Function at 0x43341d
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49d2d6
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4dc0a8]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
mov eax, dword [0x4dc0a8]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and dword [esp + 0x14], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
and dword [esp + 0x450], 0
mov dword [esp + 0x28], eax
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x4338b0
cmp word [edi], 0x7d
je 0x4338ae
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x24], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x4334cb
test ebx, ebx
je 0x433597
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
cmp dword [ebp + 0x10], 0
je 0x433597
push 0x5c
mov eax, edi
call fcn.00433198
test eax, eax
pop ecx
jne 0x43396d
push edi
call fcn.00433e55
test eax, eax
je 0x433518
mov eax, dword [esp + 0x24]
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], eax
call fcn.00433e81
test ebx, ebx
je 0x433597
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
mov ecx, dword [esp + 0x18]
call fcn.00433df0
mov esi, eax
test esi, esi
jl 0x43389d
cmp word [edi], 0x7b
jne 0x433588
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x433588
mov ecx, dword [esp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [esp + 0x1c]
push edi
call fcn.0043341d
mov esi, eax
test esi, esi
jl 0x43389d
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
cmp word [edi], 0x7d
jne 0x43349a
jmp 0x43389d
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4335c0
and dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
push 0x4b53c0
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4336be
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x234]
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
cmp word [edi], 0x3d
jne 0x43396d
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x433652
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x450], 1
mov dword [esp + 0x1c], eax
push edi
lea eax, [esp + 0x238]
push eax
lea edx, [esp + 0x24]
call fcn.004339bc
mov esi, eax
cmp esi, ebx
jl 0x433988
mov byte [esp + 0x450], bl
jmp 0x433544
cmp dword [ebp + 0x14], ebx
jne 0x4336ac
cmp dword [esp + 0x1c], ebx
je 0x4336ac
lea eax, [esp + 0x1c]
push eax
push 0x20006
push ebx
push ebx
push dword [esp + 0x34]
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x433896
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x234]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x43369f
cmp eax, 2
jne 0x433991
test ebx, ebx
je 0x4336aa
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov ecx, dword [esp + 0x18]
call fcn.00433df0
mov esi, eax
cmp esi, ebx
jmp 0x433582
push 0x5c
mov eax, edi
call fcn.00433198
test eax, eax
pop ecx
jne 0x4339ac
cmp dword [ebp + 0x10], esi
je 0x43379a
and dword [esp + 0x1c], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
mov esi, 0x2001f
push esi
push 0
push edi
push dword [esp + 0x34]
call ebx
test eax, eax
jne 0x433717
cmp dword [esp + 0x14], eax
je 0x43370b
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
je 0x433766
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push edi
push dword [esp + 0x34]
call ebx
test eax, eax
jne 0x43374f
cmp dword [esp + 0x14], eax
je 0x433743
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
je 0x433766
push esi
push edi
push dword [esp + 0x2c]
lea eax, [esp + 0x20]
call fcn.004061fc
test eax, eax
jne 0x433896
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
cmp word [edi], 0x3d
jne 0x433544
mov ecx, dword [esp + 0x18]
push edi
push 0
lea edx, [esp + 0x1c]
call fcn.004339bc
jmp 0x43353a
cmp dword [ebp + 0x14], esi
jne 0x4337dd
lea eax, [esp + 0x20]
push eax
push 0x20019
push esi
push edi
push dword [esp + 0x34]
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4337d7
xor eax, eax
cmp dword [esp + 0x14], esi
je 0x4337cf
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
jmp 0x4337e5
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], esi
je 0x4337f2
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x34]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
push eax
call fcn.004040e7
mov ecx, dword [esp + 0x2c]
add esp, 0x14
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
mov ecx, dword [esp + 0x18]
call fcn.00433df0
mov esi, eax
test esi, esi
jl 0x43389d
cmp word [edi], 0x7b
jne 0x433870
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x433870
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push 0
push dword [esp + 0x1c]
push edi
call fcn.0043341d
mov esi, eax
test esi, esi
jge 0x43385f
cmp dword [ebp + 0x14], 0
je 0x43389d
mov ecx, dword [esp + 0x18]
mov eax, edi
call fcn.0043330c
mov esi, eax
test esi, esi
jl 0x43389d
cmp dword [esp + 0x20], 2
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x14], eax
je 0x433588
xor ebx, ebx
cmp dword [esp + 0x20], ebx
je 0x4338d6
cmp eax, ebx
jne 0x433588
mov eax, dword [esp + 0x20]
call fcn.0043400e
mov esi, eax
cmp dword [esp + 0x14], 0
je 0x4338ae
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.00486d86
mov esp, ebp
pop ebp
ret 0x10
cmp eax, ebx
je 0x433917
push dword [esp + 0x14]
call fcn.00433fd9
test eax, eax
je 0x433917
lea eax, [esp + 0x2c]
push eax
call fcn.00433e55
test eax, eax
je 0x433588
cmp dword [esp + 0x1c], 0
je 0x433588
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.00433e81
jmp 0x433588
push dword [esp + 0x14]
call fcn.00433fd9
cmp dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
je 0x43393c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov dword [esp + 0x14], ebx
jne 0x4339b2
cmp dword [esp + 0x1c], ebx
je 0x433588
cmp dword [esp + 0x20], 0
jne 0x433588
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x433896
jmp 0x433588
cmp dword [esp + 0x14], 0
je 0x43397e
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4338b0
cmp dword [esp + 0x14], ebx
jmp 0x4338a2
call fcn.0043400e
test ebx, ebx
mov esi, eax
je 0x43389d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43389d
cmp dword [esp + 0x14], esi
jmp 0x433972
call fcn.0043400e
jmp 0x4338b0