Function at 0x421860
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463c9b
mov eax, dword fs:[0]
push eax
mov eax, 0x1140
call fcn.0043a720
mov eax, dword [0x488480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1120], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x111c], eax
mov dword [ebp - 0x112c], 0
mov dword [ebp - 0x1128], 0
mov dword [ebp - 0x1124], 0
push ebx
mov dword [ebp - 4], 0
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221fd
cmp byte [ebx], 0x7d
je 0x4221ea
nop dword [eax]
nop word [eax + eax]
push str.Delete
push ebx
mov dword [ebp - 0x1130], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.ForceRemove
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x421920
test edi, edi
jne 0x421a21
mov ecx, dword [ebp - 0x1120]
push ebx
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
cmp dword [ebp + 0x10], 0
je 0x421a21
mov al, byte [ebx]
mov ecx, ebx
mov dword [ebp - 0x113c], 0
mov dword [ebp - 0x1134], 0
test al, al
je 0x42197d
nop dword [eax]
cmp al, 0x5c
je 0x421975
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x421960
jmp 0x42197d
test ecx, ecx
jne 0x4221d3
mov esi, 0x46a95c
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4219da
add esi, 4
cmp esi, 0x46a98c
jl 0x421982
mov eax, dword [ebp - 0x111c]
lea ecx, [ebp - 0x113c]
push ebx
mov dword [ebp - 0x113c], eax
mov dword [ebp - 0x1138], 0
mov dword [ebp - 0x1134], 0
call fcn.00420fc0
mov dword [ebp - 0x113c], 0
mov dword [ebp - 0x1134], 0
test edi, edi
jne 0x421a17
mov edi, dword [ebp - 0x1120]
mov ecx, edi
push ebx
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
push ebx
mov ecx, edi
call fcn.004225e0
mov esi, eax
test esi, esi
js 0x4221ea
mov dword [ebp - 0x1138], 0
jmp 0x421e39
mov dword [ebp - 0x1138], 0
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x421a51
mov ecx, dword [ebp - 0x1120]
xor edi, edi
push ebx
mov dword [ebp - 0x1130], edi
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
jmp 0x421a57
mov edi, dword [ebp - 0x1130]
push 0x46a90c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x421ba6
mov ecx, dword [ebp - 0x1120]
lea eax, [ebp - 0x1114]
push eax
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
mov ecx, dword [ebp - 0x1120]
push ebx
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
cmp byte [ebx], 0x3d
jne 0x4221d3
cmp dword [ebp + 0x10], 0
je 0x421b27
mov eax, dword [ebp - 0x111c]
mov edi, dword [ebp - 0x1120]
mov ecx, edi
mov dword [ebp - 0x114c], eax
lea eax, [ebp - 0x1114]
push ebx
push eax
lea eax, [ebp - 0x114c]
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x1148], 0
mov dword [ebp - 0x1144], 0
call fcn.0041ff10
mov esi, eax
mov dword [ebp - 0x114c], 0
mov dword [ebp - 0x1148], 0
mov dword [ebp - 0x1144], 0
test esi, esi
js 0x4221ea
mov byte [ebp - 4], 0
mov dword [ebp - 0x1148], 0
jmp 0x421e39
cmp dword [ebp + 0x14], 0
jne 0x421b8b
test edi, edi
je 0x421b8b
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x1130], 0
push eax
push 0x20006
push 0
push 0
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4221df
mov edi, dword [ebp - 0x1130]
lea eax, [ebp - 0x1114]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x421b80
cmp eax, 2
jne 0x4221bb
test edi, edi
je 0x421b8b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1120]
push ebx
call fcn.004225e0
mov esi, eax
test esi, esi
js 0x4221ea
jmp 0x4221b0
mov al, byte [ebx]
mov ecx, ebx
test al, al
je 0x421bcd
nop
cmp al, 0x5c
je 0x421bc5
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x421bb0
jmp 0x421bcd
test ecx, ecx
jne 0x4221d3
cmp dword [ebp + 0x10], 0
je 0x421e8d
mov esi, dword [ebp - 0x1124]
mov dword [ebp - 0x1118], 0
test esi, esi
je 0x421c3d
cmp dword [esi], 0
je 0x421c30
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x421c8d
push str.RegOpenKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421c36
push 0
push dword [esi]
lea ecx, [ebp - 0x1118]
push ecx
push 0x2001f
push 0
push ebx
push dword [ebp - 0x111c]
call eax
jmp 0x421c58
cmp dword [esi + 4], 0
jne 0x421c3d
mov eax, 1
jmp 0x421c58
lea eax, [ebp - 0x1118]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421c8d
mov ecx, dword [ebp - 0x112c]
test ecx, ecx
je 0x421c6d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1118]
mov dword [ebp - 0x112c], edi
mov dword [ebp - 0x1128], 0
test eax, eax
je 0x421e01
jmp 0x421c93
mov edi, dword [ebp - 0x112c]
mov dword [ebp - 0x1118], 0
test esi, esi
je 0x421cf3
cmp dword [esi], 0
je 0x421ce6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x421d3b
push str.RegOpenKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421cec
push 0
push dword [esi]
lea ecx, [ebp - 0x1118]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x111c]
call eax
jmp 0x421d0e
cmp dword [esi + 4], 0
jne 0x421cf3
mov eax, 1
jmp 0x421d0e
lea eax, [ebp - 0x1118]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421d3b
test edi, edi
je 0x421d1d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1118]
mov dword [ebp - 0x112c], edi
mov dword [ebp - 0x1128], 0
test eax, eax
je 0x421e01
mov dword [ebp - 0x1118], 0
