Function at 0x51f350
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2234
call fcn.004edcb0
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0xff
push ebx
call fcn.004f0940
add esp, 0xc
mov ecx, esi
push edi
call fcn.0051f1e0
mov ecx, eax
test eax, eax
js 0x51f3c6
mov dword [ebp - 0x2238], esi
cmp word [edi], 0x7d
je 0x51f3c6
mov esi, edi
jmp 0x51f573
mov ecx, eax
jmp 0x51f3c6
mov ecx, 0x80020009
mov esi, ecx
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x51f3d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x2234
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51f4f6
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51f4f6
mov ecx, eax
mov edi, dword [edi]
call dword [0x580f64]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x51f4c3
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51f488
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51f488
jmp 0x51f9b2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x51f52a
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x51f4ab
cmp dword [edi], 0
jne 0x51f3f2
cmp dword [edi + 4], 0
je 0x51f4f6
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x51f4f6
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x51f64b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x51f52a
sub esp, 0x1c
movaps xmm0, xmmword [0x56ae10]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.00520750
test eax, eax
jne 0x51fc1d
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051f1e0
mov ecx, eax
test eax, eax
js 0x51f3c6
movzx eax, word [esi]
cmp ax, 0x3d
je 0x51f98b
cmp ax, 0x7b
jne 0x51f569
mov edi, ecx
push esi
call fcn.00507e54
add esp, 4
cmp eax, 1
je 0x51fc2b
mov ecx, edi
cmp word [esi], 0x7d
je 0x51f3c6
push str.Delete
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov edi, eax
push 0x56ae38
push esi
call ebx
test eax, eax
je 0x51f6c9
test edi, edi
je 0x51f6c9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
push str.NoRemove
push esi
call edi
mov dword [ebp - 0x223c], eax
test eax, eax
je 0x51f666
push 0x56ae30
push esi
call edi
test eax, eax
je 0x51f67f
test esi, esi
je 0x51f5ec
mov eax, esi
jmp 0x51f5dc
test ecx, ecx
je 0x51f5ec
push eax
call ebx
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x51f5d5
test eax, eax
jne 0x51f3c1
cmp dword [ebp + 0x10], 0
je 0x51f718
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x51f61d
cmp dword [edi], 0
jne 0x51f43f
cmp dword [edi + 4], 0
je 0x51f488
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x51f488
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x51f463
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x51f52a
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051f1e0
test eax, eax
jns 0x51f5bd
jmp 0x51f3bd
push 0x2000
push 0xff
lea edi, [ebp - 0x2218]
push edi
call fcn.004f0940
add esp, 0xc
mov ecx, dword [ebp - 0x2238]
push edi
call fcn.0051f1e0
mov edx, 3
test eax, eax
jns 0x51fd09
mov ecx, eax
test edx, edx
je 0x51f569
cmp edx, 2
je 0x51f569
jmp 0x51fc63
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051f1e0
mov ecx, eax
test eax, eax
js 0x51f3c6
cmp dword [ebp + 0x10], 0
je 0x51f59b
mov dword [ebp - 0x2234], ecx
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test esi, esi
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
je 0x51f8d5
mov eax, esi
jmp 0x51f8aa
mov edx, 2
cmp dword [ebp + 0x14], 0
lea ebx, [ebp - 0x218]
jne 0x51f79a
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x51f751
cmp dword [edi], 0
jne 0x51f854
cmp dword [edi + 4], 0
mov edx, 1
je 0x51f79a
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x51f79a
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x51f784
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov dword [ebp - 0x2234], edx
test edx, edx
mov edi, 1
cmove edi, dword [ebp + 0x14]
push 0xffffffffffffffff
