Function at 0x43cea0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.00641d10
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.00645dd0
add esp, 0xc
mov dword [ebp - 0x2234], esi
mov ecx, esi
push edi
call fcn.0043cd0e
mov ecx, eax
test eax, eax
js 0x43d991
cmp word [edi], 0x7d
je 0x43d991
push str.Delete
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov esi, eax
push 0x675fa8
push edi
call ebx
test esi, esi
je 0x43cf32
test eax, eax
jne 0x43d07b
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
call fcn.0043cd0e
mov ecx, eax
test eax, eax
js 0x43d991
cmp dword [ebp + 0x10], 0
je 0x43d07b
mov dword [ebp - 0x2238], ecx
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test cx, cx
mov edi, dword [sym.imp.USER32.dll_CharNextW]
je 0x43cf97
mov eax, dword [ebp + 8]
cmp cx, 0x5c
je 0x43d038
push eax
call edi
movzx ecx, word [eax]
test cx, cx
jne 0x43cf82
push str.AppID
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43d005
xor ebx, ebx
mov edi, ebx
cmp ebx, 0xb
je 0x43cfc9
lea ebx, [edi + 1]
push dword [edi*4 + 0x6760b4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43cfab
cmp edi, 0xb
jb 0x43d005
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor edi, edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
lea ecx, [ebp - 0x2218]
push dword [ebp + 8]
call fcn.0043dba2
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
xor edi, edi
test esi, esi
jne 0x43d045
mov edi, dword [ebp - 0x2234]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call fcn.0043cd0e
test eax, eax
js 0x43d591
mov ecx, edi
push esi
call fcn.0043dd1e
mov ecx, eax
mov edi, eax
sar edi, 0x1f
add edi, 4
jmp 0x43d04b
mov dword [ebp - 0x2240], 0x80020009
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x2238]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x43d06a
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
mov dword [ebp - 0x2218], 0
cmp edi, 4
je 0x43d1fb
test edi, edi
jne 0x43d5fa
push str.NoRemove
mov esi, dword [ebp + 8]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov edi, eax
test eax, eax
jne 0x43d0a6
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0043cd0e
test eax, eax
js 0x43d9e0
test edi, edi
setne byte [ebp - 0x2239]
push 0x675fa0
push esi
call ebx
test eax, eax
je 0x43d15c
movzx ecx, word [esi]
test cx, cx
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x43d0e5
mov eax, dword [ebp + 8]
cmp cx, 0x5c
je 0x43d98c
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x43d0d0
cmp dword [ebp + 0x10], 0
je 0x43d203
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x43d280
cmp dword [esi], 0
mov edi, dword [ebp - 0x2234]
je 0x43d2a2
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43d2c6
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d2c6
xor ecx, ecx
push ecx
push dword [esi]
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
jmp 0x43d2c2
push 0x2000
push 0xff
lea esi, [ebp - 0x2218]
push esi
call fcn.00645dd0
add esp, 0xc
mov edi, dword [ebp - 0x2234]
mov ecx, edi
push esi
call fcn.0043cd0e
test eax, eax
js 0x43d5e5
mov ecx, edi
mov edi, dword [ebp + 8]
push edi
call fcn.0043cd0e
mov esi, eax
test eax, eax
js 0x43d5e7
mov ecx, 0x80020009
cmp word [edi], 0x3d
mov edi, 1
jne 0x43d5f2
cmp dword [ebp + 0x10], 0
je 0x43d59d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.0043ddd0
mov ecx, eax
test eax, eax
js 0x43d610
mov esi, dword [ebp + 8]
jmp 0x43d532
mov ecx, 2
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x43d67c
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x43d622
cmp dword [esi], 0
je 0x43d617
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x43d679
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
inc ecx
test eax, eax
je 0x43d679
xor ecx, ecx
push ecx
push dword [esi]
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
jmp 0x43d63c
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x2234]
jmp 0x43d2c2
cmp dword [esi + 4], 0
je 0x43d2c6
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43d322
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x43d360
cmp dword [esi], 0
je 0x43d35a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43d382
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d382
xor ecx, ecx
push ecx
push dword [esi]
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
jmp 0x43d37a
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x43d451
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x43d2c6
jmp 0x43d4f9
cmp dword [esi + 4], 0
je 0x43d382
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43d41d
mov dword [ebp - 0x2218], 0xffffffff
mov dword [ebp - 0x2230], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x43d476
cmp dword [esi], 0
je 0x43d46c
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43d9d4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d9d4
mov ecx, eax
mov eax, dword [esi]
sub esp, 0x2c
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x28], eax
lea edx, [ebp - 0x2218]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x2230]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x679480]
movups xmmword [esp + 8], xmm0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call ecx
jmp 0x43d4b4
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x43d451
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x43d382
jmp 0x43d4f9
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x43d4f9
cmp dword [esi + 4], 0
je 0x43d9d4
sub esp, 0x24
lea eax, [ebp - 0x2218]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x2230]
mov dword [esp + 0x1c], eax
movaps xmm0, xmmword [0x679480]
