Function at 0x413f5a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.0049af20
mov edi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.0049dcc0
add esp, 0xc
mov ecx, edi
push ebx
call fcn.00413df2
mov esi, eax
test eax, eax
js 0x414895
mov dword [ebp - 0x2234], edi
cmp word [ebx], 0x7d
je 0x414895
push str.Delete
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call esi
mov edi, eax
push 0x4d3298
push ebx
call esi
test eax, eax
je 0x413fec
test edi, edi
jne 0x414125
mov ecx, dword [ebp - 0x2234]
push ebx
call fcn.00413df2
mov esi, eax
test eax, eax
js 0x414895
cmp dword [ebp + 0x10], 0
je 0x414125
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test ebx, ebx
je 0x41405b
movzx ecx, word [ebx]
test cx, cx
je 0x41405b
mov eax, ebx
cmp cx, 0x5c
je 0x414045
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x41402e
jmp 0x41405b
test eax, eax
je 0x41405b
mov dword [ebp - 0x2238], 0x80020009
xor ebx, ebx
inc ebx
jmp 0x414103
mov dword [ebp - 0x223c], edi
xor edi, edi
xor ebx, ebx
push dword [ebx*4 + 0x4d33a0]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41408b
cmp ebx, 0xb
lea eax, [ebx + 1]
setae cl
mov edi, ecx
mov ebx, eax
cmp eax, 0xc
jne 0x414065
mov eax, edi
test al, 1
je 0x4140c8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor ebx, ebx
mov dword [ebp - 0x2214], ebx
mov dword [ebp - 0x2210], ebx
lea ecx, [ebp - 0x2218]
push dword [ebp + 8]
call fcn.00414a68
mov dword [ebp - 0x2218], ebx
mov dword [ebp - 0x2214], ebx
mov dword [ebp - 0x2210], ebx
xor ebx, ebx
cmp dword [ebp - 0x223c], 0
jne 0x414103
mov edi, dword [ebp - 0x2234]
mov ecx, edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.00413df2
test eax, eax
js 0x4140fc
mov ecx, edi
push ebx
call fcn.00414ba6
mov esi, eax
mov ebx, eax
sar ebx, 0x1f
add ebx, 4
jmp 0x414103
mov esi, eax
mov ebx, 3
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x414114
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 4
je 0x414232
test ebx, ebx
jne 0x41459a
push str.NoRemove
mov edi, dword [ebp + 8]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call esi
mov dword [ebp - 0x223c], eax
test eax, eax
mov ebx, dword [ebp - 0x2234]
jne 0x414156
mov ecx, ebx
push edi
call fcn.00413df2
test eax, eax
js 0x414893
push 0x4d3290
push edi
call esi
test eax, eax
je 0x41418e
test edi, edi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x414242
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test cx, cx
je 0x414242
cmp cx, 0x5c
je 0x41423a
push eax
call esi
jmp 0x414173
push 0x2000
push 0xff
lea esi, [ebp - 0x2218]
push esi
call fcn.0049dcc0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.00413df2
test eax, eax
js 0x414585
mov ecx, ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00413df2
mov edi, eax
test eax, eax
js 0x414587
mov esi, 0x80020009
cmp word [ebx], 0x3d
mov ebx, 1
jne 0x414592
cmp dword [ebp + 0x10], 0
je 0x414535
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2234]
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00414c52
mov esi, eax
test eax, eax
jns 0x4144e0
mov edi, esi
xor ebx, ebx
inc ebx
jmp 0x414592
mov edi, dword [ebp + 8]
jmp 0x4144e0
test eax, eax
jne 0x4148bf
cmp dword [ebp + 0x10], 0
je 0x4142b8
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x414345
cmp dword [esi], 0
je 0x41433f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x414363
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414363
mov ecx, eax
mov esi, dword [esi]
call dword [0x4e4884]
xor eax, eax
push eax
push esi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call ecx
jmp 0x41435f
mov edi, 2
mov eax, dword [ebp + 0x14]
test eax, eax
mov ebx, dword [ebp + 8]
jne 0x414612
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x4145c4
cmp dword [esi], 0
je 0x4145b9
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
inc edi
test eax, eax
je 0x41460f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
inc edi
test eax, eax
je 0x41460f
mov ecx, eax
mov esi, dword [esi]
call dword [0x4e4884]
xor eax, eax
push eax
push esi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x4145dc
cmp dword [esi + 4], 0
je 0x414363
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4143d0
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x41440e
cmp dword [esi], 0
je 0x414408
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41442c
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41442c
mov ecx, eax
mov esi, dword [esi]
call dword [0x4e4884]
xor eax, eax
push eax
push esi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call ecx
jmp 0x414428
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x414491
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x414363
jmp 0x4144a7
cmp dword [esi + 4], 0
je 0x41442c
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x414464
sub esp, 0x1c
movaps xmm0, xmmword [0x4d3840]
movups xmmword [esp + 8], xmm0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.004150b6
test eax, eax
je 0x4144a7
jmp 0x41488a
