Function at 0x41a0d0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2254
call fcn.004cd140
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x2224], eax
xor esi, esi
push edi
mov eax, ebx
mov dword [ebp - 0x2220], ecx
mov dword [ebp - 0x2244], ebx
mov dword [ebp - 0x221c], esi
mov dword [ebp - 0x2218], esi
mov dword [ebp - 0x224c], edx
call fcn.00419f50
mov edi, eax
cmp edi, esi
jl 0x41a826
cmp word [ebx], 0x7d
je 0x41a824
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x2230], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x41a167
test esi, esi
je 0x41a2aa
mov ecx, dword [ebp - 0x2220]
mov eax, ebx
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
xor edx, edx
cmp dword [ebp + 0x10], edx
je 0x41a2aa
movzx ecx, word [ebx]
mov dword [ebp - 0x222c], edx
mov dword [ebp - 0x2228], edx
mov eax, ebx
cmp cx, dx
je 0x41a1c1
movzx ecx, cx
cmp cx, 0x5c
je 0x41a1b9
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x41a1a2
jmp 0x41a1c1
test eax, eax
jne 0x41a752
mov edi, 0x51d0d0
mov eax, dword [edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41a20d
add edi, 4
cmp edi, 0x51d100
jl 0x41a1c6
mov ecx, dword [ebp - 0x2224]
mov dword [ebp - 0x222c], ecx
xor edi, edi
push ebx
lea ecx, [ebp - 0x222c]
mov dword [ebp - 0x2228], edi
call fcn.0040fb30
mov dword [ebp - 0x222c], edi
mov dword [ebp - 0x2228], edi
jmp 0x41a20f
xor edi, edi
cmp esi, edi
je 0x41a2a4
mov esi, dword [ebp - 0x2220]
mov eax, ebx
mov ecx, esi
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a780
mov edi, ebx
mov ecx, esi
call fcn.00419e20
mov edi, eax
test edi, edi
jl 0x41a780
mov dword [ebp - 0x2228], 0
cmp word [ebx], 0x7b
jne 0x41a6b7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x41a6b7
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x221c]
mov esi, dword [ebp - 0x2220]
push 0
push edx
push eax
push ebx
mov ecx, esi
call fcn.0041a0d0
mov edi, eax
test edi, edi
jl 0x41a813
mov eax, ebx
mov ecx, esi
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
jmp 0x41a6b7
mov dword [ebp - 0x2228], edi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41a2d7
mov ecx, dword [ebp - 0x2220]
mov dword [ebp - 0x2230], eax
mov eax, ebx
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
push 0x51c9c0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41a40c
mov ecx, dword [ebp - 0x2220]
lea eax, [ebp - 0x2210]
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
mov ecx, dword [ebp - 0x2220]
mov eax, ebx
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
cmp word [ebx], 0x3d
jne 0x41a75d
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x41a37c
mov edx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], edx
mov edx, dword [ebp - 0x2220]
push ecx
mov ecx, ebx
mov dword [ebp - 0x223c], esi
call fcn.00419a90
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x2240], esi
mov dword [ebp - 0x223c], esi
jl 0x41a78b
mov dword [ebp - 0x223c], esi
jmp 0x41a24d
cmp dword [ebp + 0x14], esi
jne 0x41a3f0
cmp dword [ebp - 0x2230], esi
je 0x41a3f0
mov edx, dword [ebp - 0x2224]
xor edi, edi
push edx
mov ecx, 0x20006
xor edx, edx
lea esi, [ebp - 0x2238]
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
call fcn.0040fcc0
cmp eax, edi
jne 0x41a7a6
mov esi, dword [ebp - 0x2238]
lea eax, [ebp - 0x2210]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x41a3d9
cmp eax, 2
jne 0x41a7a6
cmp esi, edi
je 0x41a3ea
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
mov ecx, dword [ebp - 0x2220]
mov edi, ebx
call fcn.00419e20
mov edi, eax
test edi, edi
jl 0x41a813
jmp 0x41a6b7
movzx ecx, word [ebx]
xor edi, edi
mov eax, ebx
cmp cx, di
je 0x41a43f
movzx ecx, cx
jmp 0x41a420
cmp cx, 0x5c
je 0x41a437
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, di
jne 0x41a420
jmp 0x41a43f
cmp eax, edi
jne 0x41a75d
cmp dword [ebp + 0x10], edi
je 0x41a546
mov edx, dword [ebp - 0x2224]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x2214]
push ecx
push 0x2001f
push edi
push ebx
push edx
mov dword [ebp - 0x2214], edi
call esi
cmp eax, edi
jne 0x41a49a
mov ecx, dword [ebp - 0x221c]
xor eax, eax
cmp ecx, edi
je 0x41a482
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2214]
