Function at 0x410531
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4352d6
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.00414cb0
mov eax, dword [0x44c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2258], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2254]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x225c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x2268], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
push ebx
mov dword [ebp - 4], eax
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
push 0x7d
pop eax
cmp word [ebx], ax
je 0x410b2d
xor eax, eax
inc eax
push str.Delete
push ebx
mov dword [ebp - 0x2260], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4105eb
test edi, edi
je 0x4106af
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4106b1
push 0x5c
pop edx
mov ecx, ebx
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
call fcn.0040fb23
test eax, eax
jne 0x410b1d
push ebx
call fcn.0041019c
test eax, eax
je 0x410664
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2224]
push ebx
mov dword [ebp - 0x2224], eax
call fcn.004101cb
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
test edi, edi
je 0x4106a2
mov edi, dword [ebp - 0x2258]
mov ecx, edi
push ebx
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b15
push ebx
mov ecx, edi
call fcn.00410137
lea ecx, [ebp - 0x2224]
mov esi, eax
call fcn.00402397
test esi, esi
js 0x410b2d
jmp 0x410aaf
lea ecx, [ebp - 0x2224]
call fcn.00402397
jmp 0x4106b1
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [ebp - 0x2258]
test eax, eax
jne 0x4106df
push ebx
mov ecx, edi
mov dword [ebp - 0x2260], esi
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
push 0x44740c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x410821
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
push ebx
mov ecx, edi
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x410b28
cmp dword [ebp + 0x10], 0
je 0x4107a7
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
xor ecx, ecx
mov edi, dword [ebp - 0x2258]
inc ecx
mov byte [ebp - 4], cl
mov ecx, edi
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.0040fc40
mov esi, eax
lea ecx, [ebp - 0x2230]
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
test esi, esi
js 0x410b65
mov byte [ebp - 4], al
call fcn.00402397
jmp 0x410aaf
cmp dword [ebp + 0x14], 0
jne 0x410814
cmp dword [ebp - 0x2260], 0
je 0x410814
xor eax, eax
lea ecx, [ebp - 0x223c]
push 0x20006
push eax
push dword [ebp - 0x225c]
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], eax
call fcn.00402320
test eax, eax
jne 0x410b56
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x223c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x410809
cmp eax, 2
jne 0x410b56
lea ecx, [ebp - 0x223c]
call fcn.00402397
push ebx
mov ecx, edi
call fcn.00410137
jmp 0x410afe
push 0x5c
pop edx
mov ecx, ebx
call fcn.0040fb23
test eax, eax
jne 0x410b28
cmp dword [ebp + 0x10], eax
je 0x4108bd
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
push 0x2001f
push ebx
push esi
call fcn.00402320
test eax, eax
je 0x410886
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x2254]
call fcn.00402320
test eax, eax
je 0x410886
sub esp, 0x14
lea ecx, [ebp - 0x2254]
push ebx
push esi
call fcn.0040fb5d
test eax, eax
jne 0x410b7b
push ebx
mov ecx, edi
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x410aaf
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x2254]
push eax
call fcn.0040fc40
mov esi, eax
jmp 0x410695
cmp dword [ebp + 0x14], 0
jne 0x4108de
push 0x20019
push ebx
push dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
call fcn.00402320
mov edi, eax
jmp 0x4108e1
push 2
pop edi
mov eax, dword [ebp + 0x14]
test edi, edi
push 1
pop ecx
push 0xffffffffffffffff
cmovne eax, ecx
push ebx
mov dword [ebp - 0x2264], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0041bf3c
push eax
call fcn.00401eda
mov ecx, dword [ebp - 0x2258]
add esp, 0x14
push ebx
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.00410137
mov esi, eax
test esi, esi
js 0x410b2d
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4109a6
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2268]
jne 0x410948
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x4109a6
push dword [ebp - 0x2264]
mov ecx, dword [ebp - 0x2258]
xor eax, eax
push eax
push dword [ebp - 0x2254]
push ebx
call fcn.00410531
mov esi, eax
test esi, esi
jns 0x410990
cmp dword [ebp - 0x2264], 0
je 0x410b2d
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
cmp edi, 2
je 0x410b04
test edi, edi
je 0x4109cb
cmp dword [ebp + 0x14], 0
jne 0x410b04
mov ecx, edi
call fcn.004103d8
mov esi, eax
jmp 0x410b2d
cmp dword [ebp + 0x14], 0
je 0x410a18
push dword [ebp - 0x2254]
call fcn.004102a6
test eax, eax
je 0x410a18
lea eax, [ebp - 0x218]
push eax
call fcn.0041019c
test eax, eax
je 0x410b04
cmp dword [ebp - 0x2260], 0
je 0x410b04
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2254]
call fcn.004101cb
jmp 0x410b04
push dword [ebp - 0x2254]
call fcn.004102a6
mov ecx, dword [ebp - 0x2254]
mov edi, eax
xor eax, eax
test ecx, ecx
je 0x410a40
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2254], ecx
xor ecx, ecx
mov dword [ebp - 0x2250], ecx
test eax, eax
jne 0x410b7b
cmp dword [ebp - 0x2260], ecx
je 0x410b04
test edi, edi
jne 0x410b04
mov eax, dword [ebp - 0x225c]
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2244], ecx
mov dword [ebp - 0x2240], ecx
lea ecx, [ebp - 0x2248]
push eax
call fcn.00410350
xor ecx, ecx
mov dword [ebp - 0x2248], ecx
test eax, eax
jne 0x410b6c
lea ecx, [ebp - 0x2248]
call fcn.00402397
mov edi, dword [ebp - 0x2258]
cmp dword [ebp + 0x10], 0
je 0x410b04
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x410b04
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2268]
jne 0x410ac2
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x410b07
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2254]
push ebx
call fcn.00410531
mov esi, eax
test esi, esi
js 0x410b2d
push ebx
mov ecx, edi
call fcn.004103e6
mov esi, eax
test esi, esi
js 0x410b2d
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [ebx], cx
jne 0x4105bc
jmp 0x410b2d
lea ecx, [ebp - 0x2224]
jmp 0x410b65
lea ecx, [ebp - 0x2224]
call fcn.00402397
mov esi, 0x80020009
lea ecx, [ebp - 0x2254]
call fcn.00402397
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413a95
leave
ret 0x10
mov ecx, eax
call fcn.004103d8
lea ecx, [ebp - 0x223c]
mov esi, eax
call fcn.00402397
jmp 0x410b2d
mov ecx, eax
call fcn.004103d8
lea ecx, [ebp - 0x2248]
jmp 0x410b63
mov ecx, eax
jmp 0x4109bf