Function at 0x404f6e
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x45c530]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x18
mov eax, 0x446337
call fcn.0042d0d1
mov eax, dword [ebp + 0x420]
mov edi, dword [ebp + 0x41c]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x428]
and dword [ebp - 4], 0
mov dword [ebp - 0x24], eax
jmp 0x4053ce
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [ebp - 0x1c], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x404fea
test ebx, ebx
je 0x40507b
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x405433
cmp dword [ebp + 0x424], 0
je 0x40507b
and dword [ebp - 0x14], 0
push 0x5c
push edi
call fcn.00401eeb
test eax, eax
pop ecx
pop ecx
jne 0x4053e6
mov ecx, dword [ebp - 0x10]
push edi
call fcn.004020e4
test eax, eax
je 0x40503c
mov eax, dword [ebp - 0x20]
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.00402d7d
and dword [ebp - 0x14], 0
test ebx, ebx
je 0x405073
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x4053f5
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00402145
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00401a4c
test esi, esi
jl 0x405433
jmp 0x405396
lea ecx, [ebp - 0x14]
call fcn.00401a4c
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4050a1
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x1c], eax
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x405433
push 0x44ae6c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405182
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.00401f5b
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x405433
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401f5b
mov esi, eax
cmp esi, ebx
jl 0x405433
cmp word [edi], 0x3d
jne 0x4053ee
cmp dword [ebp + 0x424], ebx
je 0x405125
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push edi
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.00404c85
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
jl 0x40542e
mov byte [ebp - 4], bl
jmp 0x405391
cmp dword [ebp + 0x428], ebx
jne 0x405170
cmp dword [ebp - 0x1c], ebx
je 0x405170
push 0x20006
push ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.00401ab1
cmp eax, ebx
jne 0x4053fa
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x405168
cmp eax, 2
jne 0x4053fa
lea ecx, [ebp - 0x14]
call fcn.00401a4c
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00402145
mov esi, eax
cmp esi, ebx
jmp 0x4053d8
push 0x5c
push edi
call fcn.00401eeb
test eax, eax
pop ecx
pop ecx
jne 0x4053ee
cmp dword [ebp + 0x424], eax
je 0x405217
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.00401ab1
test eax, eax
je 0x4051e4
push 0x20019
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.00401ab1
test eax, eax
je 0x4051e4
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.00401a63
mov esi, eax
cmp esi, ebx
jne 0x405406
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x405433
cmp word [edi], 0x3d
jne 0x405396
mov ecx, dword [ebp - 0x10]
push edi
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00404c85
mov esi, eax
jmp 0x405066
cmp dword [ebp + 0x428], 0
jne 0x405235
push 0x20019
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.00401ab1
mov ebx, eax
jmp 0x405238
push 2
pop ebx
test ebx, ebx
je 0x405246
mov dword [ebp + 0x428], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x208]
push 0x104
push eax
call fcn.0042c4d4
push eax
call fcn.00401321
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x405433
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00402145
mov esi, eax
test esi, esi
jl 0x405433
cmp word [edi], 0x7b
jne 0x4052d5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4052d5
push dword [ebp + 0x428]
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x18]
push edi
call fcn.00404f6e
mov esi, eax
test esi, esi
jge 0x4052c2
cmp dword [ebp + 0x428], 0
je 0x405433
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x405433
cmp ebx, 2
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x428], eax
je 0x4053da
test ebx, ebx
je 0x405301
test eax, eax
jne 0x4053da
push ebx
call fcn.004014a6
pop ecx
mov esi, eax
jmp 0x405433
test eax, eax
je 0x405349
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.00402110
test eax, eax
je 0x405349
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x208]
push eax
call fcn.004020e4
test eax, eax
je 0x4053da
cmp dword [ebp - 0x1c], 0
je 0x4053da
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402d7d
jmp 0x4053da
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.00402110
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.00401a4c
mov ebx, eax
test ebx, ebx
jne 0x405417
cmp dword [ebp - 0x1c], eax
je 0x4053da
cmp dword [ebp - 0x14], eax
jne 0x4053da
lea eax, [ebp + 0x208]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0x1c], ebx
test eax, eax
jne 0x405422
lea ecx, [ebp - 0x1c]
call fcn.00401a4c
cmp dword [ebp + 0x424], 0
je 0x4053da
cmp word [edi], 0x7b
jne 0x4053da
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4053da
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x424]
push dword [ebp - 0x18]
push edi
call fcn.00404f6e
mov esi, eax
test esi, esi
jl 0x405433
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401f5b
mov esi, eax
test esi, esi
jl 0x405433
cmp word [edi], 0x7d
jne 0x404fba
jmp 0x405433
lea ecx, [ebp - 0x14]
call fcn.00401a4c
mov esi, 0x80020009
jmp 0x405433
lea ecx, [ebp - 0x14]
jmp 0x40542e
push eax
call fcn.004014a6
pop ecx
lea ecx, [ebp - 0x14]
jmp 0x40542c
lea ecx, [ebp - 0x18]
call fcn.00401a4c
push esi
call fcn.004014a6
pop ecx
jmp 0x40543d
lea ecx, [ebp - 0x18]
call fcn.00401a4c
push ebx
jmp 0x40540f
push eax
call fcn.004014a6
pop ecx
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00401a4c
lea ecx, [ebp - 0x18]
call fcn.00401a4c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0042c3ca
add ebp, 0x414
leave
ret 0x10