Function at 0x465100
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1154
call fcn.004abe10
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x114c], eax
mov eax, dword [esp + 0x115c]
push ebx
mov ebx, dword [esp + 0x115c]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1170]
push edi
mov dword [esp + 0x24], eax
xor edi, edi
push ebx
mov eax, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x50], ecx
call fcn.00464670
mov ebp, eax
cmp ebp, edi
jl 0x465758
cmp byte [ebx], 0x7d
je 0x465756
jmp 0x465174
mov esi, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push ebx
mov dword [esp + 0x28], 1
call ebp
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call ebp
test eax, eax
je 0x4651a5
test edi, edi
je 0x4652b9
push ebx
mov eax, esi
call fcn.00464670
mov ebp, eax
test ebp, ebp
jl 0x465747
xor ebp, ebp
cmp dword [esp + 0x1170], ebp
je 0x4652b5
mov cl, byte [ebx]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov eax, ebx
test cl, cl
je 0x4651f8
mov esi, dword [sym.imp.USER32.dll_CharNextA]
lea esp, [esp]
cmp cl, 0x5c
je 0x4651f0
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x4651e0
jmp 0x4651f8
cmp eax, ebp
jne 0x4656e7
push ebx
call fcn.00464c00
test eax, eax
je 0x465220
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], ebp
call fcn.004636c0
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov esi, dword [esp + 0x14]
cmp edi, ebp
je 0x4652af
push ebx
mov eax, esi
call fcn.00464670
mov ebp, eax
test ebp, ebp
jl 0x465700
mov edi, ebx
mov ecx, esi
call fcn.00464c80
mov ebp, eax
test ebp, ebp
jl 0x465700
mov dword [esp + 0x2c], 0
cmp byte [ebx], 0x7b
jne 0x4652a1
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x4652a1
mov edx, dword [esp + 0x1170]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push edx
push eax
push ebx
call fcn.00465100
mov ebp, eax
test ebp, ebp
jl 0x465747
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464670
mov ebp, eax
test ebp, ebp
jl 0x465747
cmp byte [ebx], 0x7d
jne 0x465170
jmp 0x465747
mov dword [esp + 0x2c], ebp
jmp 0x4652b9
mov esi, dword [esp + 0x14]
push str.NoRemove
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4652e5
push ebx
mov eax, esi
mov dword [esp + 0x24], edi
call fcn.00464670
mov ebp, eax
cmp ebp, edi
jl 0x465747
mov esi, dword [esp + 0x14]
push 0x4ce2b0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4653f5
lea eax, [esp + 0x158]
push eax
mov eax, esi
call fcn.00464670
mov ebp, eax
cmp ebp, edi
jl 0x465747
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464670
mov ebp, eax
test ebp, ebp
jl 0x465747
cmp byte [ebx], 0x3d
jne 0x4656f0
xor esi, esi
cmp dword [esp + 0x1170], esi
je 0x465377
mov ecx, dword [esp + 0x24]
push ebx
lea edx, [esp + 0x40]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x18]
push edx
lea edx, [esp + 0x160]
mov dword [esp + 0x48], esi
call fcn.004647b0
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
jl 0x465706
mov dword [esp + 0x40], esi
jmp 0x465259
cmp dword [esp + 0x1174], esi
jne 0x4653e1
cmp dword [esp + 0x20], esi
je 0x4653e1
mov edx, dword [esp + 0x24]
xor edi, edi
push 0x20006
xor ecx, ecx
lea esi, [esp + 0x38]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.00463620
cmp eax, edi
jne 0x46571a
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x158]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, edi
je 0x4653cc
cmp eax, 2
jne 0x46571a
cmp esi, edi
je 0x4653db
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
xor esi, esi
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00464c80
mov ebp, eax
cmp ebp, esi
jmp 0x46529b
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x46541c
lea ecx, [ecx]
cmp cl, 0x5c
je 0x465414
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x465400
jmp 0x46541c
cmp eax, edi
jne 0x4656f0
