Function at 0x4239de
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x43eba8
call fcn.004036d1
sub esp, 0x21c
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
and dword [ebp - 0x18], 0
push esi
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x20], eax
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e53
push ebx
jmp 0x423e1a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x423e7c
push edi
mov dword [ebp - 0x1c], 1
call esi
mov ebx, eax
neg ebx
push 0x423e90
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x423a55
test ebx, ebx
je 0x423adb
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e52
cmp dword [ebp + 0x10], 0
je 0x423adb
and dword [ebp + 8], 0
mov byte [ebp - 4], 1
push 0x5c
push edi
call fcn.00420afd
test eax, eax
jne 0x423e25
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420c44
test eax, eax
je 0x423aa6
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.00421d18
and dword [ebp + 8], 0
test ebx, ebx
je 0x423acf
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e46
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420d4b
mov esi, eax
test esi, esi
jmp 0x423b79
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00420652
push 0x423e84
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x423b01
mov ecx, dword [ebp - 0x14]
and dword [ebp - 0x1c], eax
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e52
push 0x423e9c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x423be9
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x228]
push eax
call fcn.00420b63
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x423e52
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
cmp esi, ebx
jl 0x423e52
cmp byte [edi], 0x3d
jne 0x423e31
cmp dword [ebp + 0x10], ebx
je 0x423b84
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 8], eax
push edi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004236a1
mov esi, eax
mov dword [ebp + 8], ebx
cmp esi, ebx
jl 0x423e46
jmp 0x423dd1
cmp dword [ebp + 0x14], ebx
jne 0x423bd7
cmp dword [ebp - 0x1c], ebx
je 0x423bd7
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 3
push 0x20006
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.004206b7
cmp eax, ebx
jne 0x423e3e
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x423bcb
cmp eax, 2
jne 0x423e3e
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00420652
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420d4b
mov esi, eax
cmp esi, ebx
jmp 0x423e18
push 0x5c
push edi
call fcn.00420afd
test eax, eax
jne 0x423e31
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x423c84
mov esi, 0x2001f
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.004206b7
xor ebx, ebx
cmp eax, ebx
je 0x423c4a
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.004206b7
cmp eax, ebx
je 0x423c4a
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.00420669
cmp eax, ebx
jne 0x423e38
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e52
cmp byte [edi], 0x3d
jne 0x423ddd
mov ecx, dword [ebp - 0x14]
push edi
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004236a1
mov esi, eax
test esi, esi
jl 0x423e52
jmp 0x423ddd
cmp dword [ebp + 0x14], esi
jne 0x423c9f
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.004206b7
mov dword [ebp + 8], eax
jmp 0x423ca6
mov dword [ebp + 8], 2
cmp dword [ebp + 8], esi
je 0x423cb2
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e52
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420d4b
mov esi, eax
test esi, esi
jl 0x423e52
cmp byte [edi], 0x7b
jne 0x423d24
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push edi
call fcn.004239de
mov esi, eax
test esi, esi
jge 0x423d11
cmp dword [ebp + 0x14], 0
je 0x423e52
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e52
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x14], eax
je 0x423e1a
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x423d52
cmp eax, ebx
jne 0x423e1a
push dword [ebp + 8]
call fcn.004205a7
mov esi, eax
jmp 0x423e52
cmp eax, ebx
je 0x423d9a
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
call fcn.00420d16
test eax, eax
je 0x423d9a
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x124]
push eax
call fcn.00420c44
test eax, eax
je 0x423e1a
cmp dword [ebp - 0x1c], 0
je 0x423e1a
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x18]
call fcn.00421d18
jmp 0x423e1a
lea ecx, [ebp - 0x18]
call fcn.00420652
cmp eax, ebx
jne 0x423e38
cmp dword [ebp - 0x1c], ebx
je 0x423e1a
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x124]
push ecx
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
mov dword [ebp + 8], ebx
jne 0x423e3e
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00420652
cmp dword [ebp + 0x10], 0
je 0x423e1a
cmp byte [edi], 0x7b
jne 0x423e1a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x423e1a
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push edi
call fcn.004239de
mov esi, eax
test esi, esi
jl 0x423e52
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00420b63
mov esi, eax
test esi, esi
jl 0x423e52
cmp byte [edi], 0x7d
jne 0x423a25
jmp 0x423e52
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00420652
mov esi, 0x80020009
jmp 0x423e52
push eax
jmp 0x423d46
push eax
call fcn.004205a7
mov esi, eax
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00420652
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00420652
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
mov eax, esi
pop esi
call fcn.004037c0
leave
ret 0x10