Function at 0x4356dc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.00517f10
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
mov dword [ebp - 0x2234], ecx
push edi
call fcn.0043554a
mov ecx, eax
test eax, eax
js 0x436191
cmp word [edi], 0x7d
je 0x436191
push 0x6390e4
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov esi, eax
push 0x6390ba
push edi
call ebx
test esi, esi
je 0x435751
test eax, eax
jne 0x43589a
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
call fcn.0043554a
mov ecx, eax
test eax, eax
js 0x436191
cmp dword [ebp + 0x10], 0
je 0x43589a
mov dword [ebp - 0x2238], ecx
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test cx, cx
mov edi, dword [sym.imp.USER32.dll_CharNextW]
je 0x4357b6
mov eax, dword [ebp + 8]
cmp cx, 0x5c
je 0x435857
push eax
call edi
movzx ecx, word [eax]
test cx, cx
jne 0x4357a1
push 0x6390f2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x435824
xor ebx, ebx
mov edi, ebx
cmp ebx, 0xb
je 0x4357e8
lea ebx, [edi + 1]
push dword [edi*4 + 0x6391c4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4357ca
cmp edi, 0xb
jb 0x435824
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor edi, edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
lea ecx, [ebp - 0x2218]
push dword [ebp + 8]
call fcn.004363a2
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x2214], edi
mov dword [ebp - 0x2210], edi
xor edi, edi
test esi, esi
jne 0x435864
mov edi, dword [ebp - 0x2234]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call fcn.0043554a
test eax, eax
js 0x435d93
mov ecx, edi
push esi
call fcn.004364f2
mov ecx, eax
mov edi, eax
sar edi, 0x1f
add edi, 4
jmp 0x43586a
mov dword [ebp - 0x2240], 0x80020009
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x2238]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x435889
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
mov dword [ebp - 0x2218], 0
cmp edi, 4
je 0x435a07
test edi, edi
jne 0x435e00
push 0x6390d2
mov esi, dword [ebp + 8]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
mov edi, eax
test eax, eax
jne 0x4358c5
mov ecx, dword [ebp - 0x2234]
push esi
call fcn.0043554a
test eax, eax
js 0x4361e0
test edi, edi
setne byte [ebp - 0x2239]
push 0x6390b2
push esi
call ebx
test eax, eax
je 0x43597b
movzx ecx, word [esi]
test cx, cx
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x435904
mov eax, dword [ebp + 8]
cmp cx, 0x5c
je 0x43618c
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x4358ef
cmp dword [ebp + 0x10], 0
je 0x435a0f
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x435a8c
cmp dword [esi], 0
mov edi, dword [ebp - 0x2234]
je 0x435aae
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x435ad2
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435ad2
xor ecx, ecx
push ecx
push dword [esi]
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
jmp 0x435ace
mov esi, dword [ebp - 0x2234]
mov ecx, esi
lea eax, [ebp - 0x2218]
push eax
call fcn.0043554a
test eax, eax
js 0x435ded
mov ecx, esi
mov esi, dword [ebp + 8]
push esi
call fcn.0043554a
mov ecx, eax
test eax, eax
js 0x435def
mov eax, 0x80020009
cmp word [esi], 0x3d
mov edi, 1
jne 0x435dfa
cmp dword [ebp + 0x10], 0
je 0x435d9f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00436588
mov ecx, eax
test eax, eax
js 0x435e16
mov esi, dword [ebp + 8]
jmp 0x435d34
mov ecx, 2
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x435e82
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x435e28
cmp dword [esi], 0
je 0x435e1d
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x435e7f
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
inc ecx
test eax, eax
je 0x435e7f
xor ecx, ecx
push ecx
push dword [esi]
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
jmp 0x435e42
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x2234]
jmp 0x435ace
cmp dword [esi + 4], 0
je 0x435ad2
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x435b2e
mov dword [ebp - 0x2218], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x435b6c
cmp dword [esi], 0
je 0x435b66
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x435b8e
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435b8e
xor ecx, ecx
push ecx
push dword [esi]
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
jmp 0x435b86
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x435c53
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x435ad2
jmp 0x435cfb
cmp dword [esi + 4], 0
je 0x435b8e
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x435c1f
mov dword [ebp - 0x2230], 0
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x435c78
cmp dword [esi], 0
je 0x435c6e
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4361d4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4361d4
mov ecx, eax
mov eax, dword [esi]
sub esp, 0x2c
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x28], eax
lea edx, [ebp - 0x2218]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x2230]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x649a40]
movups xmmword [esp + 8], xmm0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call ecx
jmp 0x435cb6
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x435c53
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x435b8e
jmp 0x435cfb
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x435cfb
cmp dword [esi + 4], 0
je 0x4361d4
sub esp, 0x24
lea eax, [ebp - 0x2218]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x2230]
mov dword [esp + 0x1c], eax
movaps xmm0, xmmword [0x649a40]
