Function at 0x417160
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x43ac66
push eax
mov eax, 0x2148
mov dword fs:[0], esp
call fcn.00425b50
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x2170]
mov edi, dword [esp + 0x2164]
push edi
mov dword [esp + 0x2160], 0
mov dword [esp + 0x50], eax
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417856
cmp byte [edi], 0x7d
push ebp
je 0x417844
jmp 0x4171e0
push str.Delete
push edi
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
neg eax
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x417211
test ebp, ebp
je 0x41733a
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
cmp dword [esp + 0x2170], 0
je 0x41733a
mov al, byte [edi]
mov ecx, edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
test al, al
je 0x41726e
cmp al, 0x5c
je 0x417266
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x417251
jmp 0x41726e
test ecx, ecx
jne 0x4177e7
mov esi, 0x43b6c0
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x4172c8
add esi, 4
cmp esi, 0x43b6f0
jl 0x417273
mov eax, dword [esp + 0x216c]
lea ecx, [esp + 0x20]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.00416940
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
test ebp, ebp
je 0x417332
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x4177f7
cmp byte [edi], 0x3d
jne 0x417327
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x4177f7
mov ecx, ebx
call fcn.004196d0
lea eax, [esp + 0x158]
mov ecx, ebx
push eax
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x4177f7
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x4177f7
xor esi, esi
mov dword [esp + 0x24], esi
jmp 0x4175ab
mov dword [esp + 0x24], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x417364
xor ebp, ebp
mov ecx, ebx
push edi
mov dword [esp + 0x20], ebp
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
jmp 0x417368
mov ebp, dword [esp + 0x1c]
push 0x43b790
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x4174f9
lea eax, [esp + 0x158]
mov ecx, ebx
push eax
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
cmp byte [edi], 0x3d
jne 0x4177f0
cmp dword [esp + 0x2170], 0
je 0x417429
mov ebp, dword [esp + 0x216c]
lea eax, [esp + 0x158]
push edi
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x2168], 1
push eax
mov ecx, ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call fcn.004042e0
mov esi, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
test esi, esi
js 0x417802
mov byte [esp + 0x2160], 0
mov dword [esp + 0x30], 0
jmp 0x4175ab
cmp dword [esp + 0x2174], 0
jne 0x4174a9
test ebp, ebp
je 0x4174a9
push 0x20006
push 0
push dword [esp + 0x2174]
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.00413780
test eax, eax
jne 0x41780d
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x158]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x41748e
cmp eax, 2
jne 0x41780d
test esi, esi
je 0x4174a1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
cmp byte [edi], 0x3d
jne 0x4174f2
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
mov ecx, ebx
call fcn.004196d0
lea eax, [esp + 0x1158]
mov ecx, ebx
push eax
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
xor esi, esi
jmp 0x4177dc
mov al, byte [edi]
mov ecx, edi
test al, al
je 0x41751e
cmp al, 0x5c
je 0x417516
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x417501
jmp 0x41751e
test ecx, ecx
jne 0x4177f0
cmp dword [esp + 0x2170], 0
je 0x4175fc
mov ebp, dword [esp + 0x216c]
lea ecx, [esp + 0x10]
push 0x2001f
push edi
push ebp
call fcn.00413780
test eax, eax
je 0x41757b
push 0x20019
push edi
push ebp
lea ecx, [esp + 0x1c]
call fcn.00413780
test eax, eax
je 0x41757b
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push ebp
lea ecx, [esp + 0x2c]
call fcn.00406f30
test eax, eax
jne 0x417839
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
cmp byte [edi], 0x3d
jne 0x4175ab
push edi
push 0
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.004042e0
mov esi, eax
test esi, esi
js 0x417844
cmp byte [edi], 0x7b
jne 0x4177dc
push edi
call fcn.00425000
add esp, 4
cmp eax, 1
jne 0x4177dc
push 0
push dword [esp + 0x2174]
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00417160
mov esi, eax
test esi, esi
js 0x417844
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
jmp 0x4177dc
cmp dword [esp + 0x2174], 0
jne 0x417624
push 0x20019
push edi
push dword [esp + 0x2174]
lea ecx, [esp + 0x1c]
call fcn.00413780
mov ebp, eax
test ebp, ebp
jne 0x417629
jmp 0x417634
mov ebp, 2
mov dword [esp + 0x2174], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x5c]
push 0x104
push eax
call fcn.00425252
push eax
call fcn.00405100
add esp, 0x14
mov ecx, ebx
push edi
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
cmp byte [edi], 0x3d
jne 0x4176aa
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
mov ecx, ebx
call fcn.004196d0
lea eax, [esp + 0x1158]
mov ecx, ebx
push eax
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
xor esi, esi
cmp byte [edi], 0x7b
jne 0x4176f9
push edi
call fcn.00425000
add esp, 4
cmp eax, 1
jne 0x4176f9
push dword [esp + 0x2174]
mov ecx, ebx
push esi
push dword [esp + 0x18]
push edi
call fcn.00417160
mov esi, eax
test esi, esi
jns 0x4176e7
cmp dword [esp + 0x2174], 0
je 0x417844
push edi
mov ecx, ebx
call fcn.0040e2b0
mov esi, eax
test esi, esi
js 0x417844
mov eax, dword [esp + 0x50]
mov dword [esp + 0x2174], eax
cmp ebp, 2
je 0x4177dc
test ebp, ebp
je 0x41771f
test eax, eax
jne 0x4177dc
push ebp
jmp 0x41783a
test eax, eax
je 0x417762
push dword [esp + 0x10]
mov ecx, ebx
call fcn.0040cdd0
test eax, eax
je 0x417762
lea eax, [esp + 0x54]
mov ecx, ebx
push eax
call fcn.004062c0
test eax, eax
je 0x4177dc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4177dc
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x14]
call fcn.00416940
jmp 0x4177dc
push dword [esp + 0x10]
mov ecx, ebx
call fcn.0040cdd0
mov ecx, dword [esp + 0x10]
mov ebp, eax
xor eax, eax
test ecx, ecx
je 0x417786
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
test eax, eax
jne 0x417839
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4177dc
test ebp, ebp
jne 0x4177dc
mov eax, dword [esp + 0x216c]
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
call fcn.00408220
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
test eax, eax
jne 0x417823
lea ecx, [esp + 0x38]
call fcn.00402d50
cmp byte [edi], 0x7d
jne 0x4171e0
jmp 0x417844
lea ecx, [esp + 0x20]
call fcn.00402d50
mov esi, 0x80020009
jmp 0x417844
lea ecx, [esp + 0x20]
call fcn.00402d50
jmp 0x417844
lea ecx, [esp + 0x2c]
call fcn.00402d50
jmp 0x417844
push eax
call fcn.00405330
add esp, 4
lea ecx, [esp + 0x44]
mov esi, eax
call fcn.00402d50
jmp 0x417844
push eax
call fcn.00405330
add esp, 4
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00402d50
jmp 0x417844
push eax
call fcn.00405330
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x10]
pop ebp
test eax, eax
je 0x417854
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x2154]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2154
ret 0x10