Function at 0x405d52
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x220c]
mov eax, 0x220c
call fcn.0041f0a0
push 0xffffffffffffffff
push 0x43235f
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x44a078]
xor eax, ebp
mov dword [ebp + 0x2208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x2218]
mov edi, dword [ebp + 0x2214]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
push 0x7d
pop eax
cmp word [edi], ax
je 0x406252
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405dfe
test ebx, ebx
je 0x405ea4
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
xor esi, esi
cmp dword [ebp + 0x221c], esi
je 0x405ea6
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.00405348
test eax, eax
jne 0x406245
push edi
call fcn.004058f9
test eax, eax
je 0x405e62
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.004059e6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
test ebx, ebx
je 0x405e9a
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edi
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406240
push edi
mov ecx, ebx
call fcn.00405892
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00405b1c
test esi, esi
js 0x406252
jmp 0x4061f5
lea ecx, [ebp - 0x30]
call fcn.00405b1c
jmp 0x405ea6
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x10]
test eax, eax
jne 0x405ece
push edi
mov ecx, ebx
mov dword [ebp - 0x24], esi
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
push 0x43f6e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405fc9
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
push edi
mov ecx, ebx
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40624d
cmp dword [ebp + 0x221c], 0
je 0x405f67
xor eax, eax
mov ecx, ebx
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x3c], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x40], eax
lea eax, [ebp]
push edi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004054dd
mov esi, eax
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
test esi, esi
js 0x40628d
mov byte [ebp - 4], al
call fcn.00405b1c
jmp 0x4061f5
cmp dword [ebp + 0x2220], 0
jne 0x405fbc
cmp dword [ebp - 0x24], 0
je 0x405fbc
xor eax, eax
lea ecx, [ebp - 0x58]
push 0x20006
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
call fcn.00405988
test eax, eax
jne 0x406281
lea eax, [ebp]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x405fb4
cmp eax, 2
jne 0x406281
lea ecx, [ebp - 0x58]
call fcn.00405b1c
push edi
mov ecx, ebx
call fcn.00405892
jmp 0x405db9
push 0x5c
pop edx
mov ecx, edi
call fcn.00405348
test eax, eax
jne 0x40624d
cmp dword [ebp + 0x221c], eax
je 0x406054
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push 0x2001f
push edi
push esi
call fcn.00405988
test eax, eax
je 0x406021
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x20]
call fcn.00405988
test eax, eax
je 0x406021
sub esp, 0x14
lea ecx, [ebp - 0x20]
push edi
push esi
call fcn.00405374
test eax, eax
jne 0x4062a0
push edi
mov ecx, ebx
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
push 0x3d
pop eax
cmp word [edi], ax
jne 0x4061f5
push edi
push 0
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.004054dd
mov esi, eax
jmp 0x405e8d
cmp dword [ebp + 0x2220], 0
jne 0x406072
push 0x20019
push edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.00405988
mov ebx, eax
jmp 0x406075
push 2
pop ebx
mov eax, dword [ebp + 0x2220]
test ebx, ebx
push 1
pop ecx
push 0xffffffffffffffff
cmovne eax, ecx
push edi
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x2000]
push 0x104
push eax
call fcn.00424e96
push eax
call fcn.00403ef5
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push edi
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00405892
mov esi, eax
test esi, esi
js 0x406252
push 0x7b
pop eax
cmp word [edi], ax
jne 0x406113
push edi
call fcn.0042234b
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x406113
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x20]
push edi
call fcn.00405d52
mov esi, eax
test esi, esi
jns 0x406100
cmp dword [ebp - 0x34], 0
je 0x406252
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00405c10
mov esi, eax
test esi, esi
js 0x406252
cmp ebx, 2
je 0x405dc3
test ebx, ebx
je 0x40613b
cmp dword [ebp + 0x2220], 0
jne 0x405dc3
mov ecx, ebx
call fcn.00405c02
mov esi, eax
jmp 0x406252
cmp dword [ebp + 0x2220], 0
je 0x406182
push dword [ebp - 0x20]
call fcn.00405ae5
test eax, eax
je 0x406182
lea eax, [ebp + 0x2000]
push eax
call fcn.004058f9
test eax, eax
je 0x405dc3
cmp dword [ebp - 0x24], 0
je 0x405dc3
lea eax, [ebp + 0x2000]
push eax
lea ecx, [ebp - 0x20]
call fcn.004059e6
jmp 0x405dc3
push dword [ebp - 0x20]
call fcn.00405ae5
mov ecx, dword [ebp - 0x20]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x4061a1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
and dword [ebp - 0x1c], 0
test eax, eax
jne 0x4062a0
cmp dword [ebp - 0x24], eax
je 0x405dc3
test ebx, ebx
jne 0x405dc3
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x2000]
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.00405b8a
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
test eax, eax
jne 0x406294
lea ecx, [ebp - 0x4c]
call fcn.00405b1c
mov ebx, dword [ebp - 0x10]
cmp dword [ebp + 0x221c], 0
je 0x405dc3
push 0x7b
pop eax
cmp word [edi], ax
jne 0x405dc3
push edi
call fcn.0042234b
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x405dc3
push 0
push dword [ebp + 0x221c]
mov ecx, ebx
push dword [ebp - 0x20]
push edi
call fcn.00405d52
mov esi, eax
test esi, esi
js 0x406252
mov ecx, ebx
jmp 0x405db3
lea ecx, [ebp - 0x30]
jmp 0x40628d
lea ecx, [ebp - 0x30]
call fcn.00405b1c
mov esi, 0x80020009
lea ecx, [ebp - 0x20]
call fcn.00405b1c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2208]
xor ecx, ebp
call fcn.0041df7e
lea esp, [ebp + 0x220c]
pop ebp
ret 0x10
mov ecx, eax
call fcn.00405c02
lea ecx, [ebp - 0x58]
mov esi, eax
call fcn.00405b1c
jmp 0x406252
mov ecx, eax
call fcn.00405c02
lea ecx, [ebp - 0x4c]
jmp 0x40628b
mov ecx, eax
jmp 0x40612f