Function at 0x430f10
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f18d6
mov eax, dword fs:[0]
push eax
mov eax, 0x2250
call fcn.0048e100
mov eax, dword [0x528c24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], ebx
mov dword [ebp - 0x2224], ebx
mov edx, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2244], edx
call fcn.0042ef90
mov esi, eax
cmp esi, ebx
jl 0x4315f4
cmp word [edi], 0x7d
je 0x4315f2
jmp 0x430f90
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [ebp - 0x2238], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x430fc3
test ebx, ebx
je 0x4310db
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4310dd
push 0x5c
push edi
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
call fcn.0042ee70
add esp, 8
test eax, eax
jne 0x43156a
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042f110
test eax, eax
je 0x43103d
mov eax, dword [ebp - 0x222c]
push edi
lea ecx, [ebp - 0x2234]
mov dword [ebp - 0x2234], eax
mov dword [ebp - 0x2230], esi
call fcn.0042f550
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
cmp ebx, esi
je 0x4310d3
mov ebx, dword [ebp - 0x221c]
push edi
mov ecx, ebx
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x431587
push edi
mov ecx, ebx
call fcn.0042f1a0
mov esi, eax
test esi, esi
jl 0x431587
mov dword [ebp - 0x2230], 0
cmp word [edi], 0x7b
jne 0x4310c4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4310c4
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
push 0
push edx
push eax
push edi
call fcn.00430f10
mov esi, eax
test esi, esi
jl 0x4315e1
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
cmp word [edi], 0x7d
jne 0x430f90
jmp 0x4315e1
mov dword [ebp - 0x2230], esi
jmp 0x4310dd
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43110b
mov ecx, dword [ebp - 0x221c]
push edi
mov dword [ebp - 0x2238], eax
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
xor esi, esi
push 0x4fefe8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43123c
lea ecx, [ebp - 0x2218]
push ecx
mov ecx, dword [ebp - 0x221c]
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
cmp word [edi], 0x3d
jne 0x431575
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x4311b6
mov edx, dword [ebp - 0x222c]
push edi
lea eax, [ebp - 0x2218]
push eax
lea ecx, [ebp - 0x224c]
push ecx
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x224c], edx
mov dword [ebp - 0x2248], ebx
call fcn.00430b90
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
jl 0x43158f
mov byte [ebp - 4], bl
mov dword [ebp - 0x2248], ebx
jmp 0x431079
cmp dword [ebp + 0x14], ebx
jne 0x431227
cmp dword [ebp - 0x2238], ebx
je 0x431227
mov edx, dword [ebp - 0x222c]
push 0x20006
push ebx
push edx
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
call fcn.00421780
cmp eax, ebx
jne 0x4315a7
mov esi, dword [ebp - 0x2240]
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x431210
cmp eax, 2
jne 0x4315a7
cmp esi, ebx
je 0x431221
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042f1a0
mov esi, eax
cmp esi, ebx
jmp 0x4310be
push 0x5c
push edi
call fcn.0042ee70
add esp, 8
test eax, eax
jne 0x431575
cmp dword [ebp + 0x10], esi
je 0x431360
mov ebx, dword [ebp - 0x222c]
lea ecx, [ebp - 0x2220]
push ecx
push 0x2001f
push esi
push edi
push ebx
mov dword [ebp - 0x2220], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4312a6
mov ecx, dword [ebp - 0x2228]
xor eax, eax
cmp ecx, esi
je 0x431290
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2220]
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2228], edx
cmp eax, esi
je 0x43131c
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x2228]
call fcn.00421780
test eax, eax
je 0x43131c
lea eax, [ebp - 0x225c]
push eax
lea ecx, [ebp - 0x2220]
push ecx
push esi
push 0x2001f
push esi
push esi
push esi
push edi
mov edx, ebx
push edx
mov dword [ebp - 0x2220], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x4315b5
mov ecx, dword [ebp - 0x2228]
xor eax, eax
cmp ecx, esi
je 0x431300
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2220]
mov dword [ebp - 0x2224], esi
mov ebx, eax
mov dword [ebp - 0x2228], ecx
cmp eax, esi
jne 0x4315b5
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
cmp word [edi], 0x3d
jne 0x431079
mov ecx, dword [ebp - 0x221c]
push edi
push 0
lea edx, [ebp - 0x2228]
push edx
call fcn.00430b90
mov esi, eax
test esi, esi
jl 0x4315e1
jmp 0x431079
cmp dword [ebp + 0x14], esi
jne 0x431460
mov eax, dword [ebp - 0x222c]
push 0x20019
push edi
push eax
lea ecx, [ebp - 0x2228]
call fcn.00421780
mov ebx, eax
mov dword [ebp - 0x2220], ebx
cmp ebx, esi
je 0x431394
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.0048d8eb
push eax
call fcn.0040cc20
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042f1a0
mov esi, eax
test esi, esi
jl 0x4315e1
cmp word [edi], 0x7b
jne 0x431432
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x431432
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
push edx
push edi
call fcn.00430f10
mov esi, eax
test esi, esi
jge 0x431416
test ebx, ebx
je 0x4315e1
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042ef90
mov esi, eax
test esi, esi
jl 0x4315e1
mov ebx, dword [ebp - 0x2220]
mov eax, dword [ebp - 0x2244]
mov dword [ebp + 0x14], eax
cmp ebx, 2
je 0x4310c4
test ebx, ebx
je 0x431475
test eax, eax
jne 0x4310c4
push ebx
call fcn.0042e900
add esp, 4
mov esi, eax
jmp 0x4315e1
mov dword [ebp - 0x2220], 2
mov ebx, dword [ebp - 0x2220]
jmp 0x43138d
mov ebx, dword [ebp - 0x2228]
test eax, eax
je 0x4314cd
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.0042f150
test eax, eax
je 0x4314cd
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x221c]
call fcn.0042f110
test eax, eax
je 0x4310c4
cmp dword [ebp - 0x2238], 0
je 0x4310c4
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x2228]
call fcn.0042f550
jmp 0x4310c4
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.0042f150
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2220], 0
test ebx, ebx
je 0x431504
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2228], 0
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2224], 0
test ebx, ebx
jne 0x4315b5
cmp dword [ebp - 0x2238], ebx
je 0x4310c4
cmp dword [ebp - 0x2258], ebx
jne 0x4310c4
mov ecx, dword [ebp - 0x222c]
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2250], ecx
cmp eax, ecx
jne 0x4315cb
lea ecx, [ebp - 0x2254]
call fcn.00422680
jmp 0x4310c4
lea ecx, [ebp - 0x2234]
call fcn.00422680
lea ecx, [ebp - 0x2228]
call fcn.00422680
mov eax, 0x80020009
jmp 0x4315f4
lea ecx, [ebp - 0x2234]
jmp 0x4315dc
lea ecx, [ebp - 0x224c]
call fcn.00422680
lea ecx, [ebp - 0x2228]
call fcn.00422680
jmp 0x4315f2
push eax
call fcn.0042e900
lea ecx, [ebp - 0x2240]
jmp 0x4315d7
lea ecx, [ebp - 0x2228]
call fcn.00422680
push ebx
call fcn.0042e900
add esp, 4
jmp 0x4315f4
push eax
call fcn.0042e900
lea ecx, [ebp - 0x2254]
add esp, 4
mov esi, eax
call fcn.00422680
mov eax, dword [ebp - 0x2228]
test eax, eax
je 0x4315f2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d9be
mov esp, ebp
pop ebp
ret 0x10