Function at 0x409320
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x428b56
mov eax, dword fs:[0]
push eax
mov eax, 0x114c
call fcn.0041fd20
mov eax, dword [0x4362ac]
xor eax, esp
mov dword [esp + 0x1148], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4362ac]
xor eax, esp
push eax
lea eax, [esp + 0x1160]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1174]
mov ebp, dword [esp + 0x1170]
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x117c]
mov eax, ebp
mov dword [esp + 0x1168], ebx
mov dword [esp + 0x3c], edx
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099b2
cmp byte [ebp], 0x7d
je 0x4099b0
lea esp, [esp]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push ebp
mov dword [esp + 0x38], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebp
inc esi
call edi
test eax, eax
je 0x4093e1
cmp esi, ebx
je 0x409507
mov ecx, dword [esp + 0x20]
mov eax, ebp
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
cmp dword [esp + 0x1178], ebx
je 0x409507
mov cl, byte [ebp]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov eax, ebp
cmp cl, bl
je 0x409438
mov edi, dword [sym.imp.USER32.dll_CharNextA]
lea ebx, [ebx]
cmp cl, 0x5c
je 0x409430
push eax
call edi
mov cl, byte [eax]
cmp cl, bl
jne 0x409420
jmp 0x409438
cmp eax, ebx
jne 0x40992d
mov edi, 0x430030
lea ecx, [ecx]
mov eax, dword [edi]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x409477
add edi, 4
cmp edi, 0x430060
jl 0x409440
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ebx
call fcn.00409040
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp esi, ebx
je 0x409503
mov esi, dword [esp + 0x20]
mov eax, ebp
mov ecx, esi
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x409946
mov edi, ebp
mov ecx, esi
call fcn.00408f90
mov edi, eax
cmp edi, ebx
jl 0x409946
mov dword [esp + 0x2c], ebx
cmp byte [ebp], 0x7b
jne 0x4098bb
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x4098bb
mov eax, dword [esp + 0x1178]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
push ebx
push eax
push ecx
push ebp
mov ecx, esi
call fcn.00409320
mov edi, eax
cmp edi, ebx
jl 0x4099a1
mov eax, ebp
mov ecx, esi
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
jmp 0x4098bb
mov dword [esp + 0x2c], ebx
push str.NoRemove
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409530
mov ecx, dword [esp + 0x20]
mov eax, ebp
mov dword [esp + 0x30], ebx
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
mov esi, dword [esp + 0x20]
push 0x42ca34
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40965f
lea eax, [esp + 0x15c]
mov ecx, esi
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
mov eax, ebp
mov ecx, esi
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
cmp byte [ebp], 0x3d
jne 0x409936
cmp dword [esp + 0x1178], ebx
je 0x4095d2
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x15c]
mov byte [esp + 0x1168], 1
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], edx
push ecx
mov ecx, ebp
mov edx, esi
mov dword [esp + 0x4c], ebx
call fcn.00408ae0
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
jl 0x40994c
mov byte [esp + 0x1168], bl
mov dword [esp + 0x44], ebx
jmp 0x4094ad
cmp dword [esp + 0x117c], ebx
jne 0x409647
cmp dword [esp + 0x30], ebx
je 0x409647
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x14]
push edx
push 0x20006
push ebx
push ebx
push eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x409960
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x15c]
push ecx
push edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x409634
cmp eax, 2
jne 0x409960
cmp edi, ebx
je 0x409643
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov edi, ebp
mov ecx, esi
call fcn.00408f90
mov edi, eax
cmp edi, ebx
jl 0x4099a1
jmp 0x4098bb
mov cl, byte [ebp]
mov eax, ebp
cmp cl, bl
je 0x409688
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov edi, edi
cmp cl, 0x5c
je 0x409680
