Function at 0x5d124481
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d124955
jmp 0x5d1245d0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [ebp - 0x10], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x5d1244e6
test ebx, ebx
je 0x5d1245ed
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
cmp dword [ebp + 0x10], 0
je 0x5d1245ed
and dword [ebp + 8], 0
mov cl, byte [edi]
mov eax, edi
jmp 0x5d12451f
cmp cl, 0x5c
je 0x5d124948
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x5d12450d
mov esi, 0x5d12e030
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x5d124553
add esi, 4
cmp esi, 0x5d12e060
jl 0x5d124528
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.5d124e09
and dword [ebp + 8], 0
test ebx, ebx
je 0x5d1245de
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124386
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x5d12496e
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124db9
mov esi, eax
cmp esi, ebx
jl 0x5d12496e
cmp dword [ebp + 8], ebx
je 0x5d124591
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0x7b
jne 0x5d1245d0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x5d1245d0
mov ecx, dword [ebp - 8]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
push edi
call fcn.5d124481
mov esi, eax
test esi, esi
jl 0x5d12492a
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
cmp byte [edi], 0x7d
jne 0x5d1244b6
jmp 0x5d12492a
cmp dword [ebp + 8], 0
je 0x5d1245ed
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x5d124613
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], eax
push edi
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
push 0x5d12b1cc
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x5d1246f7
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x11c]
push eax
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
cmp byte [edi], 0x3d
jne 0x5d12495f
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x5d124694
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp + 8], eax
push edi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp + 8]
push eax
call fcn.5d124a2a
mov esi, eax
cmp esi, ebx
mov dword [ebp + 8], ebx
jge 0x5d124591
cmp dword [ebp - 4], ebx
jmp 0x5d12492e
cmp dword [ebp + 0x14], ebx
jne 0x5d1246e5
cmp dword [ebp - 0x10], ebx
je 0x5d1246e5
push 0x20006
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.5d1249f5
cmp eax, ebx
jne 0x5d124965
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x5d1246d7
cmp eax, 2
jne 0x5d124965
cmp dword [ebp + 8], ebx
je 0x5d1246e5
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124db9
mov esi, eax
cmp esi, ebx
jmp 0x5d1245ca
mov cl, byte [edi]
mov eax, edi
jmp 0x5d12470f
cmp cl, 0x5c
je 0x5d12497e
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x5d1246fd
cmp dword [ebp + 0x10], esi
je 0x5d1247c1
mov ebx, 0x2001f
push ebx
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.5d1249f5
test eax, eax
je 0x5d124787
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.5d1249f5
test eax, eax
je 0x5d124787
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
push esi
push ebx
push esi
push esi
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x5d124993
xor eax, eax
cmp dword [ebp - 4], esi
je 0x5d124779
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jne 0x5d124993
mov ecx, dword [ebp - 8]
push edi
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
cmp byte [edi], 0x3d
jne 0x5d124591
mov ecx, dword [ebp - 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
call fcn.5d124a2a
mov esi, eax
test esi, esi
jl 0x5d12492a
jmp 0x5d124591
cmp dword [ebp + 0x14], esi
jne 0x5d1247dc
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.5d1249f5
mov dword [ebp + 8], eax
jmp 0x5d1247e3
mov dword [ebp + 8], 2
cmp dword [ebp + 8], esi
je 0x5d1247ef
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0xc], esi
jne 0x5d124801
mov eax, 0x104
call fcn.5d12a5c0
mov dword [ebp - 0xc], esp
push 0x104
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [ebp - 8]
push edi
mov ecx, ebx
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
push edi
mov ecx, ebx
call fcn.5d124db9
mov esi, eax
test esi, esi
jl 0x5d12492a
cmp byte [edi], 0x7b
jne 0x5d12486e
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 4]
push edi
call fcn.5d124481
mov esi, eax
test esi, esi
jge 0x5d12485c
cmp dword [ebp + 0x14], 0
je 0x5d12492a
push edi
mov ecx, ebx
call fcn.5d124386
mov esi, eax
test esi, esi
jl 0x5d12492a
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x14], eax
je 0x5d1245d0
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x5d124895
cmp eax, ebx
jne 0x5d1245d0
push dword [ebp + 8]
jmp 0x5d124922
cmp dword [ebp - 0x14], ebx
je 0x5d1248e6
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.5d124d84
test eax, eax
je 0x5d1248e6
mov ebx, 0x5d12e030
push dword [ebx]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x5d1245d0
add ebx, 4
cmp ebx, 0x5d12e060
jl 0x5d1248ae
cmp dword [ebp - 0x10], 0
je 0x5d1245d0
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.5d124e09
jmp 0x5d1245d0
cmp dword [ebp - 4], ebx
je 0x5d124904
push dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
and dword [ebp - 4], 0
test eax, eax
jne 0x5d1249ae
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x5d1245d0
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x5d1245d0
push eax
call fcn.5d1249cb
pop ecx
mov esi, eax
cmp dword [ebp - 4], 0
je 0x5d124939
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea esp, [ebp - 0x128]
pop edi
pop esi
pop ebx
leave
ret 0x10
lea ecx, [ebp + 8]
call fcn.5d1249de
mov esi, 0x80020009
lea ecx, [ebp - 4]
call fcn.5d1249de
jmp 0x5d124939
cmp dword [ebp - 4], 0
jmp 0x5d124981
push eax
call fcn.5d1249cb
pop ecx
mov esi, eax
cmp dword [ebp + 8], ebx
je 0x5d12492a
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5d12492a
cmp dword [ebp - 4], esi
je 0x5d12498c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x5d12493b
push eax
call fcn.5d1249cb
cmp dword [ebp - 4], esi
pop ecx
mov edi, eax
je 0x5d1249aa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x5d12493b
push eax
call fcn.5d1249cb
cmp dword [ebp - 4], 0
pop ecx
mov esi, eax
je 0x5d124939
push dword [ebp - 4]
call ebx
jmp 0x5d124939