Function at 0x407643
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2244
call fcn.0042f110
mov eax, dword [ebp + 0x14]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x24], eax
push edi
mov eax, ebx
mov dword [ebp - 4], ecx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x407a07
cmp word [ebx], 0x7d
je 0x407a05
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x18], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x4076b2
test esi, esi
je 0x407741
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x407743
push 0x5c
mov eax, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call fcn.00406e70
pop ecx
test eax, eax
jne 0x407b06
push ebx
call fcn.00407327
test eax, eax
je 0x407707
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
call fcn.00407391
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
cmp esi, edi
je 0x40773c
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.004072de
mov edi, eax
test edi, edi
jl 0x4079f6
and dword [ebp - 0x1c], 0
jmp 0x407ab0
mov dword [ebp - 0x1c], edi
jmp 0x407743
xor edi, edi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40776c
and dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
xor edi, edi
push 0x4343b0
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40785f
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x2240]
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
cmp word [ebx], 0x3d
jne 0x407b1e
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4077f2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 0x2240]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x28], esi
call fcn.00406f70
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
jl 0x407b65
mov dword [ebp - 0x28], esi
jmp 0x407ab0
cmp dword [ebp + 0x14], esi
jne 0x40784c
cmp dword [ebp - 0x18], esi
je 0x40784c
push esi
push dword [ebp + 0xc]
mov eax, 0x20006
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00407353
cmp eax, esi
jne 0x407b24
lea eax, [ebp - 0x2240]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x407838
cmp eax, 2
jne 0x407b24
cmp dword [ebp - 0x14], esi
je 0x407849
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.004072de
mov edi, eax
cmp edi, esi
jmp 0x407af1
push 0x5c
mov eax, ebx
call fcn.00406e70
pop ecx
test eax, eax
jne 0x407b06
cmp dword [ebp + 0x10], edi
je 0x407923
push ebx
push dword [ebp + 0xc]
mov esi, 0x2001f
mov eax, esi
lea ecx, [ebp - 0xc]
call fcn.00407353
test eax, eax
je 0x4078e7
push ebx
push dword [ebp + 0xc]
lea eax, [esi - 6]
lea ecx, [ebp - 0xc]
call fcn.00407353
test eax, eax
je 0x4078e7
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push edi
push edi
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x407b42
xor eax, eax
cmp dword [ebp - 0xc], edi
je 0x4078d6
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
cmp eax, edi
jne 0x407b42
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
cmp word [ebx], 0x3d
jne 0x407ab0
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.00406f70
mov edi, eax
test edi, edi
jl 0x4079f6
jmp 0x407ab0
cmp dword [ebp + 0x14], edi
jne 0x40793e
push ebx
push dword [ebp + 0xc]
mov eax, 0x20019
lea ecx, [ebp - 0xc]
call fcn.00407353
mov dword [ebp + 8], eax
jmp 0x407945
mov dword [ebp + 8], 2
cmp dword [ebp + 8], edi
je 0x407951
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x240]
push 0x104
push eax
call fcn.004215a3
push eax
call fcn.004072a9
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.004072de
mov edi, eax
test edi, edi
jl 0x4079f6
cmp word [ebx], 0x7b
jne 0x4079cd
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x4079cd
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 0xc]
push ebx
call fcn.00407643
mov edi, eax
test edi, edi
jge 0x4079bd
cmp dword [ebp + 0x14], 0
je 0x4079f6
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x14], eax
je 0x407af7
xor esi, esi
cmp dword [ebp + 8], esi
je 0x407a0e
cmp eax, esi
jne 0x407af7
mov eax, dword [ebp + 8]
call fcn.004074fe
mov edi, eax
cmp dword [ebp - 0xc], 0
je 0x407a05
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp eax, esi
je 0x407a50
push dword [ebp - 0xc]
call fcn.0040745b
test eax, eax
je 0x407a50
lea eax, [ebp - 0x240]
push eax
call fcn.00407327
test eax, eax
je 0x407af7
cmp dword [ebp - 0x18], 0
je 0x407af7
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0xc]
call fcn.00407391
jmp 0x407af7
push dword [ebp - 0xc]
call fcn.0040745b
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp - 0xc], esi
je 0x407a6e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
cmp eax, esi
jne 0x407b5e
cmp dword [ebp - 0x18], esi
je 0x407af7
cmp dword [ebp + 8], 0
jne 0x407af7
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x240]
push eax
lea esi, [ebp - 0x34]
call fcn.004074a7
and dword [ebp - 0x34], 0
and dword [ebp - 0x30], 0
test eax, eax
jne 0x4079ef
and dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
je 0x407af7
cmp word [ebx], 0x7b
jne 0x407af7
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x407af7
mov ecx, dword [ebp - 4]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push ebx
call fcn.00407643
mov edi, eax
test edi, edi
jl 0x4079f6
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040752d
mov edi, eax
test edi, edi
jl 0x4079f6
cmp word [ebx], 0x7d
jne 0x407682
jmp 0x4079f6
cmp dword [ebp - 0xc], edi
je 0x407b14
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x407a07
cmp dword [ebp - 0xc], 0
jmp 0x407b09
call fcn.004074fe
mov edi, eax
cmp dword [ebp - 0x14], esi
je 0x4079f6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4079f6
call fcn.004074fe
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x407b57
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x407a07
call fcn.004074fe
mov edi, eax
cmp dword [ebp - 0xc], esi
jmp 0x4079fa