Function at 0x41aad8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435a94
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00433980
mov eax, dword [0x44200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2258], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2254]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x225c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x226c], eax
mov dword [ebp - 0x2254], edi
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
push ebx
mov dword [ebp - 4], eax
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0e8
jmp 0x41b094
push str.Delete
push ebx
mov dword [ebp - 0x2260], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41ab8e
test edi, edi
je 0x41ac44
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x41ac46
push 0x5c
pop edx
mov ecx, ebx
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x221c], esi
call fcn.00419fa4
test eax, eax
jne 0x41b0d2
push ebx
call fcn.0041a66d
test eax, eax
je 0x41ac01
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2224]
push ebx
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], esi
call fcn.0041a776
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x221c], esi
test edi, edi
je 0x41ac3c
mov edi, dword [ebp - 0x2258]
mov ecx, edi
push ebx
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
push ebx
mov ecx, edi
call fcn.0041a608
mov esi, eax
test esi, esi
js 0x41b0d7
xor eax, eax
mov dword [ebp - 0x2220], eax
jmp 0x41ae67
mov dword [ebp - 0x2220], esi
jmp 0x41ac46
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [ebp - 0x2258]
test eax, eax
jne 0x41ac74
push ebx
mov ecx, edi
mov dword [ebp - 0x2260], esi
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
push 0x43d65c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41adcc
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
push ebx
mov ecx, edi
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x41b0d2
cmp dword [ebp + 0x10], 0
je 0x41ad35
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
mov edi, dword [ebp - 0x2258]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.0041a1a4
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
test esi, esi
js 0x41b0d7
mov byte [ebp - 4], al
mov dword [ebp - 0x222c], eax
jmp 0x41ae67
cmp dword [ebp + 0x14], 0
jne 0x41adb5
cmp dword [ebp - 0x2260], 0
je 0x41adb5
xor esi, esi
lea ecx, [ebp - 0x223c]
push 0x20006
push esi
push dword [ebp - 0x225c]
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.0041a6ff
test eax, eax
jne 0x41b0b2
mov edi, dword [ebp - 0x223c]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x41ad98
cmp eax, 2
jne 0x41b0a2
test edi, edi
je 0x41ada9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x223c], esi
mov edi, dword [ebp - 0x2258]
mov dword [ebp - 0x2238], esi
push ebx
mov ecx, edi
call fcn.0041a608
mov esi, eax
test esi, esi
js 0x41b0d7
jmp 0x41b094
push 0x5c
pop edx
mov ecx, ebx
call fcn.00419fa4
test eax, eax
jne 0x41b0d2
cmp dword [ebp + 0x10], eax
je 0x41aebf
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
push 0x2001f
push ebx
push esi
call fcn.0041a6ff
test eax, eax
je 0x41ae31
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x2254]
call fcn.0041a6ff
test eax, eax
je 0x41ae31
sub esp, 0x14
lea ecx, [ebp - 0x2254]
push ebx
push esi
call fcn.0041a051
test eax, eax
jne 0x41afc2
push ebx
mov ecx, edi
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x41ae67
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x2254]
push eax
call fcn.0041a1a4
mov esi, eax
test esi, esi
js 0x41b0d7
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x41b094
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x226c]
jne 0x41ae78
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x41b094
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2254]
push ebx
call fcn.0041aad8
mov esi, eax
test esi, esi
js 0x41b0d7
push ebx
mov ecx, edi
call fcn.0041a98e
jmp 0x41adbd
cmp dword [ebp + 0x14], 0
jne 0x41aede
push 0x20019
push ebx
push dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
call fcn.0041a6ff
jmp 0x41aee1
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x2264], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push ebx
cmove ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp - 0x2268], ecx
call fcn.004264a5
push eax
call fcn.00401a65
add esp, 0x14
mov ecx, edi
push ebx
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
push ebx
mov ecx, edi
call fcn.0041a608
mov esi, eax
test esi, esi
js 0x41b0d7
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x41af9f
mov ecx, ebx
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x41af46
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x41af9f
push dword [ebp - 0x2268]
mov ecx, dword [ebp - 0x2258]
push edi
mov edi, dword [ebp - 0x2254]
push edi
push ebx
call fcn.0041aad8
mov esi, eax
test esi, esi
jns 0x41af87
cmp dword [ebp - 0x2268], 0
je 0x41b0d7
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.0041a98e
mov esi, eax
test esi, esi
js 0x41b0d7
jmp 0x41afa5
mov edi, dword [ebp - 0x2254]
mov eax, dword [ebp - 0x2264]
cmp eax, 2
je 0x41b094
test eax, eax
je 0x41afd0
cmp dword [ebp + 0x14], 0
jne 0x41b094
mov ecx, eax
call fcn.0041a980
mov esi, eax
jmp 0x41b0d7
cmp dword [ebp + 0x14], 0
je 0x41b015
push edi
call fcn.0041a84b
test eax, eax
je 0x41b015
lea eax, [ebp - 0x218]
push eax
call fcn.0041a66d
test eax, eax
je 0x41b094
cmp dword [ebp - 0x2260], 0
je 0x41b094
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2254]
call fcn.0041a776
jmp 0x41b094
push edi
call fcn.0041a84b
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2264], ecx
test edi, edi
je 0x41b040
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2264]
xor edi, edi
mov dword [ebp - 0x2254], edi
jmp 0x41b042
xor edi, edi
mov dword [ebp - 0x2250], edi
test eax, eax
jne 0x41afc2
cmp dword [ebp - 0x2260], eax
je 0x41b094
test ecx, ecx
jne 0x41b094
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2244], edi
mov dword [ebp - 0x2240], edi
call fcn.0041a907
mov dword [ebp - 0x2248], edi
test eax, eax
jne 0x41afc2
push 0x7d
pop eax
cmp word [ebx], ax
jne 0x41ab5b
jmp 0x41b0d7
mov ecx, eax
call fcn.0041a980
mov esi, eax
test edi, edi
je 0x41b0d7
push edi
jmp 0x41b0ca
mov ecx, eax
call fcn.0041a980
cmp dword [ebp - 0x223c], 0
mov esi, eax
je 0x41b0d7
push dword [ebp - 0x223c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41b0d7
mov esi, 0x80020009
mov eax, dword [ebp - 0x2254]
test eax, eax
je 0x41b0e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d487
leave
ret 0x10