 0x414e17
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041de32
mov esp, ebp
pop ebp
ret 0x10