Function at 0x41654a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ac39
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00438ab0
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2258], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2254]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x225c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x226c], eax
mov dword [ebp - 0x2254], edi
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
push ebx
mov dword [ebp - 4], eax
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b5a
jmp 0x416b06
push str.Delete
push ebx
mov dword [ebp - 0x2260], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x416600
test edi, edi
je 0x4166b6
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4166b8
push 0x5c
pop edx
mov ecx, ebx
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x221c], esi
call fcn.004159ab
test eax, eax
jne 0x416b44
push ebx
call fcn.004160ce
test eax, eax
je 0x416673
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2224]
push ebx
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], esi
call fcn.004161d7
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x221c], esi
test edi, edi
je 0x4166ae
mov edi, dword [ebp - 0x2258]
mov ecx, edi
push ebx
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
push ebx
mov ecx, edi
call fcn.00416069
mov esi, eax
test esi, esi
js 0x416b49
xor eax, eax
mov dword [ebp - 0x2220], eax
jmp 0x4168d9
mov dword [ebp - 0x2220], esi
jmp 0x4166b8
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [ebp - 0x2258]
test eax, eax
jne 0x4166e6
push ebx
mov ecx, edi
mov dword [ebp - 0x2260], esi
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
push 0x4423dc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41683e
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
push ebx
mov ecx, edi
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x416b44
cmp dword [ebp + 0x10], 0
je 0x4167a7
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
mov edi, dword [ebp - 0x2258]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00415c2b
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
test esi, esi
js 0x416b49
mov byte [ebp - 4], al
mov dword [ebp - 0x222c], eax
jmp 0x4168d9
cmp dword [ebp + 0x14], 0
jne 0x416827
cmp dword [ebp - 0x2260], 0
je 0x416827
xor esi, esi
lea ecx, [ebp - 0x223c]
push 0x20006
push esi
push dword [ebp - 0x225c]
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.00416160
test eax, eax
jne 0x416b24
mov edi, dword [ebp - 0x223c]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x41680a
cmp eax, 2
jne 0x416b14
test edi, edi
je 0x41681b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x223c], esi
mov edi, dword [ebp - 0x2258]
mov dword [ebp - 0x2238], esi
push ebx
mov ecx, edi
call fcn.00416069
mov esi, eax
test esi, esi
js 0x416b49
jmp 0x416b06
push 0x5c
pop edx
mov ecx, ebx
call fcn.004159ab
test eax, eax
jne 0x416b44
cmp dword [ebp + 0x10], eax
je 0x416931
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
push 0x2001f
push ebx
push esi
call fcn.00416160
test eax, eax
je 0x4168a3
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x2254]
call fcn.00416160
test eax, eax
je 0x4168a3
sub esp, 0x14
lea ecx, [ebp - 0x2254]
push ebx
push esi
call fcn.00415a58
test eax, eax
jne 0x416a34
push ebx
mov ecx, edi
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x4168d9
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x2254]
push eax
call fcn.00415c2b
mov esi, eax
test esi, esi
js 0x416b49
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x416b06
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x226c]
jne 0x4168ea
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x416b06
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2254]
push ebx
call fcn.0041654a
mov esi, eax
test esi, esi
js 0x416b49
push ebx
mov ecx, edi
call fcn.004163ef
jmp 0x41682f
cmp dword [ebp + 0x14], 0
jne 0x416950
push 0x20019
push ebx
push dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
call fcn.00416160
jmp 0x416953
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x2264], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push ebx
cmove ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp - 0x2268], ecx
call fcn.0042c517
push eax
call fcn.00401a22
add esp, 0x14
mov ecx, edi
push ebx
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
push ebx
mov ecx, edi
call fcn.00416069
mov esi, eax
test esi, esi
js 0x416b49
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x416a11
mov ecx, ebx
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4169b8
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x416a11
push dword [ebp - 0x2268]
mov ecx, dword [ebp - 0x2258]
push edi
mov edi, dword [ebp - 0x2254]
push edi
push ebx
call fcn.0041654a
mov esi, eax
test esi, esi
jns 0x4169f9
cmp dword [ebp - 0x2268], 0
je 0x416b49
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.004163ef
mov esi, eax
test esi, esi
js 0x416b49
jmp 0x416a17
mov edi, dword [ebp - 0x2254]
mov eax, dword [ebp - 0x2264]
cmp eax, 2
je 0x416b06
test eax, eax
je 0x416a42
cmp dword [ebp + 0x14], 0
jne 0x416b06
mov ecx, eax
call fcn.004163e1
mov esi, eax
jmp 0x416b49
cmp dword [ebp + 0x14], 0
je 0x416a87
push edi
call fcn.004162ac
test eax, eax
je 0x416a87
lea eax, [ebp - 0x218]
push eax
call fcn.004160ce
test eax, eax
je 0x416b06
cmp dword [ebp - 0x2260], 0
je 0x416b06
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2254]
call fcn.004161d7
jmp 0x416b06
push edi
call fcn.004162ac
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2264], ecx
test edi, edi
je 0x416ab2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2264]
xor edi, edi
mov dword [ebp - 0x2254], edi
jmp 0x416ab4
xor edi, edi
mov dword [ebp - 0x2250], edi
test eax, eax
jne 0x416a34
cmp dword [ebp - 0x2260], eax
je 0x416b06
test ecx, ecx
jne 0x416b06
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2244], edi
mov dword [ebp - 0x2240], edi
call fcn.00416368
mov dword [ebp - 0x2248], edi
test eax, eax
jne 0x416a34
push 0x7d
pop eax
cmp word [ebx], ax
jne 0x4165cd
jmp 0x416b49
mov ecx, eax
call fcn.004163e1
mov esi, eax
test edi, edi
je 0x416b49
push edi
jmp 0x416b3c
mov ecx, eax
call fcn.004163e1
cmp dword [ebp - 0x223c], 0
mov esi, eax
je 0x416b49
push dword [ebp - 0x223c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x416b49
mov esi, 0x80020009
mov eax, dword [ebp - 0x2254]
test eax, eax
je 0x416b5a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421e3f
leave
ret 0x10