movups xmmword [esp + 8], xmm0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43d9d7
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x43d4d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2224], 0
jmp 0x43d4db
xor eax, eax
mov ecx, dword [ebp - 0x2230]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x43d9d7
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call fcn.0043cd0e
mov ecx, eax
test eax, eax
js 0x43d991
movzx eax, word [esi]
cmp ax, 0x3d
jne 0x43d535
mov ecx, edi
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.0043ddd0
mov ecx, eax
test eax, eax
js 0x43d991
movzx eax, word [esi]
cmp ax, 0x7b
jne 0x43d751
mov esi, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.0065e7c2
add esp, 4
cmp eax, 1
jne 0x43d58a
mov esi, dword [ebp - 0x2234]
mov ecx, esi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push edi
call fcn.0043cea0
test eax, eax
js 0x43d9e0
mov ecx, esi
push edi
call fcn.0043cd0e
mov ecx, eax
test eax, eax
jns 0x43d754
jmp 0x43d991
mov ecx, esi
jmp 0x43d754
mov ecx, eax
mov edi, 3
jmp 0x43d04b
cmp dword [ebp + 0x14], 0
setne al
mov cl, byte [ebp - 0x2239]
xor cl, 1
or cl, al
jne 0x43d969
xor eax, eax
mov dword [ebp - 0x2230], eax
lea ecx, [ebp - 0x2230]
push ecx
push 0x20006
push eax
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43d924
push eax
call fcn.0043e1dd
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x2240]
mov edi, 3
mov dword [ebp - 0x2240], ecx
mov ecx, esi
test edi, edi
je 0x43d751
cmp edi, 2
je 0x43d751
jmp 0x43d9c7
mov esi, ecx
xor edi, edi
inc edi
jmp 0x43d5f2
cmp dword [esi + 4], 0
mov ecx, 1
je 0x43d679
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x43d679
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x43d661
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov dword [ebp - 0x2224], 0
jmp 0x43d663
xor ecx, ecx
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2238], ecx
test ecx, ecx
mov esi, 1
cmove esi, eax
mov dword [ebp - 0x2244], esi
push 0xffffffffffffffff
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0065f16f
add esp, 0x10
cmp eax, 0x15
jle 0x43d6ba
cmp eax, 0x50
je 0x43d6c2
jmp 0x43da1b
test eax, eax
jne 0x43da2f
mov esi, dword [ebp - 0x2234]
mov ecx, esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0043cd0e
test eax, eax
js 0x43d9e0
mov ecx, esi
push ebx
call fcn.0043dd1e
mov ecx, eax
test eax, eax
js 0x43d991
cmp word [ebx], 0x7b
jne 0x43d746
push ebx
mov esi, ecx
call fcn.0065e7c2
mov ecx, esi
add esp, 4
cmp eax, 1
jne 0x43d746
mov ecx, dword [ebp - 0x2234]
mov esi, dword [ebp - 0x2244]
push esi
push 0
push dword [ebp - 0x2224]
push ebx
call fcn.0043cea0
test esi, esi
jne 0x43d72e
mov ecx, eax
test eax, eax
js 0x43d991
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
call fcn.0043cd0e
mov ecx, eax
test eax, eax
js 0x43d991
mov eax, dword [ebp - 0x2238]
cmp eax, 2
jne 0x43d763
mov edi, dword [ebp + 8]
cmp word [edi], 0x7d
jne 0x43cf0e
jmp 0x43d991
test eax, eax
je 0x43d775
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 8]
jne 0x43d754
jmp 0x43d9e4
mov dword [ebp - 0x2238], ecx
cmp dword [ebp + 0x14], 0
je 0x43d842
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x43d842
cmp dword [ebp - 0x2218], 0
je 0x43d842
push str.AppID
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43d916
xor edi, edi
mov esi, edi
cmp edi, 0xb
je 0x43d814
lea edi, [esi + 1]
push dword [esi*4 + 0x6760b4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43d7f2
cmp esi, 0xb
setb al
mov cl, byte [ebp - 0x2239]
xor cl, 1
or cl, al
jne 0x43d916
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.0043dba2
jmp 0x43d916
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor ecx, ecx
test eax, eax
sete bl
cmp dword [ebp - 0x2218], ecx
setne bh
mov eax, dword [ebp - 0x2224]
test eax, eax
lea esi, [ebp - 0x218]
je 0x43d8c4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], ecx
test eax, eax
je 0x43d8ce
jmp 0x43d9d7
mov dword [ebp - 0x2220], 0
and bl, bh
test edi, edi
sete al
or al, bl
jne 0x43d916
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], ecx
mov dword [ebp - 0x2210], ecx
lea ecx, [ebp - 0x2218]
push esi
call fcn.0043e1f2
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
mov dword [ebp - 0x2214], ecx
mov dword [ebp - 0x2210], ecx
test eax, eax
jne 0x43d9ec
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2238]
jmp 0x43d754
mov edi, dword [ebp - 0x2230]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
je 0x43d95e
push eax
call fcn.0043e1dd
add esp, 4
mov esi, eax
test edi, edi
je 0x43d5e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d5e7
test edi, edi
je 0x43d969
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
call fcn.0043dd1e
mov esi, eax
mov edi, eax
shr edi, 0x1f
or edi, 2
mov ecx, dword [ebp - 0x2240]
jmp 0x43d5f2
mov ecx, 0x80020009
mov esi, ecx
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x43d9ae
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2224], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, esi
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
cmp edi, 3
je 0x43d991
mov ecx, dword [ebp - 0x2240]
jmp 0x43d991
xor eax, eax
inc eax
push eax
call fcn.0043e1dd
add esp, 4
mov ecx, eax
jmp 0x43d991
push dword [ebp - 0x2238]
jmp 0x43d9d8
push eax
call fcn.0043e1dd
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x43d991
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
mov dword [ebp - 0x2218], 0
jmp 0x43d991
cmp eax, 0x16
je 0x43da25
cmp eax, 0x22
jne 0x43da3e
push 0x80070057
call fcn.004ba530
cmp eax, 0xc
jne 0x43da3e
push 0x8007000e
call fcn.004ba530
push 0x80004005
call fcn.004ba530