Function at 0x5195b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2234
call fcn.004e7f70
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0xff
push ebx
call fcn.004eac00
add esp, 0xc
mov ecx, esi
push edi
call fcn.00519440
mov ecx, eax
test eax, eax
js 0x51962f
mov dword [ebp - 0x2238], esi
cmp word [edi], 0x7d
je 0x51962f
mov esi, edi
jmp 0x5197dc
push eax
call fcn.0051a970
add esp, 4
mov ecx, eax
jmp 0x51962f
mov ecx, 0x80020009
mov esi, ecx
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x519642
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 0x2234
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51975f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51975f
mov ecx, eax
mov edi, dword [edi]
call dword [0x5798d8]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x51972c
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5196f1
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5196f1
jmp 0x519c1b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x519793
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x519714
cmp dword [edi], 0
jne 0x51965b
cmp dword [edi + 4], 0
je 0x51975f
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x51975f
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x5198b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x519793
sub esp, 0x1c
movaps xmm0, xmmword [0x563c20]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.0051a990
test eax, eax
jne 0x51961d
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00519440
mov ecx, eax
test eax, eax
js 0x51962f
movzx eax, word [esi]
cmp ax, 0x3d
je 0x519bf4
cmp ax, 0x7b
jne 0x5197d2
mov edi, ecx
push esi
call fcn.00502114
add esp, 4
cmp eax, 1
je 0x519e88
mov ecx, edi
cmp word [esi], 0x7d
je 0x51962f
push str.Delete
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov edi, eax
push 0x563c48
push esi
call ebx
test eax, eax
je 0x519932
test edi, edi
je 0x519932
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
push str.NoRemove
push esi
call edi
mov dword [ebp - 0x223c], eax
test eax, eax
je 0x5198cf
push 0x563c40
push esi
call edi
test eax, eax
je 0x5198e8
test esi, esi
je 0x519855
mov eax, esi
jmp 0x519845
test ecx, ecx
je 0x519855
push eax
call ebx
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x51983e
test eax, eax
jne 0x51962a
cmp dword [ebp + 0x10], 0
je 0x519981
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x519886
cmp dword [edi], 0
jne 0x5196a8
cmp dword [edi + 4], 0
je 0x5196f1
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5196f1
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x5196cc
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x519793
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00519440
test eax, eax
jns 0x519826
jmp 0x519626
push 0x2000
push 0xff
lea edi, [ebp - 0x2218]
push edi
call fcn.004eac00
add esp, 0xc
mov ecx, dword [ebp - 0x2238]
push edi
call fcn.00519440
mov edx, 3
test eax, eax
jns 0x519f5f
mov ecx, eax
test edx, edx
je 0x5197d2
cmp edx, 2
je 0x5197d2
jmp 0x519ec0
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00519440
mov ecx, eax
test eax, eax
js 0x51962f
cmp dword [ebp + 0x10], 0
je 0x519804
mov dword [ebp - 0x2234], ecx
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test esi, esi
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
je 0x519b3e
mov eax, esi
jmp 0x519b13
mov edx, 2
cmp dword [ebp + 0x14], 0
lea ebx, [ebp - 0x218]
jne 0x519a03
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x5199ba
cmp dword [edi], 0
jne 0x519abd
cmp dword [edi + 4], 0
mov edx, 1
je 0x519a03
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x519a03
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x5199ed
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov dword [ebp - 0x2234], edx
test edx, edx
mov edi, 1
cmove edi, dword [ebp + 0x14]
push 0xffffffffffffffff
push esi
push 0x104
push ebx
call fcn.00502d4c
add esp, 0x10
mov ebx, esi
cmp eax, 0x15
jle 0x519a36
cmp eax, 0x50
je 0x519a3e
jmp 0x51a12f
test eax, eax
jne 0x51a143
mov esi, dword [ebp - 0x2238]
mov ecx, esi
push ebx
call fcn.00519440
test eax, eax
js 0x519626
mov ecx, esi
push ebx
call fcn.0051a410
mov ecx, eax
test eax, eax
js 0x51962f
mov esi, ebx
cmp word [ebx], 0x7b
je 0x519a9a
lea ebx, [ebp - 0x218]
mov edx, dword [ebp - 0x2234]
cmp edx, 2
je 0x5197d2
test edx, edx
je 0x519c41
cmp dword [ebp + 0x14], 0
jne 0x5197d2
jmp 0x51a129
push esi
mov ebx, ecx
call fcn.00502114
mov ecx, ebx
add esp, 4
cmp eax, 1
lea ebx, [ebp - 0x218]
mov edx, dword [ebp - 0x2234]
jne 0x519a7a
jmp 0x519ed4
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x519a03
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
je 0x519a03
mov ecx, eax
mov edi, dword [edi]
call dword [0x5798d8]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x5199d2
push eax
call ebx
movzx ecx, word [eax]
test ecx, ecx
je 0x519b3e
cmp ecx, 0x5c
jne 0x519b10
test eax, eax
je 0x519b3e
mov dword [ebp - 0x2240], 0x80020009
xor edx, edx
inc edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [ebp - 0x2234]
jmp 0x519bb9
push str.AppID
push esi
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call eax
test eax, eax
je 0x519ba3
push str.CLSID
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.Component_Categories
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.FileType
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.Interface
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.Hardware
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x51a083
xor edx, edx
test edi, edi
mov ecx, dword [ebp - 0x2234]
je 0x519f18
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x519be2
push eax
mov dword [ebp - 0x2234], ecx
mov dword [ebp - 0x223c], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x223c]
