Function at 0x423e30
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4770c6
mov eax, dword fs:[0]
push eax
mov eax, 0x114c
call fcn.0045c740
mov eax, dword [0x4eec64]
xor eax, esp
mov dword [esp + 0x1148], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0x1160]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1170]
mov eax, ecx
mov ecx, dword [esp + 0x1174]
xor esi, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov edx, dword [esp + 0x117c]
push ebx
mov dword [esp + 0x116c], esi
mov dword [esp + 0x54], edx
call fcn.00423300
mov ebp, eax
cmp ebp, esi
jl 0x4244d5
cmp byte [ebx], 0x7d
je 0x4244d3
lea esp, [esp]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push ebx
mov dword [esp + 0x2c], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x423ef1
test edi, edi
je 0x424028
mov eax, dword [esp + 0x18]
push ebx
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x4244c4
xor ebp, ebp
cmp dword [esp + 0x1178], ebp
je 0x424022
mov cl, byte [ebx]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov eax, ebx
test cl, cl
je 0x423f48
mov esi, dword [sym.imp.USER32.dll_CharNextA]
lea ebx, [ebx]
cmp cl, 0x5c
je 0x423f40
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x423f30
jmp 0x423f48
cmp eax, ebp
jne 0x424464
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebp, 0x48dbac
mov eax, dword [ebp]
push eax
push ebx
call esi
test eax, eax
je 0x423f89
add ebp, 4
cmp ebp, 0x48dbdc
jl 0x423f53
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], ecx
xor ebp, ebp
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], ebp
call fcn.00422100
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
test edi, edi
je 0x424018
mov esi, dword [esp + 0x18]
push ebx
mov eax, esi
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x42447d
mov edi, ebx
mov ecx, esi
call fcn.00423970
mov ebp, eax
test ebp, ebp
jl 0x42447d
mov dword [esp + 0x30], 0
cmp byte [ebx], 0x7b
jne 0x42400a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x42400a
mov ecx, dword [esp + 0x1178]
mov edx, dword [esp + 0x1c]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ebx
call fcn.00423e30
mov ebp, eax
test ebp, ebp
jl 0x4244c4
mov eax, dword [esp + 0x18]
push ebx
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x4244c4
cmp byte [ebx], 0x7d
jne 0x423ec0
jmp 0x4244c4
mov dword [esp + 0x30], 0
jmp 0x424028
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebp, dword [esp + 0x1c]
push str.NoRemove
push ebx
call esi
test eax, eax
jne 0x42405a
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
push ebx
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x4244c4
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x48db68
push ebx
xor edi, edi
call esi
test eax, eax
jne 0x424185
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x15c]
push edx
call fcn.00423300
mov ebp, eax
cmp ebp, edi
jl 0x4244c4
mov eax, dword [esp + 0x18]
push ebx
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x4244c4
cmp byte [ebx], 0x3d
jne 0x42446d
xor esi, esi
cmp dword [esp + 0x1178], esi
je 0x4240fc
mov eax, dword [esp + 0x28]
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x116c], 1
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x164]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], esi
call fcn.00423440
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
jl 0x424483
mov byte [esp + 0x1168], 0
mov dword [esp + 0x44], esi
jmp 0x423fc2
cmp dword [esp + 0x117c], esi
jne 0x424171
cmp dword [esp + 0x24], esi
je 0x424171
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push edx
push 0x20006
push esi
push esi
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x424497
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x15c]
push ecx
push edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
je 0x42415e
cmp eax, 2
jne 0x424497
cmp edi, esi
je 0x42416d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x18]
mov edi, ebx
call fcn.00423970
mov ebp, eax
