Function at 0x43aa70
Capabilities:
Delete registry value

Disassembly:
push 0x268
mov eax, 0x446e26
call fcn.00443eac
mov eax, ecx
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x244], esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x248], ecx
mov ecx, eax
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x240], 1
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b066
jmp 0x43b155
push 0x4027e8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4027bc
sbb edi, edi
inc edi
push ebx
mov dword [ebp - 0x238], edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43ab1b
test edi, edi
je 0x43abd1
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
cmp dword [ebp + 0x10], 0
je 0x43abd1
xor eax, eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
push 0x5c
pop edx
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00439f5a
test eax, eax
jne 0x43b050
push ebx
call fcn.0043a6b0
test eax, eax
je 0x43ab8f
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x258]
push ebx
mov dword [ebp - 0x258], eax
call fcn.0043a6e1
xor eax, eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x238], 0
je 0x43abcd
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a8b3
mov edi, eax
test edi, edi
js 0x43b055
mov byte [ebp - 4], 1
jmp 0x43b0f2
mov byte [ebp - 4], 1
push 0x4027d4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43abfd
mov ecx, dword [ebp - 0x21c]
push ebx
mov dword [ebp - 0x240], eax
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
push 0x4027b4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43ad16
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x43b050
cmp dword [ebp + 0x10], 0
je 0x43ac99
mov eax, dword [ebp - 0x224]
xor ecx, ecx
push ecx
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x218]
push ebx
push eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], ecx
mov ecx, dword [ebp - 0x21c]
push eax
call fcn.0043a0bd
mov edi, eax
xor eax, eax
mov dword [ebp - 0x264], eax
jmp 0x43b0ea
cmp dword [ebp + 0x14], 0
jne 0x43ad05
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0x20006
push ecx
push ecx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x43b18d
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
push ecx
push eax
mov dword [ebp - 0x238], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x43acf4
cmp edi, 2
jne 0x43b166
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x43ad05
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a8b3
jmp 0x43b14b
push 0x5c
pop edx
mov ecx, ebx
call fcn.00439f5a
test eax, eax
jne 0x43b050
cmp dword [ebp + 0x10], eax
je 0x43ae8f
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0xf003f
push ecx
push ebx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ad82
mov ecx, eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x43ad6c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x234], edi
test ecx, ecx
je 0x43ae20
jmp 0x43ad88
mov edi, dword [ebp - 0x234]
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0x20019
push ecx
push ebx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43adc9
test edi, edi
je 0x43adb9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x234], edi
test eax, eax
je 0x43ae20
lea eax, [ebp - 0x274]
xor ecx, ecx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], ecx
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43b050
mov ecx, eax
test edi, edi
je 0x43ae0c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x234], eax
test ecx, ecx
jne 0x43b050
xor eax, eax
mov byte [ebp - 0x23c], al
movzx eax, word [ebx]
cmp eax, 0x4c
je 0x43ae35
cmp eax, 0x6c
jne 0x43ae4c
push 0x411444
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43ae4c
mov byte [ebp - 0x23c], 1
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x43b0f2
push dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push ebx
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0043a0bd
jmp 0x43b0e8
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x43aee7
lea eax, [ebp - 0x220]
xor ecx, ecx
push eax
push 0x20019
push ecx
push ebx
push dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43aee1
mov ecx, eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x43aed1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x234], eax
test ecx, ecx
je 0x43aee7
xor edi, edi
inc edi
mov dword [ebp + 0x14], edi
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x43af3e
mov ecx, 0x208
call fcn.0043a58d
test al, al
je 0x43af13
mov eax, 0x208
call fcn.00444450
mov eax, esp
mov dword [ebp - 0x228], esp
jmp 0x43af36
push 0x210
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
test eax, eax
je 0x43af30
mov dword [eax], esi
mov esi, eax
mov dword [ebp - 0x244], esi
add eax, 8
mov dword [ebp - 0x228], eax
test eax, eax
je 0x43b1a1
push 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test edi, edi
jne 0x43af6d
mov edi, dword [ebp - 0x234]
push edi
call fcn.0043a679
test eax, eax
jne 0x43af6d
push edi
call fcn.0043a5f0
test eax, eax
je 0x43b037
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a8b3
mov edi, eax
test edi, edi
js 0x43b055
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x43afe9
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push eax
push dword [ebp - 0x234]
push ebx
call fcn.0043aa70
mov edi, eax
test edi, edi
js 0x43b055
cmp dword [ebp + 0x14], 0
je 0x43aff3
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x21c]
push ebx
mov dword [ebp + 0x14], eax
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
jmp 0x43ad05
cmp dword [ebp + 0x14], 0
jne 0x43b155
push dword [ebp - 0x234]
call fcn.0043a679
test eax, eax
je 0x43b027
mov edi, dword [ebp - 0x228]
push edi
call fcn.0043a6b0
test eax, eax
je 0x43b13f
push edi
lea ecx, [ebp - 0x234]
call fcn.0043a6e1
jmp 0x43b13f
cmp dword [ebp + 0x14], 0
jne 0x43b155
mov edi, dword [ebp - 0x234]
test edi, edi
je 0x43b081
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0x234], edi
test eax, eax
je 0x43b083
mov edi, 0x80020009
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x43b066
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x244]
call fcn.00439f96
mov eax, edi
lea esp, [ebp - 0x284]
call fcn.00443e5b
ret 0x10
xor ecx, ecx
cmp dword [ebp - 0x240], 0
je 0x43b0c6
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x270]
mov edi, dword [ebp - 0x228]
mov byte [ebp - 4], 3
push edi
mov dword [ebp - 0x270], eax
call fcn.0043a81e
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a8b3
mov edi, eax
test edi, edi
js 0x43b055
cmp dword [ebp + 0x10], 0
je 0x43b155
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x43b155
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x24c]
jne 0x43b105
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x43b155
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x234]
push ebx
call fcn.0043aa70
mov edi, eax
test edi, edi
js 0x43b055
mov ecx, dword [ebp - 0x21c]
push ebx
call fcn.0043a929
mov edi, eax
test edi, edi
js 0x43b055
push 0x7d
pop eax
cmp word [ebx], ax
jne 0x43aaec
jmp 0x43b055
test edi, edi
jle 0x43b173
movzx edi, di
or edi, 0x80070000
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x43b055
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43b055
jle 0x43b055
movzx edi, di
or edi, 0x80070000
jmp 0x43b055
mov edi, 0x8007000e
jmp 0x43b055