mov ecx, dword [ebp - 0x2234]
cmp edx, 4
je 0x519c13
test edx, edx
je 0x519810
jmp 0x51991c
mov ecx, dword [ebp - 0x2238]
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.0051a4d0
mov ecx, eax
test eax, eax
js 0x51962f
movzx eax, word [esi]
jmp 0x5197b6
mov ecx, eax
mov edi, dword [edi]
call dword [0x5798d8]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push esi
push dword [ebp + 0xc]
call ecx
jmp 0x51989e
mov dword [ebp - 0x2234], ecx
cmp dword [ebp + 0x14], 0
mov edi, 0
je 0x519d36
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x519d36
cmp dword [ebp - 0x2218], 0
je 0x519d36
push str.AppID
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x519d2b
push str.CLSID
push ebx
call edi
test eax, eax
je 0x519d2b
push str.Component_Categories
push ebx
call edi
test eax, eax
je 0x519d2b
push str.FileType
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push str.Interface
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push str.Hardware
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push str.Mime
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push 0x563d04
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x519e1a
mov ecx, dword [ebp - 0x2234]
jmp 0x5197d2
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x2218], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea ecx, [ebp - 0x2218]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
setne dl
cmp dword [ebp - 0x2218], edi
sete dh
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x519e08
push eax
mov ebx, edx
mov bh, dh
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dh, bh
mov dl, bl
lea ebx, [ebp - 0x218]
mov dword [ebp - 0x2224], edi
mov dword [ebp - 0x2220], edi
test eax, eax
mov ecx, dword [ebp - 0x2234]
jne 0x51961d
or dl, dh
cmp dword [ebp - 0x223c], 0
sete al
xor dl, 1
or dl, al
jne 0x5197d2
lea edi, [ebp - 0x2218]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
push ebx
call fcn.0051aaa0
xor ecx, ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
test eax, eax
je 0x519d2b
jmp 0x51a15c
mov dword [ebp - 0x2220], 0
mov ecx, dword [ebp - 0x2234]
jmp 0x519dbf
push str.SECURITY
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push str.SYSTEM
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push str.Software
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
push str.TypeLib
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519d2b
cmp dword [ebp - 0x223c], 0
je 0x519d2b
lea ecx, [ebp - 0x2224]
push ebx
call fcn.0051a2c0
jmp 0x519d2b
mov edi, dword [ebp - 0x2238]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push esi
call fcn.005195b0
test eax, eax
js 0x519626
mov ecx, edi
push esi
call fcn.00519440
mov ecx, eax
test eax, eax
jns 0x5197d2
jmp 0x51962f
cmp edx, 3
je 0x51962f
mov ecx, dword [ebp - 0x2240]
jmp 0x51962f
mov ecx, dword [ebp - 0x2238]
push edi
push 0
push dword [ebp - 0x2224]
push esi
call fcn.005195b0
test eax, eax
jns 0x519ef7
mov ecx, eax
test edi, edi
je 0x51962f
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00519440
mov edx, dword [ebp - 0x2234]
mov ecx, eax
test eax, eax
jns 0x519a7a
jmp 0x51962f
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00519440
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x519f3a
mov ecx, eax
mov edx, 3
jmp 0x519bb9
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051a410
mov ecx, eax
mov edx, eax
sar edx, 0x1f
add edx, 4
jmp 0x519bb9
mov edx, 3
jmp 0x51991c
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.00519440
mov ecx, eax
test eax, eax
js 0x519f55
xor edx, edx
inc edx
cmp word [esi], 0x3d
je 0x519f89
mov dword [ebp - 0x2240], 0x80020009
jmp 0x51991c
cmp dword [ebp + 0x10], 0
jne 0x51a041
mov dword [ebp - 0x2234], ecx
cmp dword [ebp + 0x14], 0
jne 0x51a026
cmp dword [ebp - 0x223c], 0
je 0x51a026
xor eax, eax
lea edi, [ebp - 0x2230]
mov dword [edi], eax
push edi
push 0x20006
push eax
xor ebx, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
mov edi, 0
test eax, eax
cmove edi, ecx
jne 0x51a00e
lea eax, [ebp - 0x2218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov cl, 1
test eax, 0xfffffffd
jne 0x51a00e
test edi, edi
je 0x519ffd
push edi
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test cl, cl
jne 0x51a026
mov ecx, dword [ebp - 0x2234]
mov edx, ebx
jmp 0x51991c
mov ebx, 3
push eax
call fcn.0051a970
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x2234], eax
jmp 0x519fee
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051a410
mov ecx, eax
mov edx, eax
shr edx, 0x1f
or edx, 2
jmp 0x51991c
mov ebx, edx
lea eax, [ebp - 0x2230]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x2238]
mov edi, esi
push esi
lea edx, [ebp - 0x2218]
push edx
push eax
call fcn.0051a4d0
mov ecx, eax
test eax, eax
js 0x51a079
mov esi, edi
jmp 0x519c13
mov dword [ebp - 0x2240], ecx
mov esi, edi
jmp 0x51a007
push str.Mime
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push 0x563d04
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.SECURITY
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.SYSTEM
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
push str.TypeLib
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x519ba3
lea ecx, [ebp - 0x2218]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push esi
call fcn.0051a2c0
xor eax, eax
lea ecx, [ebp - 0x2218]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
jmp 0x519ba3
push edx
jmp 0x51961e
cmp eax, 0x16
je 0x51a139
cmp eax, 0x22
jne 0x51a152
push 0x80070057
call fcn.00531440
cmp eax, 0xc
jne 0x51a152
push 0x8007000e
call fcn.00531440
push 0x80004005
call fcn.00531440
push eax
call fcn.0051a970
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x51a178
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
jmp 0x51962f