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x414491
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x41442c
jmp 0x4144a7
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov ecx, ebx
mov edi, dword [ebp + 8]
push edi
call fcn.00413df2
mov esi, eax
test eax, eax
js 0x414895
movzx eax, word [edi]
cmp ax, 0x3d
jne 0x4144e9
mov ecx, ebx
push edi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00414c52
mov esi, eax
test eax, eax
js 0x414895
movzx eax, word [edi]
mov ebx, dword [ebp - 0x2234]
cmp ax, 0x7b
jne 0x4145a7
push edi
call fcn.004b8b3c
add esp, 4
cmp eax, 1
jne 0x414531
mov ecx, ebx
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push edi
call fcn.00413f5a
test eax, eax
js 0x414893
mov ecx, ebx
push edi
call fcn.00413df2
mov esi, eax
test eax, eax
mov ebx, edi
jns 0x4145aa
jmp 0x414895
mov ebx, edi
jmp 0x4145aa
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp - 0x2234]
mov ebx, dword [ebp + 8]
jne 0x414860
cmp dword [ebp - 0x223c], 0
je 0x414860
xor eax, eax
mov dword [ebp - 0x2230], eax
lea ecx, [ebp - 0x2230]
push ecx
push 0x20006
push eax
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41481b
push eax
call fcn.004150a1
add esp, 4
mov edi, eax
mov esi, dword [ebp - 0x2238]
mov ebx, 3
mov dword [ebp - 0x2238], esi
mov esi, edi
test ebx, ebx
je 0x4145a7
cmp ebx, 2
jne 0x41487d
mov ebx, dword [ebp + 8]
cmp word [ebx], 0x7d
jne 0x413fc8
jmp 0x414895
cmp dword [esi + 4], 0
mov edi, 1
je 0x41460f
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x41460f
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4145f7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
jmp 0x4145f9
xor edi, edi
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov eax, dword [ebp + 0x14]
test edi, edi
mov esi, 1
cmove esi, eax
push 0xffffffffffffffff
push ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.004b9063
add esp, 0x10
cmp eax, 0x15
mov dword [ebp - 0x2244], edi
mov dword [ebp - 0x2240], esi
jle 0x41464e
cmp eax, 0x50
je 0x414656
jmp 0x4148e7
test eax, eax
jne 0x4148fb
mov ebx, dword [ebp - 0x2234]
mov ecx, ebx
mov edi, dword [ebp + 8]
push edi
call fcn.00413df2
test eax, eax
js 0x414893
mov ecx, ebx
push edi
call fcn.00414ba6
mov esi, eax
test eax, eax
js 0x414895
mov ebx, edi
cmp word [edi], 0x7b
jne 0x4146df
push ebx
call fcn.004b8b3c
add esp, 4
cmp eax, 1
mov edi, dword [ebp - 0x2244]
jne 0x4146e5
mov ecx, dword [ebp - 0x2234]
push dword [ebp - 0x2240]
push 0
push dword [ebp - 0x2224]
push ebx
call fcn.00413f5a
test eax, eax
jns 0x4146c8
cmp dword [ebp - 0x2240], 0
je 0x414893
mov ecx, dword [ebp - 0x2234]
push ebx
call fcn.00413df2
mov esi, eax
test eax, eax
jns 0x4146e5
jmp 0x414895
mov edi, dword [ebp - 0x2244]
cmp edi, 2
je 0x4145aa
test edi, edi
je 0x414701
cmp dword [ebp + 0x14], 0
jne 0x4145aa
jmp 0x4148c6
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp - 0x2234]
je 0x41477d
mov ecx, edi
push dword [ebp - 0x2224]
call fcn.004151ba
test eax, eax
je 0x41477d
xor edi, edi
xor ebx, ebx
push dword [ebx*4 + 0x4d33a0]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41474c
cmp ebx, 0xb
lea eax, [ebx + 1]
setae cl
mov edi, ecx
mov ebx, eax
cmp eax, 0xc
jne 0x414722
cmp dword [ebp - 0x223c], 0
je 0x4145a7
mov eax, edi
test al, 1
mov ebx, dword [ebp + 8]
je 0x4145aa
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.00414a68
jmp 0x4145aa
mov ecx, edi
push dword [ebp - 0x2224]
call fcn.004151ba
mov edi, eax
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4147b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], ecx
test eax, eax
je 0x4147be
jmp 0x41488a
mov dword [ebp - 0x2220], 0
cmp dword [ebp - 0x223c], 0
je 0x4145aa
test edi, edi
jne 0x4145aa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor edi, edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
lea ecx, [ebp - 0x2218]
lea eax, [ebp - 0x218]
push eax
call fcn.0041522c
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
test eax, eax
je 0x4145aa
jmp 0x4148c9
mov esi, dword [ebp - 0x2230]
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
je 0x414855
push eax
call fcn.004150a1
add esp, 4
mov edi, eax
test esi, esi
je 0x414587
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414587
test esi, esi
je 0x414860
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
push ebx
call fcn.00414ba6
mov edi, eax
mov ebx, eax
shr ebx, 0x1f
or ebx, 2
mov esi, dword [ebp - 0x2238]
jmp 0x414592
cmp ebx, 3
je 0x414895
mov esi, dword [ebp - 0x2238]
jmp 0x414895
push eax
call fcn.004150a1
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4148a6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, 0x80020009
jmp 0x414895
push edi
jmp 0x41488b
push eax
call fcn.004150a1
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x414895
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414895
cmp eax, 0x16
je 0x4148f1
cmp eax, 0x22
jne 0x41490a
push 0x80070057
call fcn.004451b0
cmp eax, 0xc
jne 0x41490a
push 0x8007000e
call fcn.004451b0
push 0x80004005
call fcn.004451b0