Function at 0x406c6c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467158
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.0045ddb0
mov eax, dword [0x484060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x2228], eax
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2244], eax
mov eax, ebx
mov dword [ebp - 4], esi
call fcn.00406b56
mov edi, eax
cmp edi, esi
jl 0x407147
cmp word [ebx], 0x7d
je 0x407145
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x2230], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x406d18
test esi, esi
je 0x406dd2
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x406dd4
push 0x5c
mov eax, ebx
mov dword [ebp - 0x2240], edi
mov dword [ebp - 0x223c], edi
call fcn.004063ed
pop ecx
test eax, eax
jne 0x4072a2
push ebx
call fcn.004068ea
test eax, eax
je 0x406d8c
mov eax, dword [ebp - 0x2228]
push ebx
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], edi
call fcn.00406954
mov dword [ebp - 0x2240], edi
mov dword [ebp - 0x223c], edi
cmp esi, edi
je 0x406dca
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.00406885
mov edi, eax
test edi, edi
jl 0x407130
and dword [ebp - 0x223c], 0
jmp 0x407243
mov dword [ebp - 0x223c], edi
jmp 0x406dd4
xor edi, edi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x406e03
and dword [ebp - 0x2230], eax
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
xor edi, edi
push 0x46f32c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x406f3c
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
cmp word [ebx], 0x3d
jne 0x4072c0
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x406eae
mov eax, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x2254], eax
push ebx
lea eax, [ebp - 0x2218]
push eax
lea edx, [ebp - 0x2254]
mov dword [ebp - 0x2250], esi
call fcn.0040653d
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x2254], esi
mov dword [ebp - 0x2250], esi
jl 0x407316
mov byte [ebp - 4], 0
mov dword [ebp - 0x2250], esi
jmp 0x407243
cmp dword [ebp + 0x14], esi
jne 0x406f26
cmp dword [ebp - 0x2230], esi
je 0x406f26
push esi
push dword [ebp - 0x2228]
mov eax, 0x20006
lea ecx, [ebp - 0x2238]
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.00406916
cmp eax, esi
jne 0x4072c9
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2238]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x406f06
cmp eax, 2
jne 0x4072c9
cmp dword [ebp - 0x2238], esi
je 0x406f20
push dword [ebp - 0x2238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.00406885
mov edi, eax
cmp edi, esi
jmp 0x40728d
push 0x5c
mov eax, ebx
call fcn.004063ed
pop ecx
test eax, eax
jne 0x4072a2
cmp dword [ebp + 0x10], edi
je 0x40702f
push ebx
push dword [ebp - 0x2228]
mov esi, 0x2001f
mov eax, esi
lea ecx, [ebp - 0x2224]
call fcn.00406916
test eax, eax
je 0x406feb
push ebx
push dword [ebp - 0x2228]
lea eax, [esi - 6]
lea ecx, [ebp - 0x2224]
call fcn.00406916
test eax, eax
je 0x406feb
lea eax, [ebp - 0x2258]
push eax
lea eax, [ebp - 0x2230]
push eax
push edi
push esi
push edi
push edi
push edi
push ebx
push dword [ebp - 0x2228]
mov dword [ebp - 0x2230], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x4072ed
xor eax, eax
cmp dword [ebp - 0x2224], edi
je 0x406fd1
push dword [ebp - 0x2224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2230]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], edi
cmp eax, edi
jne 0x4072ed
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
cmp word [ebx], 0x3d
jne 0x407243
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
lea edx, [ebp - 0x2224]
call fcn.0040653d
mov edi, eax
test edi, edi
jl 0x407130
jmp 0x407243
cmp dword [ebp + 0x14], edi
jne 0x407053
push ebx
push dword [ebp - 0x2228]
mov eax, 0x20019
lea ecx, [ebp - 0x2224]
call fcn.00406916
mov dword [ebp - 0x222c], eax
jmp 0x40705d
mov dword [ebp - 0x222c], 2
cmp dword [ebp - 0x222c], edi
je 0x40706c
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00448e3b
push eax
call fcn.004021a5
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.00406885
mov edi, eax
test edi, edi
jl 0x407130
cmp word [ebx], 0x7b
jne 0x4070fb
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4070fb
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp - 0x2224]
push ebx
call fcn.00406c6c
mov edi, eax
test edi, edi
jge 0x4070e8
cmp dword [ebp + 0x14], 0
je 0x407130
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
cmp dword [ebp - 0x222c], 2
mov eax, dword [ebp - 0x2244]
mov dword [ebp + 0x14], eax
je 0x407293
xor esi, esi
cmp dword [ebp - 0x222c], esi
je 0x407163
cmp eax, esi
jne 0x407293
mov eax, dword [ebp - 0x222c]
call fcn.00406b27
mov edi, eax
cmp dword [ebp - 0x2224], 0
je 0x407145
push dword [ebp - 0x2224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447554
leave
ret 0x10
cmp eax, esi
je 0x4071ae
push dword [ebp - 0x2224]
call fcn.00406a7f
test eax, eax
je 0x4071ae
lea eax, [ebp - 0x218]
push eax
call fcn.004068ea
test eax, eax
je 0x407293
cmp dword [ebp - 0x2230], 0
je 0x407293
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2224]
call fcn.00406954
jmp 0x407293
push dword [ebp - 0x2224]
call fcn.00406a7f
mov dword [ebp - 0x222c], eax
xor eax, eax
cmp dword [ebp - 0x2224], esi
je 0x4071db
push dword [ebp - 0x2224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
cmp eax, esi
jne 0x40730f
cmp dword [ebp - 0x2230], esi
je 0x407293
cmp dword [ebp - 0x222c], 0
jne 0x407293
mov eax, dword [ebp - 0x2228]
and dword [ebp - 0x2248], 0
mov dword [ebp - 0x224c], eax
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x224c]
call fcn.00406ad0
and dword [ebp - 0x224c], 0
and dword [ebp - 0x2248], 0
test eax, eax
jne 0x407129
and dword [ebp - 0x2248], eax
cmp dword [ebp + 0x10], 0
je 0x407293
cmp word [ebx], 0x7b
jne 0x407293
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x407293
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push ebx
call fcn.00406c6c
mov edi, eax
test edi, edi
jl 0x407130
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00406b56
mov edi, eax
test edi, edi
jl 0x407130
cmp word [ebx], 0x7d
jne 0x406ce5
jmp 0x407130
cmp dword [ebp - 0x2224], edi
je 0x4072b6
push dword [ebp - 0x2224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x407147
cmp dword [ebp - 0x2224], 0
jmp 0x4072a8
call fcn.00406b27
mov edi, eax
cmp dword [ebp - 0x2238], esi
je 0x407130
push dword [ebp - 0x2238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407130
call fcn.00406b27
mov esi, eax
cmp dword [ebp - 0x2224], edi
je 0x407308
push dword [ebp - 0x2224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x407147
call fcn.00406b27
mov edi, eax
cmp dword [ebp - 0x2224], esi
jmp 0x407137