Function at 0x4057e0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x224c
call fcn.0041d790
mov eax, dword [0x451b84]
xor eax, esp
mov dword [esp + 0x2248], eax
mov eax, dword [esp + 0x2254]
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x2268]
push edi
mov edi, dword [esp + 0x2260]
xor ebx, ebx
mov dword [esp + 0x40], ecx
push edi
mov ecx, ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.00403140
mov esi, eax
cmp esi, ebx
jl 0x405e39
cmp word [edi], 0x7d
je 0x405e37
jmp 0x405854
mov ebp, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x30], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x405885
test ebx, ebx
je 0x405997
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
xor esi, esi
cmp dword [esp + 0x2268], esi
je 0x405999
movzx ecx, word [edi]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov eax, edi
cmp cx, si
je 0x4058df
movzx ecx, cx
jmp 0x4058c0
cmp cx, 0x5c
je 0x4058d7
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, si
jne 0x4058c0
jmp 0x4058df
cmp eax, esi
jne 0x405dad
push edi
mov ecx, ebp
call fcn.004032b0
test eax, eax
je 0x405909
mov edx, dword [esp + 0x1c]
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
call fcn.00403710
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
cmp ebx, esi
je 0x405991
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405dc6
push edi
mov ecx, ebp
call fcn.00403340
mov esi, eax
test esi, esi
jl 0x405dc6
mov dword [esp + 0x24], 0
cmp word [edi], 0x7b
jne 0x405982
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x405982
mov ecx, dword [esp + 0x2268]
mov edx, dword [esp + 0x10]
push 0
push ecx
push edx
push edi
mov ecx, ebp
call fcn.004057e0
mov esi, eax
test esi, esi
jl 0x405e28
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
cmp word [edi], 0x7d
jne 0x405850
jmp 0x405e28
mov dword [esp + 0x24], esi
jmp 0x405999
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4059c1
push edi
mov ecx, ebp
mov dword [esp + 0x2c], eax
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
xor esi, esi
push 0x4465e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405ac8
lea eax, [esp + 0x258]
push eax
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
cmp word [edi], 0x3d
jne 0x405db6
xor ebx, ebx
cmp dword [esp + 0x2268], ebx
je 0x405a51
mov ecx, dword [esp + 0x1c]
push edi
lea edx, [esp + 0x25c]
push edx
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ecx
push eax
mov ecx, ebp
mov dword [esp + 0x44], ebx
call fcn.004054f0
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
jl 0x405dcc
mov dword [esp + 0x38], ebx
jmp 0x40593d
cmp dword [esp + 0x226c], ebx
jne 0x405ab7
cmp dword [esp + 0x28], ebx
je 0x405ab7
mov ecx, dword [esp + 0x1c]
push 0x20006
push ebx
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00402be0
cmp eax, ebx
jne 0x405de0
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x258]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x405aa4
cmp eax, 2
jne 0x405de0
cmp esi, ebx
je 0x405ab3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
push edi
mov ecx, ebp
call fcn.00403340
mov esi, eax
cmp esi, ebx
jmp 0x40597c
movzx ecx, word [edi]
mov eax, edi
cmp cx, si
je 0x405af4
movzx ecx, cx
cmp cx, 0x5c
je 0x405aec
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, si
jne 0x405ad5
jmp 0x405af4
cmp eax, esi
jne 0x405db6
cmp dword [esp + 0x2268], esi
je 0x405be9
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push 0x2001f
push esi
push edi
push ecx
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x405b41
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, esi
je 0x405b31
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
cmp eax, esi
je 0x405baf
mov eax, dword [esp + 0x1c]
push 0x20019
push edi
push eax
lea ecx, [esp + 0x1c]
call fcn.00402be0
test eax, eax
je 0x405baf
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x4c]
push ecx
xor ebx, ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push eax
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x405dec
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x405b99
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov esi, eax
mov dword [esp + 0x10], ecx
cmp eax, ebx
jne 0x405dec
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
cmp word [edi], 0x3d
jne 0x40593d
push edi
push 0
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
call fcn.004054f0
mov esi, eax
test esi, esi
jl 0x405e28
jmp 0x40593d
cmp dword [esp + 0x226c], esi
jne 0x405cdb
mov eax, dword [esp + 0x1c]
push 0x20019
push edi
push eax
lea ecx, [esp + 0x1c]
call fcn.00402be0
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp ebx, esi
je 0x405c1f
mov dword [esp + 0x226c], 1
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x58]
push 0x104
push ecx
call fcn.0041d6a1
push eax
call fcn.00401050
add esp, 0x14
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
push edi
mov ecx, ebp
call fcn.00403340
mov esi, eax
test esi, esi
jl 0x405e28
cmp word [edi], 0x7b
jne 0x405cab
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x405cab
mov ebx, dword [esp + 0x226c]
mov edx, dword [esp + 0x10]
push ebx
push 0
push edx
push edi
mov ecx, ebp
call fcn.004057e0
mov esi, eax
test esi, esi
jge 0x405c95
test ebx, ebx
je 0x405e28
push edi
mov ecx, ebp
call fcn.00403140
mov esi, eax
test esi, esi
jl 0x405e28
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x226c], eax
cmp ebx, 2
je 0x405982
test ebx, ebx
je 0x405cec
test eax, eax
jne 0x405982
push ebx
call fcn.00402970
add esp, 4
mov esi, eax
jmp 0x405e28
mov dword [esp + 0x18], 2
mov ebx, dword [esp + 0x18]
jmp 0x405c14
test eax, eax
je 0x405d32
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebp
call fcn.004032f0
test eax, eax
je 0x405d32
lea ecx, [esp + 0x50]
push ecx
mov ecx, ebp
call fcn.004032b0
test eax, eax
je 0x405982
cmp dword [esp + 0x28], 0
je 0x405982
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x14]
call fcn.00403710
jmp 0x405982
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
push eax
call fcn.004032f0
xor ebx, ebx
mov ebp, eax
cmp dword [esp + 0x10], ebx
je 0x405d5f
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
test ebx, ebx
jne 0x405e00
cmp dword [esp + 0x28], ebx
je 0x405982
test ebp, ebp
jne 0x405982
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x50]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
cmp eax, ecx
jne 0x405e14
lea ecx, [esp + 0x44]
call fcn.004036f0
jmp 0x405982
lea ecx, [esp + 0x20]
call fcn.004036f0
lea ecx, [esp + 0x10]
call fcn.004036f0
mov eax, 0x80020009
jmp 0x405e39
lea ecx, [esp + 0x20]
jmp 0x405e23
lea ecx, [esp + 0x34]
call fcn.004036f0
lea ecx, [esp + 0x10]
call fcn.004036f0
jmp 0x405e37
push eax
call fcn.00402970
lea ecx, [esp + 0x30]
jmp 0x405e1e
lea ecx, [esp + 0x10]
call fcn.004036f0
push esi
call fcn.00402970
add esp, 4
jmp 0x405e39
lea ecx, [esp + 0x10]
call fcn.004036f0
push ebx
call fcn.00402970
add esp, 4
jmp 0x405e39
push eax
call fcn.00402970
lea ecx, [esp + 0x48]
add esp, 4
mov esi, eax
call fcn.004036f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405e37
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x2258]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041d774
add esp, 0x224c
ret 0x10