Function at 0x434591
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [ebp + 0x14]
and dword [esp], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x1c], eax
mov eax, edi
mov dword [esp + 0x10], ecx
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43495e
cmp word [edi], 0x7d
je 0x43495c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x1c], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x4345fe
test ebx, ebx
je 0x4346c9
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
cmp dword [ebp + 0x10], 0
je 0x4346c9
push 0x5c
mov eax, edi
call fcn.00434359
test eax, eax
pop ecx
jne 0x4349fd
push edi
call fcn.00434e92
test eax, eax
je 0x43464a
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.00434ebe
test ebx, ebx
je 0x4346c9
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
mov ecx, dword [esp + 0x10]
call fcn.00434e49
mov esi, eax
test esi, esi
jl 0x43494b
cmp word [edi], 0x7b
jne 0x4346ba
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4346ba
mov ecx, dword [esp + 0x10]
push 0
push dword [ebp + 0x10]
push dword [esp + 0x14]
push edi
call fcn.00434591
mov esi, eax
test esi, esi
jl 0x43494b
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
cmp word [edi], 0x7d
jne 0x4345cd
jmp 0x43494b
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4346f2
and dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
push 0x512184
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4347df
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x228]
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
cmp word [edi], 0x3d
jne 0x4349fd
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x434777
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 0x22c]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call fcn.00434a54
mov esi, eax
cmp esi, ebx
jge 0x434676
cmp dword [esp + 0xc], ebx
jmp 0x434950
cmp dword [ebp + 0x14], ebx
jne 0x4347cd
cmp dword [esp + 0x14], ebx
je 0x4347cd
push 0x20006
push ebx
push dword [ebp + 0xc]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.004017a0
cmp eax, ebx
jne 0x434a33
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x228]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4347c0
cmp eax, 2
jne 0x434a18
test ebx, ebx
je 0x4347cb
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
call fcn.00434e49
mov esi, eax
cmp esi, ebx
jmp 0x4346b4
push 0x5c
mov eax, edi
call fcn.00434359
test eax, eax
pop ecx
jne 0x4349fd
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x43486e
push 0x2001f
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
call fcn.004017a0
test eax, eax
je 0x434839
push 0x20019
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
call fcn.004017a0
test eax, eax
je 0x434839
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
call fcn.00429fd8
cmp eax, esi
jne 0x434944
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
cmp word [edi], 0x3d
jne 0x434676
push edi
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call fcn.00434a54
jmp 0x43466c
cmp dword [ebp + 0x14], esi
jne 0x43488b
push 0x20019
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
call fcn.004017a0
mov dword [esp + 0x18], eax
jmp 0x434893
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], esi
je 0x4348a0
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x28]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
push eax
call fcn.0040147f
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
mov ecx, dword [esp + 0x10]
call fcn.00434e49
mov esi, eax
test esi, esi
jl 0x43494b
cmp word [edi], 0x7b
jne 0x43491e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x43491e
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
push 0
push dword [esp + 0x14]
push edi
call fcn.00434591
mov esi, eax
test esi, esi
jge 0x43490d
cmp dword [ebp + 0x14], 0
je 0x43494b
mov ecx, dword [esp + 0x10]
mov eax, edi
call fcn.00434480
mov esi, eax
test esi, esi
jl 0x43494b
cmp dword [esp + 0x18], 2
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0x14], eax
je 0x4346ba
xor ebx, ebx
cmp dword [esp + 0x18], ebx
je 0x434967
cmp eax, ebx
jne 0x4346ba
mov eax, dword [esp + 0x18]
call fcn.00434fb7
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x43495c
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, ebx
je 0x4349a8
push dword [esp + 0xc]
call fcn.00434f82
test eax, eax
je 0x4349a8
lea eax, [esp + 0x20]
push eax
call fcn.00434e92
test eax, eax
je 0x4346ba
cmp dword [esp + 0x14], 0
je 0x4346ba
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
call fcn.00434ebe
jmp 0x4346ba
push dword [esp + 0xc]
call fcn.00434f82
cmp dword [esp + 0xc], ebx
mov dword [esp + 0x18], eax
je 0x4349cd
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov dword [esp + 0xc], ebx
jne 0x434a4a
cmp dword [esp + 0x14], ebx
je 0x4346ba
cmp dword [esp + 0x18], 0
jne 0x4346ba
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x434944
jmp 0x4346ba
cmp dword [esp + 0xc], 0
je 0x434a0e
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x43495e
call fcn.00434fb7
test ebx, ebx
mov esi, eax
je 0x43494b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43494b
call fcn.00434fb7
cmp dword [esp + 0x14], ebx
mov esi, eax
je 0x43494b
push dword [esp + 0x14]
jmp 0x434a28
call fcn.00434fb7
jmp 0x43495e