Function at 0x405f12
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7bd2
mov eax, dword fs:[0]
push eax
mov eax, 0x2258
call fcn.00496fd0
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x221c], eax
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov dword [ebp - 4], eax
push edi
mov ecx, ebx
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
push 0x7d
pop eax
cmp word [edi], ax
je 0x40649d
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp - 0x2224], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4d2960
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2220], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405fbf
test esi, esi
je 0x40607f
push edi
mov ecx, ebx
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x406081
push 0x5c
push edi
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.00406a6e
pop ecx
pop ecx
test eax, eax
jne 0x40648d
push edi
mov ecx, ebx
call fcn.00405263
test eax, eax
je 0x406036
mov eax, dword [ebp - 0x221c]
lea ecx, [ebp - 0x223c]
push edi
mov dword [ebp - 0x223c], eax
call fcn.00405a94
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
cmp dword [ebp - 0x2220], esi
je 0x406072
push edi
mov ecx, ebx
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x406485
push edi
mov ecx, ebx
call fcn.004069e7
lea ecx, [ebp - 0x223c]
mov esi, eax
call fcn.00405302
test esi, esi
js 0x40649d
jmp 0x406441
lea ecx, [ebp - 0x223c]
call fcn.00405302
jmp 0x406081
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4060a9
push edi
mov ecx, ebx
mov dword [ebp - 0x2224], esi
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
push 0x4d2958
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4061d5
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
push edi
mov ecx, ebx
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
push 0x3d
pop eax
cmp word [edi], ax
jne 0x406498
cmp dword [ebp + 0x10], 0
je 0x40615b
and dword [ebp - 0x2248], 0
xor eax, eax
and dword [ebp - 0x2244], 0
inc eax
mov byte [ebp - 4], al
mov ecx, ebx
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x224c], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x224c]
push eax
call fcn.00404c92
mov esi, eax
lea ecx, [ebp - 0x224c]
xor eax, eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
test esi, esi
js 0x4064d5
mov byte [ebp - 4], al
jmp 0x40643c
cmp dword [ebp + 0x14], 0
jne 0x4061c8
cmp dword [ebp - 0x2224], 0
je 0x4061c8
xor eax, eax
lea ecx, [ebp - 0x2258]
push 0x20006
push eax
push dword [ebp - 0x221c]
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
call fcn.004057fb
test eax, eax
jne 0x4064c6
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2258]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4061bd
cmp eax, 2
jne 0x4064c6
lea ecx, [ebp - 0x2258]
call fcn.00405302
push edi
mov ecx, ebx
call fcn.004069e7
jmp 0x405f71
push 0x5c
push edi
call fcn.00406a6e
pop ecx
pop ecx
test eax, eax
jne 0x406498
cmp dword [ebp + 0x10], eax
je 0x406278
mov esi, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2230]
push 0x2001f
push edi
push esi
call fcn.004057fb
test eax, eax
je 0x406242
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2230]
call fcn.004057fb
test eax, eax
je 0x406242
xor eax, eax
lea ecx, [ebp - 0x2230]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.0040531c
test eax, eax
jne 0x40635e
push edi
mov ecx, ebx
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
push 0x3d
pop eax
cmp word [edi], ax
jne 0x406441
push edi
push 0
lea eax, [ebp - 0x2230]
mov ecx, ebx
push eax
call fcn.00404c92
mov esi, eax
jmp 0x406065
cmp dword [ebp + 0x14], 0
jne 0x406297
push 0x20019
push edi
push dword [ebp - 0x221c]
lea ecx, [ebp - 0x2230]
call fcn.004057fb
jmp 0x40629a
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [ebp - 0x2220], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp - 0x218]
push edi
push 0x104
push eax
mov dword [ebp - 0x2240], ecx
call fcn.004a97c0
push eax
call fcn.004051fc
add esp, 0x14
mov ecx, ebx
push edi
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
push edi
mov ecx, ebx
call fcn.004069e7
mov esi, eax
test esi, esi
js 0x40649d
push 0x7b
pop eax
cmp word [edi], ax
jne 0x406341
push edi
call fcn.004a338c
pop ecx
cmp eax, 1
jne 0x406341
push dword [ebp - 0x2240]
mov ecx, ebx
push 0
push dword [ebp - 0x2230]
push edi
call fcn.00405f12
mov esi, eax
test esi, esi
jns 0x40632f
cmp dword [ebp - 0x2240], 0
je 0x40649d
push edi
mov ecx, ebx
call fcn.004056c3
mov esi, eax
test esi, esi
js 0x40649d
mov eax, dword [ebp - 0x2220]
cmp eax, 2
je 0x405f7b
test eax, eax
je 0x40636c
cmp dword [ebp + 0x14], 0
jne 0x405f7b
push eax
call fcn.0040524e
pop ecx
mov esi, eax
jmp 0x40649d
cmp dword [ebp + 0x14], 0
je 0x4063bd
push dword [ebp - 0x2230]
mov ecx, ebx
call fcn.0040552c
test eax, eax
je 0x4063bd
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.00405263
test eax, eax
je 0x405f7b
cmp dword [ebp - 0x2224], 0
je 0x405f7b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.00405a94
jmp 0x405f7b
push dword [ebp - 0x2230]
mov ecx, ebx
call fcn.0040552c
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2220], eax
call fcn.00405302
test eax, eax
jne 0x40635e
cmp dword [ebp - 0x2224], eax
je 0x405f7b
cmp dword [ebp - 0x2220], eax
jne 0x405f7b
mov eax, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2264]
and dword [ebp - 0x2260], 0
and dword [ebp - 0x225c], 0
mov dword [ebp - 0x2264], eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040538b
and dword [ebp - 0x2264], 0
test eax, eax
jne 0x4064dc
lea ecx, [ebp - 0x2264]
call fcn.00405302
cmp dword [ebp + 0x10], 0
je 0x405f7b
push 0x7b
pop eax
cmp word [edi], ax
jne 0x405f7b
push edi
call fcn.004a338c
pop ecx
cmp eax, 1
jne 0x405f7b
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2230]
push edi
call fcn.00405f12
mov esi, eax
test esi, esi
js 0x40649d
jmp 0x405f69
lea ecx, [ebp - 0x223c]
jmp 0x4064d5
lea ecx, [ebp - 0x223c]
call fcn.00405302
mov esi, 0x80020009
lea ecx, [ebp - 0x2230]
call fcn.00405302
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ca3
leave
ret 0x10
push eax
call fcn.0040524e
pop ecx
lea ecx, [ebp - 0x2258]
mov esi, eax
call fcn.00405302
jmp 0x40649d
push eax
call fcn.0040524e
pop ecx
lea ecx, [ebp - 0x2264]
jmp 0x4064d3