Function at 0x406020
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x430
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x42c], eax
mov eax, dword [esp + 0x438]
mov edx, dword [esp + 0x440]
push esi
push edi
mov edi, dword [esp + 0x43c]
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], edx
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x40666a
cmp word [edi], 0x7d
push ebx
push ebp
je 0x406666
jmp 0x406080
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x18], 1
call ebp
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call ebp
test eax, eax
je 0x4060b1
test ebx, ebx
je 0x4061b0
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
xor esi, esi
cmp dword [esp + 0x44c], esi
je 0x4061b2
movzx ecx, word [edi]
mov dword [esp + 0x1c], esi
mov eax, edi
cmp cx, si
je 0x406104
movzx ecx, cx
cmp cx, 0x5c
je 0x4060fc
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, si
jne 0x4060e5
jmp 0x406104
cmp eax, esi
jne 0x4065fc
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404e60
test eax, eax
je 0x406128
mov eax, dword [esp + 0x20]
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
call fcn.00404fe0
mov dword [esp + 0x1c], esi
cmp ebx, esi
je 0x4061b2
mov ebx, dword [esp + 0x18]
push edi
mov ecx, ebx
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406615
push edi
mov ecx, ebx
call fcn.00404ef0
mov esi, eax
test esi, esi
jl 0x406615
cmp word [edi], 0x7b
jne 0x4061a1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4061a1
mov ecx, dword [esp + 0x44c]
mov edx, dword [esp + 0x14]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push edi
call fcn.00406020
mov esi, eax
test esi, esi
jl 0x406657
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
cmp word [edi], 0x7d
jne 0x406080
jmp 0x406657
xor esi, esi
push str.NoRemove
push edi
call ebp
test eax, eax
jne 0x4061d8
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], eax
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
xor esi, esi
push 0x4ba120
push edi
call ebp
test eax, eax
jne 0x4062dd
lea ecx, [esp + 0x234]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
cmp word [edi], 0x3d
jne 0x406605
xor ebx, ebx
cmp dword [esp + 0x44c], ebx
je 0x406270
mov edx, dword [esp + 0x20]
push edi
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edx
call fcn.00405d30
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x10], ebx
jge 0x406158
lea ecx, [esp + 0x10]
call fcn.00404fc0
lea ecx, [esp + 0x14]
call fcn.00404fc0
jmp 0x406666
cmp dword [esp + 0x450], ebx
jne 0x4062ca
cmp dword [esp + 0x10], ebx
je 0x4062ca
mov edx, dword [esp + 0x20]
push 0x20006
push ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
call fcn.00404920
cmp eax, ebx
jne 0x406643
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x234]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x4062bf
cmp eax, 2
jne 0x406643
cmp esi, ebx
je 0x4062ca
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404ef0
mov esi, eax
cmp esi, ebx
jmp 0x40619b
movzx ecx, word [edi]
mov eax, edi
cmp cx, si
je 0x40630f
movzx ecx, cx
lea ebx, [ebx]
cmp cx, 0x5c
je 0x406307
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, si
jne 0x4062f0
jmp 0x40630f
cmp eax, esi
jne 0x406605
cmp dword [esp + 0x44c], esi
je 0x40642e
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push esi
push edi
push edx
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40635e
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x40634c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
cmp eax, esi
je 0x4063f0
xor esi, esi
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push 0x20019
push esi
push edi
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40639a
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x40638e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
cmp eax, esi
je 0x4063f0
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ecx
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x40661b
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4063de
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 0x14], edx
test eax, eax
jne 0x40661b
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
cmp word [edi], 0x3d
jne 0x406158
mov ecx, dword [esp + 0x18]
push edi
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.00405d30
mov esi, eax
test esi, esi
jl 0x406657
jmp 0x406158
cmp dword [esp + 0x450], esi
jne 0x406544
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push esi
push edi
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x406473
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x40646b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov ebx, eax
cmp eax, esi
je 0x406484
mov dword [esp + 0x450], 1
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x34]
push 0x104
push edx
call fcn.0049f35b
push eax
call fcn.00401030
mov ecx, dword [esp + 0x2c]
add esp, 0x14
push edi
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404ef0
mov esi, eax
test esi, esi
jl 0x406657
cmp word [edi], 0x7b
jne 0x406514
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x406514
mov ebp, dword [esp + 0x450]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebp
push 0
push eax
push edi
call fcn.00406020
mov esi, eax
test esi, esi
jge 0x406500
test ebp, ebp
je 0x406657
mov ecx, dword [esp + 0x18]
push edi
call fcn.00404cf0
mov esi, eax
test esi, esi
jl 0x406657
mov eax, dword [esp + 0x24]
mov dword [esp + 0x450], eax
cmp ebx, 2
je 0x4061a1
test ebx, ebx
je 0x40654e
test eax, eax
jne 0x4061a1
push ebx
call fcn.00404820
add esp, 4
mov esi, eax
jmp 0x406657
mov ebx, 2
jmp 0x406479
test eax, eax
je 0x406598
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.00404ea0
test eax, eax
je 0x406598
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
call fcn.00404e60
test eax, eax
je 0x4061a1
cmp dword [esp + 0x10], 0
je 0x4061a1
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.00404fe0
jmp 0x4061a1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
call fcn.00404ea0
mov ebp, eax
test ebx, ebx
je 0x4065c3
mov ecx, ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [esp + 0x14], 0
test ebx, ebx
jne 0x40662f
cmp dword [esp + 0x10], 0
je 0x4061a1
test ebp, ebp
jne 0x4061a1
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [esp + 0x10], ebp
test eax, eax
jne 0x406643
lea ecx, [esp + 0x10]
call fcn.00404fc0
jmp 0x4061a1
lea ecx, [esp + 0x1c]
call fcn.00404fc0
lea ecx, [esp + 0x14]
call fcn.00404fc0
mov eax, 0x80020009
jmp 0x406668
lea ecx, [esp + 0x1c]
jmp 0x406652
lea ecx, [esp + 0x14]
call fcn.00404fc0
push esi
call fcn.00404820
add esp, 4
jmp 0x406668
lea ecx, [esp + 0x14]
call fcn.00404fc0
push ebx
call fcn.00404820
add esp, 4
jmp 0x406668
push eax
call fcn.00404820
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.00404fc0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406666
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x434]
pop edi
pop esi
xor ecx, esp
call fcn.0049e9d2
add esp, 0x430
ret 0x10