Function at 0x412b60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.00460860
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.00463600
add esp, 0xc
mov ecx, esi
push edi
call fcn.004907b0
mov ebx, eax
test eax, eax
js 0x412be5
mov dword [ebp - 0x2234], esi
cmp word [edi], 0x7d
je 0x412be5
mov esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x412d0a
push eax
call fcn.00490a30
add esp, 4
mov ebx, eax
jmp 0x412be5
mov ebx, 0x80020009
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x412bf6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x412c64
sub esp, 0x1c
movaps xmm0, xmmword [0x4d7800]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.00413e30
test eax, eax
jne 0x412bd3
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.004907b0
mov ebx, eax
test eax, eax
js 0x412be5
movzx eax, word [esi]
cmp ax, 0x3d
je 0x412c8b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x412cb3
mov ecx, dword [ebp - 0x2234]
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00413990
mov ebx, eax
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
js 0x412be5
movzx eax, word [esi]
cmp ax, 0x7b
jne 0x412d00
push esi
call fcn.0047e4dc
add esp, 4
cmp eax, 1
jne 0x412d00
mov edi, dword [ebp - 0x2234]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push esi
call fcn.00412b60
test eax, eax
js 0x412bdc
mov ecx, edi
push esi
call fcn.004907b0
mov ebx, eax
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
js 0x412be5
cmp word [esi], 0x7d
je 0x412be5
push str.Delete
push esi
call edi
mov ecx, edi
mov edi, eax
push 0x4d7298
push esi
call ecx
test eax, eax
je 0x4130d1
test edi, edi
je 0x4130d1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.NoRemove
push esi
call edi
mov dword [ebp - 0x2238], eax
test eax, eax
je 0x412d64
push 0x4d7290
push esi
call edi
test eax, eax
je 0x4131fb
test esi, esi
mov edi, dword [sym.imp.USER32.dll_CharNextW]
je 0x412d90
mov eax, esi
jmp 0x412d80
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.004907b0
test eax, eax
jns 0x412d46
jmp 0x412bdc
test ecx, ecx
je 0x412d90
push eax
call edi
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x412d79
test eax, eax
jne 0x412be0
cmp dword [ebp + 0x10], 0
je 0x412f0e
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x412dbd
cmp dword [edi], 0
jne 0x412e78
cmp dword [edi + 4], 0
je 0x412e08
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412e08
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x412e5d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x412c64
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x412e2f
cmp dword [edi], 0
jne 0x412ec1
cmp dword [edi + 4], 0
je 0x412c30
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412c30
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x412c0f
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x412c64
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412e08
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412e08
mov ecx, eax
mov edi, dword [edi]
call dword [0x4e925c]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x412dd5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412c30
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412c30
mov ecx, eax
mov edi, dword [edi]
call dword [0x4e925c]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x412e47
mov edx, 2
cmp dword [ebp + 0x14], 0
jne 0x412fd6
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x412f8d
cmp dword [edi], 0
je 0x412f82
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x412fd6
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
je 0x412fd6
mov ecx, eax
mov edi, dword [edi]
call dword [0x4e925c]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x412fa5
cmp dword [edi + 4], 0
mov edx, 1
je 0x412fd6
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x412fd6
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x412fc0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov dword [ebp - 0x2240], edx
test edx, edx
mov eax, 1
cmove eax, dword [ebp + 0x14]
mov dword [ebp - 0x223c], eax
push 0xffffffffffffffff
push esi
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0047ea03
add esp, 0x10
mov edi, esi
cmp eax, 0x15
jle 0x413015
cmp eax, 0x50
je 0x41301d
jmp 0x41371e
test eax, eax
jne 0x413732
mov esi, dword [ebp - 0x2234]
mov ecx, esi
push edi
call fcn.004907b0
test eax, eax
js 0x412bdc
mov ecx, esi
push edi
call fcn.00490970
mov ebx, eax
test eax, eax
js 0x412be5
mov esi, edi
cmp word [edi], 0x7b
jne 0x4130a5
push esi
call fcn.0047e4dc
add esp, 4
cmp eax, 1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jne 0x4130ab
mov ecx, dword [ebp - 0x2234]
push dword [ebp - 0x223c]
push 0
push dword [ebp - 0x2224]
push esi
call fcn.00412b60
test eax, eax
jns 0x41308e
mov ebx, eax
cmp dword [ebp - 0x223c], 0
je 0x412be5
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.004907b0
mov ebx, eax
test eax, eax
jns 0x4130ab
jmp 0x412be5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2240]
cmp eax, 2
je 0x412d00
test eax, eax
je 0x413254
cmp dword [ebp + 0x14], 0
jne 0x412d00
jmp 0x413612
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.004907b0
mov ebx, eax
test eax, eax
js 0x412be5
cmp dword [ebp + 0x10], 0
je 0x412d2e
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test esi, esi
je 0x413136
mov eax, esi
jmp 0x413114
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test ecx, ecx
je 0x413136
cmp ecx, 0x5c
jne 0x41310d
test eax, eax
je 0x413136
mov dword [ebp - 0x2244], 0x80020009
xor ecx, ecx
inc ecx
jmp 0x4131c5
push str.AppID
push esi
