Function at 0x41202e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ef43
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00532310
mov eax, dword [0x5f1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2258], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2254]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x225c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 4], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x226c], eax
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
push 0x7d
pop eax
cmp word [ebx], ax
je 0x412667
xor eax, eax
inc eax
push str.Delete
push ebx
mov dword [ebp - 0x2260], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push ebx
mov dword [ebp - 0x2268], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4120f9
test esi, esi
je 0x4121da
push ebx
mov ecx, edi
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4121dc
xor eax, eax
lea edi, [ebp - 0x2224]
stosd dword es:[edi], eax
mov ecx, ebx
push 0x5c
pop edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
call fcn.0041150a
test eax, eax
jne 0x412657
push ebx
call fcn.00411ca1
test eax, eax
je 0x412185
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2224]
push ebx
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
call fcn.00411cd0
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
cmp dword [ebp - 0x2268], esi
je 0x4121c7
mov edi, dword [ebp - 0x2258]
mov ecx, edi
push ebx
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x41264f
push ebx
mov ecx, edi
call fcn.00411c3a
lea ecx, [ebp - 0x2224]
mov esi, eax
call fcn.0040321c
test esi, esi
js 0x412667
jmp 0x4125e4
lea ecx, [ebp - 0x2224]
call fcn.0040321c
mov edi, dword [ebp - 0x2258]
jmp 0x4121dc
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x412204
push ebx
mov ecx, edi
mov dword [ebp - 0x2260], esi
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
push 0x5c782c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x412357
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
push ebx
mov ecx, edi
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x412662
cmp dword [ebp + 0x10], 0
je 0x4122cc
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x2258]
xor eax, eax
inc eax
mov ecx, edi
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x225c]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.004117e5
mov esi, eax
lea ecx, [ebp - 0x2230]
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
test esi, esi
js 0x4126a1
mov byte [ebp - 4], al
call fcn.0040321c
jmp 0x4125e4
cmp dword [ebp + 0x14], 0
jne 0x41234a
cmp dword [ebp - 0x2260], 0
je 0x41234a
xor eax, eax
lea edi, [ebp - 0x2248]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2248]
push 0x20006
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push dword [ebp - 0x225c]
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], eax
call fcn.004031a2
test eax, eax
jne 0x412692
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2248]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x412339
cmp eax, 2
jne 0x412692
lea ecx, [ebp - 0x2248]
call fcn.0040321c
mov edi, dword [ebp - 0x2258]
push ebx
mov ecx, edi
call fcn.00411c3a
jmp 0x412633
push 0x5c
pop edx
mov ecx, ebx
call fcn.0041150a
test eax, eax
jne 0x412662
cmp dword [ebp + 0x10], eax
je 0x4123fb
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
push 0x2001f
push ebx
push esi
call fcn.004031a2
test eax, eax
je 0x4123c4
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x2254]
call fcn.004031a2
test eax, eax
je 0x4123c4
xor eax, eax
lea ecx, [ebp - 0x2254]
push eax
push eax
push 0x2001f
push eax
push eax
push ebx
push esi
call fcn.00411599
test eax, eax
jne 0x4126b7
push ebx
mov ecx, edi
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x4125e4
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x2254]
push eax
call fcn.004117e5
mov esi, eax
jmp 0x4121ba
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x41241d
push 0x20019
push ebx
push dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
call fcn.004031a2
mov edi, eax
jmp 0x412420
push 2
pop edi
push 1
pop eax
push 0xffffffffffffffff
test edi, edi
push ebx
cmovne esi, eax
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.00555818
push eax
call fcn.004030a2
mov ecx, dword [ebp - 0x2258]
add esp, 0x14
push ebx
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.00411c3a
mov esi, eax
test esi, esi
js 0x412667
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4124d9
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2264]
jne 0x412481
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x4124d9
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x2258]
xor eax, eax
push eax
push dword [ebp - 0x2254]
push ebx
call fcn.0041202e
mov esi, eax
test esi, esi
jns 0x4124c3
cmp dword [ebp + 0x14], 0
je 0x412667
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
mov eax, dword [ebp - 0x226c]
mov dword [ebp + 0x14], eax
cmp edi, 2
je 0x412639
test edi, edi
je 0x412505
test eax, eax
jne 0x412639
mov ecx, edi
call fcn.00411eca
mov esi, eax
jmp 0x412667
test eax, eax
je 0x412550
push dword [ebp - 0x2254]
call fcn.00411db2
test eax, eax
je 0x412550
lea eax, [ebp - 0x218]
push eax
call fcn.00411ca1
test eax, eax
je 0x412639
cmp dword [ebp - 0x2260], 0
je 0x412639
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2254]
call fcn.00411cd0
jmp 0x412639
push dword [ebp - 0x2254]
call fcn.00411db2
lea ecx, [ebp - 0x2254]
mov edi, eax
call fcn.0040321c
test eax, eax
jne 0x4126b7
cmp dword [ebp - 0x2260], eax
je 0x412639
test edi, edi
jne 0x412639
lea edi, [ebp - 0x223c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x223c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
xor edi, edi
mov dword [ebp - 0x223c], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
call fcn.00411e51
mov dword [ebp - 0x223c], edi
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
test eax, eax
jne 0x4126a8
lea ecx, [ebp - 0x223c]
call fcn.0040321c
mov edi, dword [ebp - 0x2258]
cmp dword [ebp + 0x10], 0
je 0x412639
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x412639
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2264]
jne 0x4125f7
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x41263c
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2254]
push ebx
call fcn.0041202e
mov esi, eax
test esi, esi
js 0x412667
push ebx
mov ecx, edi
call fcn.00411ed8
mov esi, eax
test esi, esi
js 0x412667
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [ebx], cx
je 0x412667
mov edi, dword [ebp - 0x2258]
jmp 0x4120c4
lea ecx, [ebp - 0x2224]
jmp 0x4126a1
lea ecx, [ebp - 0x2224]
call fcn.0040321c
mov esi, 0x80020009
lea ecx, [ebp - 0x2254]
call fcn.0040321c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531526
mov esp, ebp
pop ebp
ret 0x10
mov ecx, eax
call fcn.00411eca
lea ecx, [ebp - 0x2248]
mov esi, eax
call fcn.0040321c
jmp 0x412667
mov ecx, eax
call fcn.00411eca
lea ecx, [ebp - 0x223c]
jmp 0x41269f
mov ecx, eax
jmp 0x4124f9