push esi
push 0x104
push ebx
call fcn.00508a8c
add esp, 0x10
mov ebx, esi
cmp eax, 0x15
jle 0x51f7cd
cmp eax, 0x50
je 0x51f7d5
jmp 0x51fed3
test eax, eax
jne 0x51fee7
mov esi, dword [ebp - 0x2238]
mov ecx, esi
push ebx
call fcn.0051f1e0
test eax, eax
js 0x51f3bd
mov ecx, esi
push ebx
call fcn.005201d0
mov ecx, eax
test eax, eax
js 0x51f3c6
mov esi, ebx
cmp word [ebx], 0x7b
je 0x51f831
lea ebx, [ebp - 0x218]
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x51f569
test eax, eax
je 0x51f9d8
cmp dword [ebp + 0x14], 0
jne 0x51f569
jmp 0x51fc1d
push esi
mov ebx, ecx
call fcn.00507e54
mov ecx, ebx
add esp, 4
cmp eax, 1
lea ebx, [ebp - 0x218]
mov eax, dword [ebp - 0x2234]
jne 0x51f811
jmp 0x51fc77
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x51f79a
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
je 0x51f79a
mov ecx, eax
mov edi, dword [edi]
call dword [0x580f64]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x51f769
push eax
call ebx
movzx ecx, word [eax]
test ecx, ecx
je 0x51f8d5
cmp ecx, 0x5c
jne 0x51f8a7
test eax, eax
je 0x51f8d5
mov dword [ebp - 0x2240], 0x80020009
xor edx, edx
inc edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [ebp - 0x2234]
jmp 0x51f950
push str.AppID
push esi
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call eax
test eax, eax
je 0x51f93a
push str.CLSID
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.Component_Categories
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.FileType
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.Interface
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.Hardware
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x51fe2d
xor edx, edx
test edi, edi
mov ecx, dword [ebp - 0x2234]
je 0x51fcc2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x51f979
push eax
mov dword [ebp - 0x2234], ecx
mov dword [ebp - 0x223c], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x223c]
mov ecx, dword [ebp - 0x2234]
cmp edx, 4
je 0x51f9aa
test edx, edx
je 0x51f5a7
jmp 0x51f6b3
mov ecx, dword [ebp - 0x2238]
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00520290
mov ecx, eax
test eax, eax
js 0x51f3c6
movzx eax, word [esi]
jmp 0x51f54d
mov ecx, eax
mov edi, dword [edi]
call dword [0x580f64]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x51f635
mov dword [ebp - 0x2234], ecx
cmp dword [ebp + 0x14], 0
mov edi, 0
je 0x51facd
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x51facd
cmp dword [ebp - 0x2218], 0
je 0x51facd
push str.AppID
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x51fac2
push str.CLSID
push ebx
call edi
test eax, eax
je 0x51fac2
push str.Component_Categories
push ebx
call edi
test eax, eax
je 0x51fac2
push str.FileType
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
push str.Interface
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
push str.Hardware
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
push str.Mime
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
push 0x56aef4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x51fbb1
mov ecx, dword [ebp - 0x2234]
jmp 0x51f569
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
setne dl
cmp dword [ebp - 0x2218], edi
sete dh
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x51fb9f
push eax
mov ebx, edx
mov bh, dh
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dh, bh
mov dl, bl
lea ebx, [ebp - 0x218]
mov dword [ebp - 0x2224], edi
mov dword [ebp - 0x2220], edi
test eax, eax
mov ecx, dword [ebp - 0x2234]
jne 0x51fc1d
or dl, dh
cmp dword [ebp - 0x223c], 0
sete al
xor dl, 1
or dl, al
jne 0x51f569
lea edi, [ebp - 0x2218]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
push ebx
call fcn.00520860
xor ecx, ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
test eax, eax
je 0x51fac2
jmp 0x51ff11