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call eax
test eax, eax
je 0x4131bb
push str.CLSID
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.Component_Categories
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.FileType
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.Interface
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.Hardware
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.Mime
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push 0x4d7354
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41361d
xor ecx, ecx
test edi, edi
je 0x4134a1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x4131e8
push eax
mov dword [ebp - 0x2238], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2238]
cmp ecx, 4
je 0x412cb0
test ecx, ecx
je 0x412d34
jmp 0x41322f
push 0x2000
push 0xff
lea ebx, [ebp - 0x2218]
push ebx
call fcn.00463600
add esp, 0xc
mov ecx, dword [ebp - 0x2234]
push ebx
call fcn.004907b0
mov ecx, 3
test eax, eax
jns 0x4134de
mov ebx, eax
test ecx, ecx
je 0x412d00
cmp ecx, 2
je 0x412d00
cmp ecx, 3
je 0x412be5
mov ebx, dword [ebp - 0x2244]
jmp 0x412be5
cmp dword [ebp + 0x14], 0
mov edi, 0
je 0x4133a1
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4133a1
cmp dword [ebp - 0x2218], 0
je 0x4133a1
push str.AppID
lea edi, [ebp - 0x218]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x412d00
push str.CLSID
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.Component_Categories
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.FileType
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.Interface
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.Hardware
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.Mime
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push 0x4d7354
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.SECURITY
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.SYSTEM
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x4136a9
jmp 0x412d00
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
setne cl
cmp dword [ebp - 0x2218], edi
sete dl
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x413495
push eax
mov byte [ebp - 0x2240], cl
mov byte [ebp - 0x223c], dl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dl, byte [ebp - 0x223c]
mov cl, byte [ebp - 0x2240]
xor edi, edi
mov dword [ebp - 0x2224], edi
mov dword [ebp - 0x2220], edi
test eax, eax
jne 0x412bd3
or cl, dl
cmp dword [ebp - 0x2238], 0
sete al
xor cl, 1
or cl, al
jne 0x41348a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor edi, edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
lea ecx, [ebp - 0x2218]
lea eax, [ebp - 0x218]
push eax
call fcn.00413f40
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
test eax, eax
jne 0x4136f9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x412d00
mov dword [ebp - 0x2220], 0
jmp 0x413434
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.004907b0
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x4134c3
mov ebx, eax
mov ecx, 3
jmp 0x4131cb
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.00490970
mov ebx, eax
mov ecx, eax
sar ecx, 0x1f
add ecx, 4
jmp 0x4131cb
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.004907b0
mov ebx, eax
test eax, eax
js 0x413508
cmp word [esi], 0x3d
je 0x413512
mov dword [ebp - 0x2244], 0x80020009
xor ecx, ecx
inc ecx
jmp 0x41322f
mov ecx, 3
jmp 0x41322f
cmp dword [ebp + 0x10], 0
je 0x41355b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2234]
push esi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00413990
mov ebx, eax
test eax, eax
jns 0x412cb0
mov dword [ebp - 0x2244], ebx
jmp 0x413500
cmp dword [ebp + 0x14], 0
jne 0x4135fa
cmp dword [ebp - 0x2238], 0
je 0x4135fa
xor eax, eax
mov dword [ebp - 0x2230], eax
lea ecx, [ebp - 0x2230]
push ecx
push 0x20006
push eax
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x2230]
mov edi, 0
test eax, eax
cmove edi, ecx
jne 0x4135e6
lea eax, [ebp - 0x2218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x4135e6
xor ecx, ecx
mov al, 1
test edi, edi
je 0x4135d7
push edi
mov dword [ebp - 0x2238], ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0x2238]
test al, al
jne 0x4135fa
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x41322f
push eax
call fcn.00490a30
mov ecx, 3
add esp, 4
mov ebx, eax
xor eax, eax
jmp 0x4135bc
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.00490970
mov ebx, eax
mov ecx, eax
shr ecx, 0x1f
or ecx, 2
jmp 0x4135db
push dword [ebp - 0x2240]
jmp 0x412bd4
push str.SECURITY
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.SYSTEM
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
push str.TypeLib
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4131bb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor eax, eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
lea ecx, [ebp - 0x2218]
push esi
call fcn.00413840
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
jmp 0x4131bb
push str.Software
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
push str.TypeLib
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x412d00
cmp dword [ebp - 0x2238], 0
je 0x412d00
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.00413840
jmp 0x412d00
push eax
call fcn.00490a30
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x412be5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412be5
cmp eax, 0x16
je 0x413728
cmp eax, 0x22
jne 0x413741
push 0x80070057
call fcn.004ab480
cmp eax, 0xc
jne 0x413741
push 0x8007000e
call fcn.004ab480
push 0x80004005
call fcn.004ab480
int3