test esi, esi
je 0x421da8
cmp dword [esi], 0
je 0x421d9b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4221da
push str.RegCreateKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421da1
push 0
push dword [esi]
lea ecx, [ebp - 0x1140]
push ecx
lea ecx, [ebp - 0x1118]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x111c]
call eax
jmp 0x421dd0
cmp dword [esi + 4], 0
jne 0x421da8
mov eax, 1
jmp 0x421dd0
lea eax, [ebp - 0x1140]
push eax
lea eax, [ebp - 0x1118]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4221df
test edi, edi
je 0x421de3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1118]
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1128], 0
test eax, eax
jne 0x4221df
mov edi, dword [ebp - 0x1120]
mov ecx, edi
push ebx
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
cmp byte [ebx], 0x3d
jne 0x421e39
push ebx
push 0
lea eax, [ebp - 0x112c]
mov ecx, edi
push eax
call fcn.0041ff10
mov esi, eax
test esi, esi
js 0x4221ea
cmp byte [ebx], 0x7b
jne 0x4221b0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x421e47
sub ecx, edx
cmp ecx, 1
jne 0x4221b0
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x112c]
push ebx
call fcn.00421860
mov esi, eax
test esi, esi
js 0x4221ea
push ebx
mov ecx, edi
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
jmp 0x4221b0
cmp dword [ebp + 0x14], 0
jne 0x421f4d
mov esi, dword [ebp - 0x1124]
mov dword [ebp - 0x1118], 0
test esi, esi
je 0x421f01
cmp dword [esi], 0
je 0x421ef4
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x421ec7
lea edi, [eax + 1]
jmp 0x421f52
push str.RegOpenKeyTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421efa
push 0
push dword [esi]
lea ecx, [ebp - 0x1118]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x111c]
call eax
jmp 0x421f1c
cmp dword [esi + 4], 0
jne 0x421f01
mov edi, 1
jmp 0x421f1e
lea eax, [ebp - 0x1118]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x421f52
mov eax, dword [ebp - 0x112c]
test eax, eax
je 0x421f35
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x1128], 0
jmp 0x421f52
mov edi, 2
test edi, edi
mov eax, 1
push 0xffffffffffffffff
cmove eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x1118], eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00447f64
push eax
call fcn.00405930
mov ecx, dword [ebp - 0x1120]
add esp, 0x14
push ebx
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
mov ecx, dword [ebp - 0x1120]
push ebx
call fcn.004225e0
mov esi, eax
test esi, esi
js 0x4221ea
cmp byte [ebx], 0x7b
jne 0x422007
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x421fb6
sub ecx, edx
cmp ecx, 1
jne 0x422007
push dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1120]
push 0
push dword [ebp - 0x112c]
push ebx
call fcn.00421860
mov esi, eax
test esi, esi
jns 0x421ff1
cmp dword [ebp - 0x1118], 0
je 0x4221ea
mov ecx, dword [ebp - 0x1120]
push ebx
call fcn.00420ac0
mov esi, eax
test esi, esi
js 0x4221ea
cmp edi, 2
je 0x4221b0
test edi, edi
je 0x422024
cmp dword [ebp + 0x14], 0
jne 0x4221b0
push edi
jmp 0x4221e0
cmp dword [ebp + 0x14], 0
je 0x4220ba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1118]
mov dword [ebp - 0x1118], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x112c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4220ba
cmp eax, dword [ebp - 0x1118]
sbb eax, eax
neg eax
je 0x4220ba
mov edi, 0x46a95c
push dword [edi]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4221b0
add edi, 4
cmp edi, 0x46a98c
jl 0x422074
cmp dword [ebp - 0x1130], 0
je 0x4221b0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x112c]
call fcn.00420fc0
jmp 0x4221b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1118]
mov dword [ebp - 0x1118], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x112c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4220f3
xor edi, edi
jmp 0x4220ff
xor eax, eax
cmp eax, dword [ebp - 0x1118]
sbb edi, edi
neg edi
mov ecx, dword [ebp - 0x112c]
xor eax, eax
test ecx, ecx
je 0x42211a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1128], 0
test eax, eax
jne 0x4221df
cmp dword [ebp - 0x1130], eax
je 0x4221b0
test edi, edi
jne 0x4221b0
cmp byte [0x4aaeb8], al
jne 0x42217b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x42216d
push str.RegDeleteKeyExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4aaeb4], eax
mov byte [0x4aaeb8], 1
jmp 0x422180
mov eax, dword [0x4aaeb4]
mov byte [0x4aaeb8], 1
jmp 0x422180
mov eax, dword [0x4aaeb4]
test eax, eax
je 0x422199
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
push dword [ebp - 0x111c]
call eax
jmp 0x4221ac
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4221df
cmp byte [ebx], 0x7d
jne 0x4218f0
jmp 0x4221ea
push eax
call fcn.00420600
add esp, 4
mov esi, eax
test edi, edi
je 0x4221ea
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4221ea
mov esi, 0x80020009
jmp 0x4221ea
mov eax, 1
push eax
call fcn.00420600
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x112c]
test eax, eax
je 0x4221fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a0ec
mov esp, ebp
pop ebp
ret 0x10