Function at 0x41b5e5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464561
mov eax, dword fs:[0]
push eax
mov eax, 0x2258
call fcn.0043ff20
mov eax, dword [0x484db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2264], eax
push edi
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
push 0x7d
pop eax
cmp word [edi], ax
je 0x41bb88
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp - 0x223c], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb esi, esi
push 0x476600
inc esi
push edi
mov dword [ebp - 0x221c], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41b69b
test esi, esi
je 0x41b767
push edi
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x41b769
push 0x5c
push edi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
call fcn.0041db9e
pop ecx
pop ecx
test eax, eax
jne 0x41bb78
push edi
mov ecx, ebx
call fcn.0041428c
test eax, eax
je 0x41b71e
mov eax, dword [ebp - 0x2220]
push edi
lea ecx, [ebp - 0x2238]
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
call fcn.0041b221
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
cmp dword [ebp - 0x221c], esi
je 0x41b75a
push edi
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb70
push edi
mov ecx, ebx
call fcn.0041d9e3
lea ecx, [ebp - 0x2238]
mov esi, eax
call fcn.004013a0
test esi, esi
js 0x41bb88
jmp 0x41bb2c
lea ecx, [ebp - 0x2238]
call fcn.004013a0
jmp 0x41b769
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41b791
push edi
mov ecx, ebx
mov dword [ebp - 0x223c], esi
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
push 0x4765f8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41b8bd
lea eax, [ebp - 0x2218]
push eax
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
push edi
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
push 0x3d
pop eax
cmp word [edi], ax
jne 0x41bb83
cmp dword [ebp + 0x10], 0
je 0x41b843
and dword [ebp - 0x2250], 0
and dword [ebp - 0x224c], 0
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x2254], eax
push edi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2254]
push eax
mov ecx, ebx
call fcn.00413785
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
lea ecx, [ebp - 0x2254]
test esi, esi
js 0x41bbc0
mov byte [ebp - 4], al
jmp 0x41bb27
cmp dword [ebp + 0x14], 0
jne 0x41b8b0
cmp dword [ebp - 0x223c], 0
je 0x41b8b0
xor eax, eax
push 0x20006
push eax
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2260]
mov dword [ebp - 0x2260], eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
call fcn.004013d0
test eax, eax
jne 0x41bbb1
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2260]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x41b8a5
cmp eax, 2
jne 0x41bbb1
lea ecx, [ebp - 0x2260]
call fcn.004013a0
push edi
mov ecx, ebx
call fcn.0041d9e3
jmp 0x41b64d
push 0x5c
push edi
call fcn.0041db9e
pop ecx
pop ecx
test eax, eax
jne 0x41bb83
cmp dword [ebp + 0x10], eax
je 0x41b960
mov esi, dword [ebp - 0x2220]
push 0x2001f
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.004013d0
test eax, eax
je 0x41b92a
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.004013d0
test eax, eax
je 0x41b92a
xor eax, eax
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.0040b52d
test eax, eax
jne 0x41ba42
push edi
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
push 0x3d
pop eax
cmp word [edi], ax
jne 0x41bb2c
push edi
push 0
lea eax, [ebp - 0x222c]
push eax
mov ecx, ebx
call fcn.00413785
mov esi, eax
jmp 0x41b74d
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x41b980
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
call fcn.004013d0
jmp 0x41b983
push 2
pop eax
push 1
test eax, eax
mov dword [ebp - 0x221c], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.0044091c
push eax
call fcn.00413e49
add esp, 0x14
mov ecx, ebx
push edi
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
push edi
mov ecx, ebx
call fcn.0041d9e3
mov esi, eax
test esi, esi
js 0x41bb88
push 0x7b
pop eax
cmp word [edi], ax
jne 0x41ba1e
push edi
call fcn.0043f784
pop ecx
cmp eax, 1
jne 0x41ba1e
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x222c]
push edi
call fcn.0041b5e5
mov esi, eax
test esi, esi
jns 0x41ba0c
cmp dword [ebp + 0x14], 0
je 0x41bb88
push edi
mov ecx, ebx
call fcn.004184c6
mov esi, eax
test esi, esi
js 0x41bb88
mov eax, dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2264]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x41b657
test eax, eax
je 0x41ba50
test ecx, ecx
jne 0x41b657
push eax
call fcn.00413eb9
pop ecx
mov esi, eax
jmp 0x41bb88
test ecx, ecx
je 0x41ba9f
push dword [ebp - 0x222c]
mov ecx, ebx
call fcn.00416b05
test eax, eax
je 0x41ba9f
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.0041428c
test eax, eax
je 0x41b657
cmp dword [ebp - 0x223c], 0
je 0x41b657
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x222c]
call fcn.0041b221
jmp 0x41b657
push dword [ebp - 0x222c]
mov ecx, ebx
call fcn.00416b05
lea ecx, [ebp - 0x222c]
mov dword [ebp - 0x221c], eax
call fcn.004013a0
test eax, eax
jne 0x41ba42
cmp dword [ebp - 0x223c], eax
je 0x41b657
cmp dword [ebp - 0x221c], eax
jne 0x41b657
mov eax, dword [ebp - 0x2220]
and dword [ebp - 0x2244], 0
and dword [ebp - 0x2240], 0
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2248]
call fcn.00414f34
xor ecx, ecx
mov dword [ebp - 0x2248], ecx
mov dword [ebp - 0x2244], ecx
mov dword [ebp - 0x2240], ecx
test eax, eax
jne 0x41bbc7
lea ecx, [ebp - 0x2248]
call fcn.004013a0
cmp dword [ebp + 0x10], 0
je 0x41b657
push 0x7b
pop eax
cmp word [edi], ax
jne 0x41b657
push edi
call fcn.0043f784
pop ecx
cmp eax, 1
jne 0x41b657
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x222c]
push edi
call fcn.0041b5e5
mov esi, eax
test esi, esi
js 0x41bb88
jmp 0x41b645
lea ecx, [ebp - 0x2238]
jmp 0x41bbc0
lea ecx, [ebp - 0x2238]
call fcn.004013a0
mov esi, 0x80020009
lea ecx, [ebp - 0x222c]
call fcn.004013a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e699
leave
ret 0x10
push eax
call fcn.00413eb9
pop ecx
lea ecx, [ebp - 0x2260]
mov esi, eax
call fcn.004013a0
jmp 0x41bb88
push eax
call fcn.00413eb9
pop ecx
lea ecx, [ebp - 0x2248]
jmp 0x41bbbe