movups xmmword [esp + 8], xmm0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4361d7
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x435cdb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2224], 0
jmp 0x435cdd
xor eax, eax
mov ecx, dword [ebp - 0x2230]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x4361d7
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call fcn.0043554a
mov ecx, eax
test eax, eax
js 0x436191
movzx eax, word [esi]
cmp ax, 0x3d
jne 0x435d37
mov ecx, edi
push esi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00436588
mov ecx, eax
test eax, eax
js 0x436191
movzx eax, word [esi]
cmp ax, 0x7b
jne 0x435f57
mov esi, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.006208d5
add esp, 4
cmp eax, 1
jne 0x435d8c
mov esi, dword [ebp - 0x2234]
mov ecx, esi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push edi
call fcn.004356dc
test eax, eax
js 0x4361e0
mov ecx, esi
push edi
call fcn.0043554a
mov ecx, eax
test eax, eax
jns 0x435f5a
jmp 0x436191
mov ecx, esi
jmp 0x435f5a
mov ecx, eax
mov edi, 3
jmp 0x43586a
cmp dword [ebp + 0x14], 0
setne al
mov cl, byte [ebp - 0x2239]
xor cl, 1
or cl, al
mov edi, dword [ebp - 0x2234]
jne 0x436173
xor eax, eax
mov dword [ebp - 0x2230], eax
lea ecx, [ebp - 0x2230]
push ecx
push 0x20006
push eax
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43612a
push eax
call fcn.0043692d
add esp, 4
mov ecx, eax
mov edi, 3
mov eax, dword [ebp - 0x2240]
mov dword [ebp - 0x2240], eax
test edi, edi
je 0x435f57
cmp edi, 2
je 0x435f57
jmp 0x4361c7
xor edi, edi
inc edi
mov eax, ecx
jmp 0x435dfa
cmp dword [esi + 4], 0
mov ecx, 1
je 0x435e7f
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x435e7f
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x435e67
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov dword [ebp - 0x2224], 0
jmp 0x435e69
xor ecx, ecx
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2238], ecx
test ecx, ecx
mov esi, 1
cmove esi, eax
mov dword [ebp - 0x2244], esi
push 0xffffffffffffffff
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.00620e3e
add esp, 0x10
cmp eax, 0x15
jle 0x435ec0
cmp eax, 0x50
je 0x435ec8
jmp 0x43621b
test eax, eax
jne 0x43622f
mov esi, dword [ebp - 0x2234]
mov ecx, esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0043554a
test eax, eax
js 0x4361e0
mov ecx, esi
push ebx
call fcn.004364f2
mov ecx, eax
test eax, eax
js 0x436191
cmp word [ebx], 0x7b
jne 0x435f4c
push ebx
mov esi, ecx
call fcn.006208d5
mov ecx, esi
add esp, 4
cmp eax, 1
jne 0x435f4c
mov ecx, dword [ebp - 0x2234]
mov esi, dword [ebp - 0x2244]
push esi
push 0
push dword [ebp - 0x2224]
push ebx
call fcn.004356dc
test esi, esi
jne 0x435f34
mov ecx, eax
test eax, eax
js 0x436191
mov ecx, dword [ebp - 0x2234]
push dword [ebp + 8]
call fcn.0043554a
mov ecx, eax
test eax, eax
js 0x436191
mov eax, dword [ebp - 0x2238]
cmp eax, 2
jne 0x435f69
mov edi, dword [ebp + 8]
cmp word [edi], 0x7d
jne 0x43572d
jmp 0x436191
test eax, eax
je 0x435f7b
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 8]
jne 0x435f5a
jmp 0x4361e4
mov dword [ebp - 0x2238], ecx
cmp dword [ebp + 0x14], 0
je 0x436048
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x436048
cmp dword [ebp - 0x2218], 0
je 0x436048
push 0x6390f2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43611c
xor edi, edi
mov esi, edi
cmp edi, 0xb
je 0x43601a
lea edi, [esi + 1]
push dword [esi*4 + 0x6391c4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x435ff8
cmp esi, 0xb
setb al
mov cl, byte [ebp - 0x2239]
xor cl, 1
or cl, al
jne 0x43611c
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.004363a2
jmp 0x43611c
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor ecx, ecx
test eax, eax
sete bl
cmp dword [ebp - 0x2218], ecx
setne bh
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4360c4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], ecx
test eax, eax
je 0x4360ce
jmp 0x4361d7
mov dword [ebp - 0x2220], 0
and bl, bh
test edi, edi
sete al
or al, bl
jne 0x43611c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], ecx
mov dword [ebp - 0x2210], ecx
lea ecx, [ebp - 0x2218]
lea eax, [ebp - 0x218]
push eax
call fcn.00436942
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
mov dword [ebp - 0x2214], ecx
mov dword [ebp - 0x2210], ecx
test eax, eax
jne 0x4361ec
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2238]
jmp 0x435f5a
mov esi, dword [ebp - 0x2230]
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
je 0x436168
push eax
call fcn.0043692d
add esp, 4
mov ecx, eax
test esi, esi
je 0x435def
push esi
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
jmp 0x435def
test esi, esi
je 0x436173
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
push dword [ebp + 8]
call fcn.004364f2
mov ecx, eax
mov edi, eax
shr edi, 0x1f
or edi, 2
jmp 0x435df4
mov ecx, 0x80020009
mov esi, ecx
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4361ae
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2224], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
cmp edi, 3
je 0x436191
mov ecx, dword [ebp - 0x2240]
jmp 0x436191
xor eax, eax
inc eax
push eax
call fcn.0043692d
add esp, 4
mov ecx, eax
jmp 0x436191
push dword [ebp - 0x2238]
jmp 0x4361d8
push eax
call fcn.0043692d
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x436191
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
mov dword [ebp - 0x2218], 0
jmp 0x436191
cmp eax, 0x16
je 0x436225
cmp eax, 0x22
jne 0x43623e
push 0x80070057
call fcn.00485120
cmp eax, 0xc
jne 0x43623e
push 0x8007000e
call fcn.00485120
push 0x80004005
call fcn.00485120