Function at 0x44316b
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [ebp + 0x14]
and dword [esp], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [esp + 0x18], eax
push edi
mov eax, ebx
mov dword [esp + 0x10], ecx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x4435b2
cmp word [ebx], 0x7d
je 0x4435b0
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
push str.Delete
push ebx
mov dword [esp + 0x1c], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x4431d8
test edi, edi
je 0x4432a6
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4432a8
push 0x5c
mov eax, ebx
call fcn.00442f33
test eax, eax
pop ecx
jne 0x443655
push ebx
call fcn.00443b0b
test eax, eax
je 0x443225
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.0043839f
cmp edi, esi
je 0x4432a8
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
mov ecx, dword [esp + 0x10]
mov edi, ebx
call fcn.00443ac2
mov esi, eax
test esi, esi
jl 0x44359f
cmp word [ebx], 0x7b
jne 0x443297
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x443297
mov ecx, dword [esp + 0x10]
push 0
push dword [ebp + 0x10]
push dword [esp + 0x14]
push ebx
call fcn.0044316b
mov esi, eax
test esi, esi
jl 0x44359f
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
cmp word [ebx], 0x7d
jne 0x4431a7
jmp 0x44359f
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x4432d3
and dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
xor esi, esi
push 0x4c3e6c
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x4433bf
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x228]
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
cmp word [ebx], 0x3d
jne 0x44366f
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x443358
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
push ebx
lea eax, [esp + 0x22c]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call fcn.004436b9
mov esi, eax
cmp esi, edi
jge 0x443253
cmp dword [esp + 0xc], edi
jmp 0x4435a4
cmp dword [ebp + 0x14], edi
jne 0x4433af
cmp dword [esp + 0x14], edi
je 0x4433af
lea eax, [esp + 0x14]
push eax
push 0x20006
push edi
push edi
push dword [ebp + 0xc]
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x443598
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x228]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4433a4
cmp eax, 2
jne 0x443676
test edi, edi
je 0x4433af
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov edi, ebx
call fcn.00443ac2
jmp 0x44328d
push 0x5c
mov eax, ebx
call fcn.00442f33
test eax, eax
pop ecx
jne 0x443655
cmp dword [ebp + 0x10], esi
je 0x443498
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
push 0x2001f
push esi
push ebx
push dword [ebp + 0xc]
mov dword [esp + 0x28], esi
call edi
cmp eax, esi
jne 0x443417
xor eax, eax
cmp dword [esp + 0xc], esi
je 0x44340b
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
je 0x443463
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
push ebx
push dword [ebp + 0xc]
mov dword [esp + 0x28], esi
call edi
cmp eax, esi
jne 0x44344e
xor eax, eax
cmp dword [esp + 0xc], esi
je 0x443442
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
je 0x443463
push ebx
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
call fcn.00440031
cmp eax, esi
jne 0x443691
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
cmp word [ebx], 0x3d
jne 0x443253
push ebx
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call fcn.004436b9
jmp 0x443249
cmp dword [ebp + 0x14], esi
jne 0x4434da
lea eax, [esp + 0x18]
push eax
push 0x20019
push esi
push ebx
push dword [ebp + 0xc]
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4434d4
xor eax, eax
cmp dword [esp + 0xc], esi
je 0x4434cc
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], eax
jmp 0x4434e2
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], esi
je 0x4434ef
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.00490937
push eax
call fcn.004017a9
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
mov ecx, dword [esp + 0x10]
mov edi, ebx
call fcn.00443ac2
mov esi, eax
test esi, esi
jl 0x44359f
cmp word [ebx], 0x7b
jne 0x443572
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x443572
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
push 0
push dword [esp + 0x14]
push ebx
call fcn.0044316b
mov esi, eax
test esi, esi
jge 0x443561
cmp dword [ebp + 0x14], 0
je 0x44359f
mov ecx, dword [esp + 0x10]
mov eax, ebx
call fcn.0044305a
mov esi, eax
test esi, esi
jl 0x44359f
cmp dword [esp + 0x18], 2
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0x14], eax
je 0x443297
mov eax, dword [esp + 0x18]
xor edi, edi
cmp eax, edi
je 0x4435bb
cmp dword [esp + 0x1c], edi
jne 0x443297
call fcn.00443ff4
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x4435b0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x1c], edi
je 0x4435fd
push dword [esp + 0xc]
call fcn.00443b37
test eax, eax
je 0x4435fd
lea eax, [esp + 0x20]
push eax
call fcn.00443b0b
test eax, eax
je 0x443297
cmp dword [esp + 0x14], edi
je 0x443297
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
call fcn.0043839f
jmp 0x443297
push dword [esp + 0xc]
call fcn.00443b37
cmp dword [esp + 0xc], edi
mov dword [esp + 0x18], eax
je 0x443626
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov dword [esp + 0xc], edi
jne 0x4436af
cmp dword [esp + 0x14], edi
je 0x443297
cmp dword [esp + 0x18], edi
jne 0x443297
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x443598
jmp 0x443297
cmp dword [esp + 0xc], esi
je 0x443665
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4435b2
cmp dword [esp + 0xc], 0
jmp 0x443659
call fcn.00443ff4
test edi, edi
mov esi, eax
je 0x44359f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44359f
call fcn.00443ff4
cmp dword [esp + 0xc], esi
mov edi, eax
je 0x4436a8
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4435b2
call fcn.00443ff4
jmp 0x4435b2