Function at 0x22795783
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x2279abfd
call fcn.2279a2e0
sub esp, 0x224
mov eax, dword [0x227a16b0]
and dword [ebp - 0x224], 0
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [ebp - 0x230], eax
jmp 0x22795c53
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x2279c3ec
push edi
mov dword [ebp - 0x228], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x227957fe
test ebx, ebx
je 0x227958a9
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795cc9
cmp dword [ebp + 0x10], 0
je 0x227958a9
and dword [ebp - 0x220], 0
push 0x5c
push edi
call fcn.22793c0b
test eax, eax
pop ecx
pop ecx
jne 0x22795c6a
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793d59
test eax, eax
je 0x22795866
mov eax, dword [ebp - 0x22c]
push edi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], eax
call fcn.22794047
and dword [ebp - 0x220], 0
test ebx, ebx
je 0x2279589e
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795c7c
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793dba
lea ecx, [ebp - 0x220]
mov esi, eax
call fcn.2279392d
jmp 0x22795a90
lea ecx, [ebp - 0x220]
call fcn.2279392d
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x227958d5
mov ecx, dword [ebp - 0x21c]
and dword [ebp - 0x228], eax
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795cc9
push 0x2279c40c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x227959e5
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call fcn.22793c72
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x22795cc9
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
cmp esi, ebx
jl 0x22795cc9
cmp byte [edi], 0x3d
jne 0x22795c75
cmp dword [ebp + 0x10], ebx
je 0x22795973
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x228], eax
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 1
call fcn.227953d2
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x228], ebx
lea ecx, [ebp - 0x228]
jl 0x22795cc4
mov byte [ebp - 4], bl
jmp 0x22795c14
cmp dword [ebp + 0x14], ebx
jne 0x227959d0
cmp dword [ebp - 0x228], ebx
je 0x227959d0
push 0x20006
push ebx
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
call fcn.22793992
cmp eax, ebx
jne 0x22795c84
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x227959c5
cmp eax, 2
jne 0x22795c84
lea ecx, [ebp - 0x220]
call fcn.2279392d
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793dba
mov esi, eax
cmp esi, ebx
jmp 0x22795c5d
push 0x5c
push edi
call fcn.22793c0b
test eax, eax
pop ecx
pop ecx
jne 0x22795c75
cmp dword [ebp + 0x10], eax
je 0x22795a9d
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.22793992
test eax, eax
je 0x22795a5a
push 0x20019
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.22793992
test eax, eax
je 0x22795a5a
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.22793944
mov esi, eax
cmp esi, ebx
jne 0x22795c93
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795cc9
cmp byte [edi], 0x3d
jne 0x22795c19
mov ecx, dword [ebp - 0x21c]
push edi
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.227953d2
mov esi, eax
test esi, esi
jl 0x22795cc9
jmp 0x22795c19
cmp dword [ebp + 0x14], 0
jne 0x22795abe
push 0x20019
push edi
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x224]
call fcn.22793992
mov ebx, eax
jmp 0x22795ac1
push 2
pop ebx
test ebx, ebx
je 0x22795acc
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795cc9
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793dba
mov esi, eax
test esi, esi
jl 0x22795cc9
cmp byte [edi], 0x7b
jne 0x22795b4d
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
push 0
push dword [ebp - 0x224]
push edi
call fcn.22795783
mov esi, eax
test esi, esi
jge 0x22795b37
cmp dword [ebp + 0x14], 0
je 0x22795cc9
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795cc9
cmp ebx, 2
mov eax, dword [ebp - 0x230]
mov dword [ebp + 0x14], eax
je 0x22795c5f
test ebx, ebx
je 0x22795b79
test eax, eax
jne 0x22795c5f
push ebx
call fcn.227938eb
pop ecx
mov esi, eax
jmp 0x22795cc9
test eax, eax
je 0x22795bd0
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x21c]
call fcn.22793d85
test eax, eax
je 0x22795bd0
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x114]
push eax
call fcn.22793d59
test eax, eax
je 0x22795c5f
cmp dword [ebp - 0x228], 0
je 0x22795c5f
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x224]
call fcn.22794047
jmp 0x22795c5f
lea ecx, [ebp - 0x224]
call fcn.2279392d
mov ebx, eax
test ebx, ebx
jne 0x22795ca1
cmp dword [ebp - 0x228], eax
je 0x22795c5f
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp - 0x228], ebx
test eax, eax
jne 0x22795cb5
lea ecx, [ebp - 0x228]
call fcn.2279392d
cmp dword [ebp + 0x10], 0
je 0x22795c5f
cmp byte [edi], 0x7b
jne 0x22795c5f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x22795c5f
mov ecx, dword [ebp - 0x21c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x224]
push edi
call fcn.22795783
mov esi, eax
test esi, esi
jl 0x22795cc9
mov ecx, dword [ebp - 0x21c]
push edi
call fcn.22793c72
mov esi, eax
test esi, esi
jl 0x22795cc9
cmp byte [edi], 0x7d
jne 0x227957cb
jmp 0x22795cc9
lea ecx, [ebp - 0x220]
call fcn.2279392d
mov esi, 0x80020009
jmp 0x22795cc9
lea ecx, [ebp - 0x220]
jmp 0x22795cc4
push eax
call fcn.227938eb
pop ecx
lea ecx, [ebp - 0x220]
jmp 0x22795cc2
lea ecx, [ebp - 0x224]
call fcn.2279392d
push esi
jmp 0x22795cad
lea ecx, [ebp - 0x224]
call fcn.2279392d
push ebx
call fcn.227938eb
pop ecx
jmp 0x22795cd6
push eax
call fcn.227938eb
pop ecx
lea ecx, [ebp - 0x228]
mov esi, eax
call fcn.2279392d
lea ecx, [ebp - 0x224]
call fcn.2279392d
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.2279a349
leave
ret 0x10