Function at 0x426f97
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4571d8
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00451090
mov eax, dword [0x45d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2248], ecx
mov dword [ebp - 0x222c], ebx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275cd
jmp 0x427579
push 0x40d838
push edi
mov dword [ebp - 0x2230], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x40d80c
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427046
test ebx, ebx
je 0x42710e
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x427110
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x2240], esi
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
call fcn.00426504
test eax, eax
jne 0x4275b7
push edi
call fcn.00426ae5
test eax, eax
je 0x4270cb
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2240]
push edi
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
call fcn.00425df8
mov dword [ebp - 0x2240], esi
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
test ebx, ebx
je 0x427106
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
push edi
mov ecx, ebx
call fcn.00426b4b
mov esi, eax
test esi, esi
js 0x4275bc
xor eax, eax
mov dword [ebp - 0x223c], eax
jmp 0x427526
mov dword [ebp - 0x223c], esi
jmp 0x427110
xor esi, esi
push 0x40d824
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x221c]
test eax, eax
jne 0x42713e
push edi
mov ecx, ebx
mov dword [ebp - 0x2230], esi
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
push 0x40d804
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42727b
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
push edi
mov ecx, ebx
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
push 0x3d
pop eax
cmp word [edi], ax
jne 0x4275b7
cmp dword [ebp + 0x10], 0
je 0x4271ee
mov eax, dword [ebp - 0x2220]
mov ecx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2260], eax
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2260]
push eax
call fcn.004266b0
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x2260], ecx
mov dword [ebp - 0x225c], ecx
mov dword [ebp - 0x2258], ecx
test esi, esi
js 0x4275bc
mov byte [ebp - 4], cl
mov dword [ebp - 0x225c], ecx
jmp 0x427526
cmp dword [ebp + 0x14], 0
jne 0x42726e
cmp dword [ebp - 0x2230], 0
je 0x42726e
xor esi, esi
lea ecx, [ebp - 0x2254]
push 0x20006
push esi
push dword [ebp - 0x2220]
mov dword [ebp - 0x2254], esi
mov dword [ebp - 0x2250], esi
mov dword [ebp - 0x224c], esi
call fcn.00425cf3
test eax, eax
jne 0x427597
mov ebx, dword [ebp - 0x2254]
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x427251
cmp eax, 2
jne 0x427587
test ebx, ebx
je 0x427262
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2254], esi
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2250], esi
push edi
mov ecx, ebx
call fcn.00426b4b
jmp 0x427573
push 0x5c
pop edx
mov ecx, edi
call fcn.00426504
test eax, eax
jne 0x4275b7
cmp dword [ebp + 0x10], eax
je 0x42731f
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
push 0x2001f
push edi
push esi
call fcn.00425cf3
test eax, eax
je 0x4272e0
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.00425cf3
test eax, eax
je 0x4272e0
sub esp, 0x14
lea ecx, [ebp - 0x222c]
push edi
push esi
call fcn.00425c90
test eax, eax
jne 0x427431
push edi
mov ecx, ebx
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
push 0x3d
pop eax
cmp word [edi], ax
jne 0x427526
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x222c]
push eax
call fcn.004266b0
mov esi, eax
test esi, esi
js 0x4275bc
jmp 0x427526
cmp dword [ebp + 0x14], 0
jne 0x42733e
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
call fcn.00425cf3
jmp 0x427341
push 2
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2234], eax
mov dword [ebp - 0x2244], ebx
test eax, eax
je 0x42735d
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2244], ebx
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0043dad3
add esp, 0x10
mov ecx, eax
call fcn.004189bf
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00426b4b
mov esi, eax
test esi, esi
js 0x4275bc
push 0x7b
pop eax
cmp word [edi], ax
jne 0x42740e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2248]
jne 0x4273b4
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x42740e
mov ecx, dword [ebp - 0x221c]
xor eax, eax
push ebx
mov ebx, dword [ebp - 0x222c]
push eax
push ebx
push edi
call fcn.00426f97
mov esi, eax
test esi, esi
jns 0x4273f6
cmp dword [ebp - 0x2244], 0
je 0x4275bc
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
jmp 0x427414
mov ebx, dword [ebp - 0x222c]
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x427579
test eax, eax
je 0x42743f
cmp dword [ebp + 0x14], 0
jne 0x427579
mov ecx, eax
call fcn.00425917
mov esi, eax
jmp 0x4275bc
cmp dword [ebp + 0x14], 0
je 0x427487
push ebx
call fcn.00426b14
test eax, eax
je 0x427487
lea eax, [ebp - 0x218]
push eax
call fcn.00426ae5
test eax, eax
je 0x427579
cmp dword [ebp - 0x2230], 0
je 0x427579
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x222c]
call fcn.00425df8
jmp 0x427579
push ebx
call fcn.00426b14
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x2234], ecx
mov eax, edx
test ebx, ebx
je 0x4274b2
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2234]
xor edx, edx
mov dword [ebp - 0x222c], edx
mov dword [ebp - 0x2228], edx
test eax, eax
jne 0x427431
cmp dword [ebp - 0x2230], eax
je 0x427579
test ecx, ecx
jne 0x427579
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x226c]
mov dword [ebp - 0x226c], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2268], edx
mov dword [ebp - 0x2264], edx
call fcn.00425c08
xor ecx, ecx
mov dword [ebp - 0x226c], ecx
mov dword [ebp - 0x2268], ecx
mov dword [ebp - 0x2264], ecx
test eax, eax
jne 0x427431
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2268], ecx
cmp dword [ebp + 0x10], 0
je 0x427579
push 0x7b
pop eax
cmp word [edi], ax
jne 0x427579
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2248]
jne 0x427539
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x427579
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x222c]
push edi
call fcn.00426f97
mov esi, eax
test esi, esi
js 0x4275bc
push edi
mov ecx, ebx
call fcn.00426559
mov esi, eax
test esi, esi
js 0x4275bc
push 0x7d
pop eax
cmp word [edi], ax
jne 0x427013
jmp 0x4275bc
mov ecx, eax
call fcn.00425917
mov esi, eax
test ebx, ebx
je 0x4275bc
push ebx
jmp 0x4275af
mov ecx, eax
call fcn.00425917
cmp dword [ebp - 0x2254], 0
mov esi, eax
je 0x4275bc
push dword [ebp - 0x2254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4275bc
mov esi, 0x80020009
mov eax, dword [ebp - 0x222c]
test eax, eax
je 0x4275cd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043567f
mov esp, ebp
pop ebp
ret 0x10