cmp ebp, esi
jmp 0x424004
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x4241ac
lea ecx, [ecx]
cmp cl, 0x5c
je 0x4241a4
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x424190
jmp 0x4241ac
cmp eax, edi
jne 0x42446d
cmp dword [esp + 0x1178], edi
je 0x42428c
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push edx
push 0x2001f
push edi
push ebx
push eax
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4241f9
xor eax, eax
cmp ebp, edi
je 0x4241e5
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x42424f
xor edi, edi
mov ebp, ecx
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x424235
xor eax, eax
cmp ebp, edi
je 0x424225
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x42424f
mov edx, dword [esp + 0x28]
push edx
mov edx, ebx
lea esi, [esp + 0x20]
call fcn.00422050
mov edi, eax
test edi, edi
jne 0x4244a2
mov eax, dword [esp + 0x18]
push ebx
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x4244c4
cmp byte [ebx], 0x3d
jne 0x423fc2
mov ecx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x20]
push eax
xor edx, edx
call fcn.00423440
mov ebp, eax
test ebp, ebp
jl 0x4244c4
jmp 0x423fc2
cmp dword [esp + 0x117c], edi
jne 0x4243a0
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [esp + 0x48], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4242d1
xor eax, eax
cmp ebp, edi
je 0x4242c5
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
mov esi, eax
cmp eax, edi
je 0x4242e2
mov dword [esp + 0x117c], 1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x5c]
push 0x104
push edx
call fcn.0045f68c
push eax
call fcn.00421910
mov eax, dword [esp + 0x2c]
add esp, 0x14
push ebx
call fcn.00423300
mov ebp, eax
cmp ebp, edi
jl 0x4244c4
mov ecx, dword [esp + 0x18]
mov edi, ebx
call fcn.00423970
mov ebp, eax
test ebp, ebp
jl 0x4244c4
cmp byte [ebx], 0x7b
jne 0x424372
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x424372
mov edi, dword [esp + 0x117c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edi
push 0
push eax
push ebx
call fcn.00423e30
mov ebp, eax
test ebp, ebp
jge 0x42435e
test edi, edi
je 0x4244c4
mov eax, dword [esp + 0x18]
push ebx
call fcn.00423300
mov ebp, eax
test ebp, ebp
jl 0x4244c4
mov eax, dword [esp + 0x50]
mov dword [esp + 0x117c], eax
cmp esi, 2
je 0x42400a
test esi, esi
je 0x4243aa
test eax, eax
jne 0x42400a
mov eax, esi
call fcn.00421a90
mov ebp, eax
jmp 0x4244c4
mov esi, 2
jmp 0x4242d7
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x4243ed
mov ecx, esi
call fcn.00423930
test eax, eax
je 0x4243ed
lea ecx, [esp + 0x54]
push ecx
call fcn.004238f0
test eax, eax
je 0x42400a
cmp dword [esp + 0x24], 0
je 0x42400a
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
call fcn.00422100
jmp 0x42400a
mov ecx, esi
call fcn.00423930
xor edi, edi
mov dword [esp + 0x34], eax
test esi, esi
je 0x42440f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test edi, edi
jne 0x4244a2
cmp dword [esp + 0x24], edi
je 0x42400a
cmp dword [esp + 0x34], edi
jne 0x42400a
mov eax, dword [esp + 0x28]
mov dword [esp + 0x4c], edi
lea edi, [esp + 0x54]
lea esi, [esp + 0x48]
mov dword [esp + 0x48], eax
call fcn.00421ff0
xor ecx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
cmp eax, ecx
jne 0x4244b4
call fcn.00421fd0
jmp 0x42400a
lea esi, [esp + 0x2c]
call fcn.00421fd0
lea esi, [esp + 0x1c]
call fcn.00421fd0
mov eax, 0x80020009
jmp 0x4244d5
lea esi, [esp + 0x2c]
jmp 0x4244bf
lea esi, [esp + 0x40]
call fcn.00421fd0
lea esi, [esp + 0x1c]
call fcn.00421fd0
jmp 0x4244d3
call fcn.00421a90
lea esi, [esp + 0x38]
jmp 0x4244bd
lea esi, [esp + 0x1c]
call fcn.00421fd0
mov eax, edi
call fcn.00421a90
jmp 0x4244d5
call fcn.00421a90
lea esi, [esp + 0x48]
mov ebp, eax
call fcn.00421fd0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4244d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x1160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1148]
xor ecx, esp
call fcn.0045c0ce
add esp, 0x1158
ret 0x10