Function at 0x41b042
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x521cfe
call fcn.0051f0b4
mov eax, 0x2240
call fcn.004eff30
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, ebx
call fcn.0041af2c
mov esi, eax
cmp esi, edi
jl 0x41b464
cmp word [ebx], 0x7d
je 0x41b462
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x53fdb0
push ebx
mov dword [ebp - 0x28], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x41b0bb
test edi, edi
je 0x41b199
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x41b19b
push 0x5c
mov eax, ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call fcn.0041a8b2
pop ecx
test eax, eax
jne 0x41b50f
push ebx
call fcn.0041ad7f
test eax, eax
je 0x41b114
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
call fcn.0041adde
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
cmp edi, esi
je 0x41b194
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.0041ad36
mov esi, eax
test esi, esi
jl 0x41b453
and dword [ebp - 0x2c], 0
cmp word [ebx], 0x7b
jne 0x41b185
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x41b185
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push ebx
call fcn.0041b042
mov esi, eax
test esi, esi
jl 0x41b453
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
cmp word [ebx], 0x7d
jne 0x41b08b
jmp 0x41b453
mov dword [ebp - 0x2c], esi
jmp 0x41b19b
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41b1c4
and dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
xor esi, esi
push 0x53fdec
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41b2bb
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x224c]
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
cmp word [ebx], 0x3d
jne 0x41b527
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x41b252
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], eax
push ebx
lea eax, [ebp - 0x224c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x38], edi
call fcn.0041a9f9
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
jl 0x41b56e
mov byte [ebp - 4], 0
mov dword [ebp - 0x38], edi
jmp 0x41b144
cmp dword [ebp + 0x14], edi
jne 0x41b2ac
cmp dword [ebp - 0x28], edi
je 0x41b2ac
push 0x20006
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call fcn.0041adab
cmp eax, edi
jne 0x41b52d
lea eax, [ebp - 0x224c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x41b298
cmp eax, 2
jne 0x41b52d
cmp dword [ebp - 0x24], edi
je 0x41b2a9
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.0041ad36
jmp 0x41b17b
push 0x5c
mov eax, ebx
call fcn.0041a8b2
pop ecx
test eax, eax
jne 0x41b50f
cmp dword [ebp + 0x10], esi
je 0x41b380
mov edi, 0x2001f
push edi
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
call fcn.0041adab
test eax, eax
je 0x41b344
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
call fcn.0041adab
test eax, eax
je 0x41b344
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 8]
push eax
push esi
push edi
push esi
push esi
push esi
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x41b54b
xor eax, eax
cmp dword [ebp - 0x1c], esi
je 0x41b333
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
cmp eax, esi
jne 0x41b54b
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
cmp word [ebx], 0x3d
jne 0x41b144
push ebx
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
call fcn.0041a9f9
mov esi, eax
test esi, esi
jl 0x41b453
jmp 0x41b144
cmp dword [ebp + 0x14], esi
jne 0x41b39b
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
call fcn.0041adab
mov dword [ebp + 8], eax
jmp 0x41b3a2
mov dword [ebp + 8], 2
cmp dword [ebp + 8], esi
je 0x41b3ae
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x24c]
push 0x104
push eax
call fcn.004ead58
push eax
call fcn.00401b8a
mov ecx, dword [ebp - 0x14]
add esp, 0x14
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.0041ad36
mov esi, eax
test esi, esi
jl 0x41b453
cmp word [ebx], 0x7b
jne 0x41b42a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x41b42a
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp - 0x1c]
push ebx
call fcn.0041b042
mov esi, eax
test esi, esi
jge 0x41b41a
cmp dword [ebp + 0x14], 0
je 0x41b453
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041af2c
mov esi, eax
test esi, esi
jl 0x41b453
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x14], eax
je 0x41b185
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
je 0x41b475
cmp dword [ebp - 0x34], edi
jne 0x41b185
call fcn.0041aefd
mov esi, eax
cmp dword [ebp - 0x1c], 0
je 0x41b462
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
cmp dword [ebp - 0x34], edi
je 0x41b4b7
push dword [ebp - 0x1c]
call fcn.0041aeac
test eax, eax
je 0x41b4b7
lea eax, [ebp - 0x24c]
push eax
call fcn.0041ad7f
test eax, eax
je 0x41b185
cmp dword [ebp - 0x28], edi
je 0x41b185
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041adde
jmp 0x41b185
push dword [ebp - 0x1c]
call fcn.0041aeac
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp - 0x1c], edi
je 0x41b4d5
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
cmp eax, edi
jne 0x41b567
cmp dword [ebp - 0x28], edi
je 0x41b185
cmp dword [ebp + 8], edi
jne 0x41b185
lea eax, [ebp - 0x24c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x41b44c
jmp 0x41b185
cmp dword [ebp - 0x1c], esi
je 0x41b51d
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x41b464
cmp dword [ebp - 0x1c], 0
jmp 0x41b512
call fcn.0041aefd
mov esi, eax
cmp dword [ebp - 0x24], edi
je 0x41b453
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41b453
call fcn.0041aefd
mov edi, eax
cmp dword [ebp - 0x1c], esi
je 0x41b560
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x41b464
call fcn.0041aefd
mov esi, eax
cmp dword [ebp - 0x1c], edi
jmp 0x41b457