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x221c], ecx
cmp eax, edi
je 0x41a502
xor edi, edi
mov eax, dword [ebp - 0x2224]
lea edx, [ebp - 0x2214]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [ebp - 0x2214], edi
call esi
cmp eax, edi
jne 0x41a4e4
mov ecx, dword [ebp - 0x221c]
xor eax, eax
cmp ecx, edi
je 0x41a4ce
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2214]
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x221c], ecx
cmp eax, edi
je 0x41a502
mov edx, dword [ebp - 0x2224]
push edx
mov edx, ebx
lea esi, [ebp - 0x221c]
call fcn.00419810
mov edi, eax
test edi, edi
jne 0x41a7b3
mov esi, dword [ebp - 0x2220]
mov eax, ebx
mov ecx, esi
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
cmp word [ebx], 0x3d
jne 0x41a24d
push 0
lea eax, [ebp - 0x221c]
push eax
mov ecx, ebx
mov edx, esi
call fcn.00419a90
mov edi, eax
test edi, edi
jl 0x41a813
jmp 0x41a24d
cmp dword [ebp + 0x14], edi
jne 0x41a667
mov edx, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2214]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [ebp - 0x2214], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x41a599
mov ecx, dword [ebp - 0x221c]
xor eax, eax
cmp ecx, edi
je 0x41a587
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2214]
mov dword [ebp - 0x2218], edi
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x2214], eax
cmp eax, edi
je 0x41a5aa
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x210]
push 0x104
push edx
call fcn.004c2af7
push eax
call fcn.00410780
mov esi, dword [ebp - 0x2220]
add esp, 0x14
mov eax, ebx
mov ecx, esi
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
mov edi, ebx
mov ecx, esi
call fcn.00419e20
mov edi, eax
test edi, edi
jl 0x41a813
cmp word [ebx], 0x7b
jne 0x41a63d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x41a63d
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x221c]
push eax
push 0
push ecx
push ebx
mov ecx, esi
call fcn.0041a0d0
mov edi, eax
test edi, edi
jge 0x41a62a
cmp dword [ebp + 0x14], 0
je 0x41a813
mov eax, ebx
mov ecx, esi
call fcn.00419f50
mov edi, eax
test edi, edi
jl 0x41a813
mov ecx, dword [ebp - 0x2214]
mov eax, dword [ebp - 0x224c]
mov dword [ebp + 0x14], eax
cmp ecx, 2
je 0x41a6b7
test ecx, ecx
je 0x41a676
test eax, eax
jne 0x41a6b7
mov eax, ecx
call fcn.00419f10
mov edi, eax
jmp 0x41a813
mov dword [ebp - 0x2214], 2
jmp 0x41a5a3
mov esi, dword [ebp - 0x221c]
test eax, eax
je 0x41a6c6
mov ecx, esi
call fcn.00419ec0
test eax, eax
je 0x41a6c6
lea ebx, [ebp - 0x210]
call fcn.00419e80
test eax, eax
je 0x41a6b1
cmp dword [ebp - 0x2230], 0
je 0x41a6b1
mov edx, ebx
push edx
lea ecx, [ebp - 0x221c]
call fcn.0040fb30
mov ebx, dword [ebp - 0x2244]
cmp word [ebx], 0x7d
jne 0x41a134
jmp 0x41a813
mov ecx, esi
call fcn.00419ec0
mov dword [ebp - 0x2248], eax
xor eax, eax
mov dword [ebp - 0x2214], eax
test esi, esi
je 0x41a6f6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x221c], 0
mov dword [ebp - 0x2218], 0
test eax, eax
jne 0x41a7d8
cmp dword [ebp - 0x2230], eax
je 0x41a6b7
cmp dword [ebp - 0x2248], eax
jne 0x41a6b7
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x210]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2250], ecx
cmp eax, ecx
jne 0x41a801
lea esi, [ebp - 0x2254]
call fcn.0040fd10
jmp 0x41a6b7
lea esi, [ebp - 0x222c]
call fcn.0040fd10
lea esi, [ebp - 0x221c]
call fcn.0040fd10
mov eax, 0x80020009
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 0x10
lea esi, [ebp - 0x222c]
jmp 0x41a80e
lea esi, [ebp - 0x2240]
call fcn.0040fd10
lea esi, [ebp - 0x221c]
call fcn.0040fd10
jmp 0x41a824
call fcn.00419f10
lea esi, [ebp - 0x2238]
jmp 0x41a80c
lea esi, [ebp - 0x221c]
call fcn.0040fd10
mov eax, edi
call fcn.00419f10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 0x10
lea esi, [ebp - 0x221c]
call fcn.0040fd10
mov eax, dword [ebp - 0x2214]
call fcn.00419f10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 0x10
call fcn.00419f10
lea esi, [ebp - 0x2254]
mov edi, eax
call fcn.0040fd10
mov eax, dword [ebp - 0x221c]
test eax, eax
je 0x41a824
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret 0x10