cmp dword [esp + 0x1170], edi
je 0x465502
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0x2001f
push edi
push ebx
push edx
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x46546b
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
je 0x465459
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x4654c5
xor edi, edi
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4654ab
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
je 0x46549b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x4654c5
mov edx, dword [esp + 0x24]
push edx
mov edx, ebx
lea esi, [esp + 0x1c]
call fcn.004635c0
mov edi, eax
test edi, edi
jne 0x465725
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464670
mov ebp, eax
test ebp, ebp
jl 0x465747
cmp byte [ebx], 0x3d
jne 0x465259
mov ecx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x1c]
push eax
xor edx, edx
call fcn.004647b0
mov ebp, eax
test ebp, ebp
jl 0x465747
jmp 0x465259
cmp dword [esp + 0x1174], edi
jne 0x46561e
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x30]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [esp + 0x44], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x46554b
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
je 0x46553f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], eax
cmp eax, edi
je 0x46555e
mov dword [esp + 0x1174], 1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x58]
push 0x104
push edx
call fcn.004a0809
push eax
call fcn.00462f70
add esp, 0x14
push ebx
mov eax, esi
call fcn.00464670
mov ebp, eax
cmp ebp, edi
jl 0x465747
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00464c80
mov ebp, eax
test ebp, ebp
jl 0x465747
cmp byte [ebx], 0x7b
jne 0x4655ec
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x4655ec
mov edi, dword [esp + 0x1174]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edi
push 0
push eax
push ebx
call fcn.00465100
mov ebp, eax
test ebp, ebp
jge 0x4655d8
test edi, edi
je 0x465747
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464670
mov ebp, eax
test ebp, ebp
jl 0x465747
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1174], eax
cmp ecx, 2
je 0x4652a1
test ecx, ecx
je 0x46562b
test eax, eax
jne 0x4652a1
mov eax, ecx
call fcn.00463050
mov ebp, eax
jmp 0x465747
mov dword [esp + 0x30], 2
jmp 0x465553
test eax, eax
je 0x46566c
mov ecx, dword [esp + 0x18]
call fcn.00464c40
test eax, eax
je 0x46566c
lea ecx, [esp + 0x50]
push ecx
call fcn.00464c00
test eax, eax
je 0x4652a1
cmp dword [esp + 0x20], 0
je 0x4652a1
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x1c]
call fcn.004636c0
jmp 0x4652a1
mov ecx, dword [esp + 0x18]
call fcn.00464c40
xor edi, edi
mov esi, eax
cmp dword [esp + 0x18], edi
je 0x465694
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
test edi, edi
jne 0x465725
cmp dword [esp + 0x20], edi
je 0x4652a1
test esi, esi
jne 0x4652a1
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x48], esi
lea edi, [esp + 0x50]
lea esi, [esp + 0x44]
mov dword [esp + 0x44], ecx
call fcn.00463560
xor ecx, ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
cmp eax, ecx
jne 0x465737
call fcn.00463540
jmp 0x4652a1
lea esi, [esp + 0x28]
call fcn.00463540
lea esi, [esp + 0x18]
call fcn.00463540
mov eax, 0x80020009
jmp 0x465758
lea esi, [esp + 0x28]
jmp 0x465742
lea esi, [esp + 0x3c]
call fcn.00463540
lea esi, [esp + 0x18]
call fcn.00463540
jmp 0x465756
call fcn.00463050
lea esi, [esp + 0x34]
jmp 0x465740
lea esi, [esp + 0x18]
call fcn.00463540
mov eax, edi
call fcn.00463050
jmp 0x465758
call fcn.00463050
lea esi, [esp + 0x44]
mov ebp, eax
call fcn.00463540
mov eax, dword [esp + 0x18]
test eax, eax
je 0x465756
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x115c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1154
ret 0x10