Function at 0x439a4f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5000fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2264
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, esp
mov dword [esp + 0x2260], eax
push ebx
push esi
push edi
mov eax, dword [0x5475b0]
xor eax, esp
push eax
lea eax, [esp + 0x2278]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2280], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x60], ecx
mov ecx, eax
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a01a
push 0x7d
pop eax
cmp word [edi], ax
je 0x43a00b
xor eax, eax
inc eax
push 0x525c88
push edi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x525c5c
sbb esi, esi
inc esi
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x439b18
test esi, esi
je 0x439bc4
mov ecx, dword [esp + 0x10]
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x439bc6
push 0x5c
pop edx
mov ecx, edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.00438fd7
test eax, eax
jne 0x43a006
push edi
call fcn.004395c7
test eax, eax
je 0x439b85
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00438908
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
cmp dword [esp + 0x18], esi
je 0x439bbe
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
push edi
mov ecx, ebx
call fcn.0043962d
mov esi, eax
test esi, esi
js 0x43a00b
xor ebx, ebx
mov dword [esp + 0x30], ebx
jmp 0x439f71
mov dword [esp + 0x30], esi
jmp 0x439bc6
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x439bee
mov ecx, dword [esp + 0x10]
push edi
mov dword [esp + 0x2c], esi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
push 0x525c54
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x439d22
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x26c]
push eax
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
mov ecx, dword [esp + 0x10]
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
push 0x3d
pop eax
cmp word [edi], ax
jne 0x43a006
cmp dword [ebp + 0x10], 0
je 0x439c9c
mov ecx, dword [esp + 0x10]
xor eax, eax
inc eax
xor ebx, ebx
mov byte [esp + 0x2280], al
mov eax, dword [esp + 0x14]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x26c]
push edi
push eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x50], ebx
push eax
mov dword [esp + 0x58], ebx
call fcn.0043917e
mov esi, eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
test esi, esi
js 0x43a00b
mov byte [esp + 0x2280], bl
mov dword [esp + 0x48], ebx
jmp 0x439f71
cmp dword [ebp + 0x14], 0
jne 0x439d09
cmp dword [esp + 0x28], 0
je 0x439d09
xor esi, esi
lea ecx, [esp + 0x38]
push 0x20006
push esi
push dword [esp + 0x1c]
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
call fcn.0043884c
test eax, eax
jne 0x439fea
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x26c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x439cf2
cmp eax, 2
jne 0x439fda
test ebx, ebx
je 0x439d01
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x38], esi
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x10]
push edi
call fcn.0043962d
mov esi, eax
test esi, esi
js 0x43a00b
jmp 0x439ee8
push 0x5c
pop edx
mov ecx, edi
call fcn.00438fd7
test eax, eax
jne 0x43a006
cmp dword [ebp + 0x10], eax
je 0x439dbe
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push 0x2001f
push edi
push ebx
call fcn.0043884c
test eax, eax
je 0x439d7f
push 0x20019
push edi
push ebx
lea ecx, [esp + 0x28]
call fcn.0043884c
test eax, eax
je 0x439d7f
sub esp, 0x14
lea ecx, [esp + 0x30]
push edi
push ebx
call fcn.004387e9
test eax, eax
jne 0x439ea5
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
push 0x3d
pop eax
cmp word [edi], ax
jne 0x439db7
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0043917e
mov esi, eax
test esi, esi
js 0x43a00b
xor ebx, ebx
jmp 0x439f71
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x439dde
push 0x20019
push edi
push dword [esp + 0x1c]
lea ecx, [esp + 0x28]
call fcn.0043884c
mov ebx, dword [esp + 0x1c]
jmp 0x439de1
push 2
pop eax
push 1
test eax, eax
mov dword [esp + 0x1c], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
lea eax, [esp + 0x68]
push edi
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.004dc842
push eax
call fcn.00402c87
mov ecx, dword [esp + 0x24]
add esp, 0x14
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
mov ecx, dword [esp + 0x10]
push edi
call fcn.0043962d
mov esi, eax
test esi, esi
js 0x43a00b
push 0x7b
pop eax
cmp word [edi], ax
jne 0x439e8d
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x5c]
jne 0x439e40
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x439e8d
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
xor eax, eax
push eax
push ebx
push edi
call fcn.00439a4f
mov esi, eax
test esi, esi
jns 0x439e79
cmp dword [ebp + 0x14], 0
je 0x43a00b
mov ecx, dword [esp + 0x10]
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
js 0x43a00b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x439ee8
test eax, eax
je 0x439eb3
test ecx, ecx
jne 0x439ee8
mov ecx, eax
call fcn.00438513
mov esi, eax
jmp 0x43a00b
test ecx, ecx
je 0x439efc
push ebx
call fcn.004395f6
test eax, eax
je 0x439efc
lea eax, [esp + 0x64]
push eax
call fcn.004395c7
test eax, eax
je 0x439ee8
cmp dword [esp + 0x28], 0
je 0x439ee8
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x20]
call fcn.00438908
mov ebx, dword [esp + 0x1c]
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [edi], cx
jne 0x439ae7
jmp 0x43a00b
push ebx
call fcn.004395f6
mov ecx, eax
xor eax, eax
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x439f21
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov ebx, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
xor edx, edx
mov dword [esp + 0x20], edx
test eax, eax
jne 0x439ea5
cmp dword [esp + 0x28], edx
je 0x439ee8
test ecx, ecx
jne 0x439ee8
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], eax
xor ebx, ebx
lea eax, [esp + 0x64]
mov dword [esp + 0x54], ebx
push eax
mov dword [esp + 0x5c], ebx
call fcn.00438756
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
test eax, eax
jne 0x439ea5
mov dword [esp + 0x54], ebx
cmp dword [ebp + 0x10], 0
je 0x439ee4
push 0x7b
pop eax
cmp word [edi], ax
jne 0x439ee4
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x439f8c
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x439fd1
mov ecx, dword [esp + 0x10]
push ebx
push dword [ebp + 0x10]
mov ebx, dword [esp + 0x24]
push ebx
push edi
call fcn.00439a4f
mov esi, eax
test esi, esi
js 0x43a00b
mov ecx, dword [esp + 0x10]
push edi
call fcn.0043902c
mov esi, eax
test esi, esi
jns 0x439ee8
jmp 0x43a00b
mov ebx, dword [esp + 0x1c]
jmp 0x439eeb
mov ecx, eax
call fcn.00438513
mov esi, eax
test ebx, ebx
je 0x43a00b
push ebx
jmp 0x439ffe
mov ecx, eax
call fcn.00438513
cmp dword [esp + 0x38], 0
mov esi, eax
je 0x43a00b
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43a00b
mov esi, 0x80020009
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x43a01a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x2278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2260]
xor ecx, esp
call fcn.004d9731
mov esp, ebp
pop ebp
ret 0x10