push eax
call edi
mov cl, byte [eax]
cmp cl, bl
jne 0x409670
jmp 0x409688
cmp eax, ebx
jne 0x409936
cmp dword [esp + 0x1178], ebx
je 0x409766
mov esi, dword [esp + 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebx
push ebp
push esi
mov dword [esp + 0x28], ebx
call edi
cmp eax, ebx
jne 0x4096d7
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x4096c7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
cmp eax, ebx
je 0x409727
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push ebp
push esi
mov dword [esp + 0x28], ebx
call edi
cmp eax, ebx
jne 0x40970f
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x4096ff
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
cmp eax, ebx
je 0x409727
mov edx, esi
push edx
mov edx, ebp
lea esi, [esp + 0x1c]
call fcn.00408740
mov edi, eax
cmp edi, ebx
jne 0x40996b
mov ecx, dword [esp + 0x20]
mov eax, ebp
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
cmp byte [ebp], 0x3d
jne 0x4094ad
mov edx, dword [esp + 0x20]
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call fcn.00408ae0
mov edi, eax
cmp edi, ebx
jl 0x4099a1
jmp 0x4094ad
cmp dword [esp + 0x117c], ebx
jne 0x409879
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push ebp
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4097af
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x4097a3
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x4097c2
mov dword [esp + 0x117c], 1
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x5c]
push 0x104
push edx
call fcn.0041786d
push eax
call fcn.00404e60
add esp, 0x14
mov eax, ebp
mov ecx, esi
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
mov edi, ebp
mov ecx, esi
call fcn.00408f90
mov edi, eax
cmp edi, ebx
jl 0x4099a1
cmp byte [ebp], 0x7b
jne 0x409851
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x409851
mov eax, dword [esp + 0x117c]
mov ecx, dword [esp + 0x18]
push eax
push ebx
push ecx
push ebp
mov ecx, esi
call fcn.00409320
mov edi, eax
cmp edi, ebx
jge 0x40983e
cmp dword [esp + 0x117c], ebx
je 0x4099a1
mov eax, ebp
mov ecx, esi
call fcn.00409200
mov edi, eax
cmp edi, ebx
jl 0x4099a1
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x117c], edx
cmp eax, 2
je 0x4098bb
cmp eax, ebx
je 0x409886
cmp edx, ebx
jne 0x4098bb
call fcn.004091f0
mov edi, eax
jmp 0x4099a1
mov dword [esp + 0x14], 2
jmp 0x4097b7
mov esi, dword [esp + 0x18]
cmp edx, ebx
je 0x4098ca
mov ecx, esi
call fcn.00409190
test eax, eax
je 0x4098ca
lea ebx, [esp + 0x54]
call fcn.00409000
test eax, eax
je 0x4098b9
cmp dword [esp + 0x30], 0
je 0x4098b9
mov eax, ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.00409040
xor ebx, ebx
cmp byte [ebp], 0x7d
jne 0x4093b0
jmp 0x4099a1
mov ecx, esi
call fcn.00409190
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x14], eax
cmp esi, ebx
je 0x4098ee
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x40997d
cmp dword [esp + 0x30], ebx
je 0x4098bb
cmp dword [esp + 0x50], ebx
jne 0x4098bb
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
cmp eax, ebx
jne 0x409991
lea esi, [esp + 0x48]
call fcn.004091d0
jmp 0x4098bb
lea esi, [esp + 0x28]
call fcn.004091d0
lea esi, [esp + 0x18]
call fcn.004091d0
mov eax, 0x80020009
jmp 0x4099b2
lea esi, [esp + 0x28]
jmp 0x40999c
lea esi, [esp + 0x40]
call fcn.004091d0
lea esi, [esp + 0x18]
call fcn.004091d0
jmp 0x4099b0
call fcn.004091f0
lea esi, [esp + 0x34]
jmp 0x40999a
lea esi, [esp + 0x18]
call fcn.004091d0
mov eax, edi
call fcn.004091f0
jmp 0x4099b2
lea esi, [esp + 0x18]
call fcn.004091d0
mov eax, dword [esp + 0x14]
call fcn.004091f0
jmp 0x4099b2
call fcn.004091f0
lea esi, [esp + 0x48]
mov edi, eax
call fcn.004091d0
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4099b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x1160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1148]
xor ecx, esp
call fcn.00416933
add esp, 0x1158
ret 0x10