mov dword [ebp - 0x2220], 0
mov ecx, dword [ebp - 0x2234]
jmp 0x51fb56
push str.SECURITY
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
push str.SYSTEM
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
push str.Software
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51fac2
cmp dword [ebp - 0x223c], 0
sete byte [ebp - 0x223c]
push str.TypeLib
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
sete al
or al, byte [ebp - 0x223c]
jne 0x51fac2
jmp 0x51ff00
push eax
call fcn.00520730
add esp, 4
jmp 0x51f3bd
mov edi, dword [ebp - 0x2238]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push esi
call fcn.0051f350
test eax, eax
js 0x51f3bd
mov ecx, edi
push esi
call fcn.0051f1e0
mov ecx, eax
test eax, eax
jns 0x51f569
jmp 0x51f3c6
cmp edx, 3
je 0x51f3c6
mov ecx, dword [ebp - 0x2240]
jmp 0x51f3c6
mov ecx, dword [ebp - 0x2238]
push edi
push 0
push dword [ebp - 0x2224]
push esi
call fcn.0051f350
test eax, eax
setns dl
test edi, edi
setne cl
or cl, dl
cmp cl, 1
jne 0x51f3bd
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051f1e0
mov ecx, eax
test eax, eax
mov eax, dword [ebp - 0x2234]
jns 0x51f811
jmp 0x51f3c6
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051f1e0
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x51fce4
mov ecx, eax
mov edx, 3
jmp 0x51f950
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.005201d0
mov ecx, eax
mov edx, eax
sar edx, 0x1f
add edx, 4
jmp 0x51f950
mov edx, 3
jmp 0x51f6b3
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051f1e0
mov ecx, eax
test eax, eax
js 0x51fcff
xor edx, edx
inc edx
cmp word [esi], 0x3d
je 0x51fd33
mov dword [ebp - 0x2240], 0x80020009
jmp 0x51f6b3
cmp dword [ebp + 0x10], 0
jne 0x51fdeb
mov dword [ebp - 0x2234], ecx
cmp dword [ebp + 0x14], 0
jne 0x51fdd0
cmp dword [ebp - 0x223c], 0
je 0x51fdd0
xor eax, eax
lea edi, [ebp - 0x2230]
mov dword [edi], eax
push edi
push 0x20006
push eax
xor ebx, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
mov edi, 0
test eax, eax
cmove edi, ecx
jne 0x51fdb8
lea eax, [ebp - 0x2218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov cl, 1
test eax, 0xfffffffd
jne 0x51fdb8
test edi, edi
je 0x51fda7
push edi
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test cl, cl
jne 0x51fdd0
mov ecx, dword [ebp - 0x2234]
mov edx, ebx
jmp 0x51f6b3
mov ebx, 3
push eax
call fcn.00520730
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x2234], eax
jmp 0x51fd98
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.005201d0
mov ecx, eax
mov edx, eax
shr edx, 0x1f
or edx, 2
jmp 0x51f6b3
mov ebx, edx
lea eax, [ebp - 0x2230]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x2238]
mov edi, esi
push esi
lea edx, [ebp - 0x2218]
push edx
push eax
call fcn.00520290
mov ecx, eax
test eax, eax
js 0x51fe23
mov esi, edi
jmp 0x51f9aa
mov dword [ebp - 0x2240], ecx
mov esi, edi
jmp 0x51fdb1
push str.Mime
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push 0x56aef4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.SECURITY
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.SYSTEM
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
push str.TypeLib
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x51f93a
lea ecx, [ebp - 0x2218]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push esi
call fcn.00520080
xor eax, eax
lea ecx, [ebp - 0x2218]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
jmp 0x51f93a
cmp eax, 0x16
je 0x51fedd
cmp eax, 0x22
jne 0x51fef6
push 0x80070057
call fcn.00537370
cmp eax, 0xc
jne 0x51fef6
push 0x8007000e
call fcn.00537370
push 0x80004005
call fcn.00537370
lea ecx, [ebp - 0x2224]
push ebx
call fcn.00520080
jmp 0x51fac2
push eax
call fcn.00520730
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x51ff2d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
jmp 0x51f3c6