Function at 0x416143
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451df5
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.00424390
mov eax, dword [0x46d290]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x223c]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], eax
mov dword [ebp - 4], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2268], eax
push ebx
mov ecx, edi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
push 0x7d
pop eax
cmp word [ebx], ax
je 0x41673c
xor eax, eax
push str.Delete
inc eax
push ebx
mov dword [ebp - 0x2240], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x45699c
sbb esi, esi
inc esi
push ebx
mov dword [ebp - 0x221c], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41620a
test esi, esi
je 0x4162e7
push ebx
mov ecx, edi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4162e9
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
push 0x5c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2230], esi
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
call fcn.00418378
pop ecx
pop ecx
test eax, eax
jne 0x41672c
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.0040f416
test eax, eax
je 0x41629e
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2230]
push ebx
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
call fcn.00415ab0
mov dword [ebp - 0x2230], esi
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
cmp dword [ebp - 0x221c], esi
je 0x4162da
push ebx
mov ecx, edi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x416724
push ebx
mov ecx, edi
call fcn.004180e5
lea ecx, [ebp - 0x2230]
mov esi, eax
call fcn.0040f7a7
test esi, esi
js 0x41673c
jmp 0x4166e0
lea ecx, [ebp - 0x2230]
call fcn.0040f7a7
jmp 0x4162e9
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416311
push ebx
mov ecx, edi
mov dword [ebp - 0x2240], esi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
push 0x456994
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416464
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
push ebx
mov ecx, edi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x416737
cmp dword [ebp + 0x10], 0
je 0x4163d9
xor eax, eax
lea edi, [ebp - 0x2258]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x2224]
xor eax, eax
and dword [ebp - 0x2254], 0
inc eax
and dword [ebp - 0x2250], 0
mov ecx, edi
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2258]
push eax
call fcn.0040e89d
mov esi, eax
lea ecx, [ebp - 0x2258]
xor eax, eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
test esi, esi
js 0x416776
mov byte [ebp - 4], al
call fcn.0040f7a7
jmp 0x4166e0
cmp dword [ebp + 0x14], 0
jne 0x416457
cmp dword [ebp - 0x2240], 0
je 0x416457
xor eax, eax
lea edi, [ebp - 0x2264]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2264]
push 0x20006
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push dword [ebp - 0x2220]
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2260], eax
mov dword [ebp - 0x225c], eax
call fcn.00414d13
test eax, eax
jne 0x416767
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2264]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x416446
cmp eax, 2
jne 0x416767
lea ecx, [ebp - 0x2264]
call fcn.0040f7a7
mov edi, dword [ebp - 0x2224]
push ebx
mov ecx, edi
call fcn.004180e5
jmp 0x4161bc
push 0x5c
push ebx
call fcn.00418378
pop ecx
pop ecx
test eax, eax
jne 0x416737
cmp dword [ebp + 0x10], eax
je 0x416507
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
push 0x2001f
push ebx
push esi
call fcn.00414d13
test eax, eax
je 0x4164d1
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x223c]
call fcn.00414d13
test eax, eax
je 0x4164d1
xor eax, eax
lea ecx, [ebp - 0x223c]
push eax
push eax
push 0x2001f
push eax
push eax
push ebx
push esi
call fcn.0040fa8f
test eax, eax
jne 0x4165e9
push ebx
mov ecx, edi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x4166e0
push ebx
push 0
lea eax, [ebp - 0x223c]
mov ecx, edi
push eax
call fcn.0040e89d
mov esi, eax
jmp 0x4162cd
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x416527
push 0x20019
push ebx
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
call fcn.00414d13
jmp 0x41652a
push 2
pop eax
push 1
test eax, eax
mov dword [ebp - 0x221c], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
lea eax, [ebp - 0x218]
push ebx
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.004225f4
push eax
call fcn.004031e5
add esp, 0x14
mov ecx, edi
push ebx
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
push ebx
mov ecx, edi
call fcn.004180e5
mov esi, eax
test esi, esi
js 0x41673c
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4165c5
push ebx
call fcn.00421690
pop ecx
cmp eax, 1
jne 0x4165c5
push dword [ebp + 0x14]
mov ecx, edi
push 0
push dword [ebp - 0x223c]
push ebx
call fcn.00416143
mov esi, eax
test esi, esi
jns 0x4165b3
cmp dword [ebp + 0x14], 0
je 0x41673c
push ebx
mov ecx, edi
call fcn.00414bba
mov esi, eax
test esi, esi
js 0x41673c
mov eax, dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2268]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x4161c6
test eax, eax
je 0x4165f7
test ecx, ecx
jne 0x4161c6
push eax
call fcn.0040f377
pop ecx
mov esi, eax
jmp 0x41673c
test ecx, ecx
je 0x416646
push dword [ebp - 0x223c]
mov ecx, edi
call fcn.0041341f
test eax, eax
je 0x416646
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0040f416
test eax, eax
je 0x4161c6
cmp dword [ebp - 0x2240], 0
je 0x4161c6
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x223c]
call fcn.00415ab0
jmp 0x4161c6
push dword [ebp - 0x223c]
mov ecx, edi
call fcn.0041341f
lea ecx, [ebp - 0x223c]
mov dword [ebp - 0x221c], eax
call fcn.0040f7a7
test eax, eax
jne 0x4165e9
cmp dword [ebp - 0x2240], eax
je 0x4161c6
cmp dword [ebp - 0x221c], eax
jne 0x4161c6
lea edi, [ebp - 0x224c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x224c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2220]
xor edi, edi
mov dword [ebp - 0x224c], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2248], edi
mov dword [ebp - 0x2244], edi
call fcn.0040ffae
mov dword [ebp - 0x224c], edi
mov dword [ebp - 0x2248], edi
mov dword [ebp - 0x2244], edi
test eax, eax
jne 0x41677d
lea ecx, [ebp - 0x224c]
call fcn.0040f7a7
mov edi, dword [ebp - 0x2224]
cmp dword [ebp + 0x10], 0
je 0x4161c6
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4161c6
push ebx
call fcn.00421690
pop ecx
cmp eax, 1
jne 0x4161c6
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x223c]
push ebx
call fcn.00416143
mov esi, eax
test esi, esi
js 0x41673c
jmp 0x4161b4
lea ecx, [ebp - 0x2230]
jmp 0x416776
lea ecx, [ebp - 0x2230]
call fcn.0040f7a7
mov esi, 0x80020009
lea ecx, [ebp - 0x223c]
call fcn.0040f7a7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421ac3
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.0040f377
pop ecx
lea ecx, [ebp - 0x2264]
mov esi, eax
call fcn.0040f7a7
jmp 0x41673c
push eax
call fcn.0040f377
pop ecx
lea ecx, [ebp - 0x224c]
jmp 0x416774