Function at 0x43d669
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472b0e
mov eax, dword fs:[0]
push eax
mov eax, 0x104c
call fcn.00463310
mov eax, dword [0x4a0590]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea eax, [ebp - 0x1038]
mov dword [ebp - 0x1050], ecx
mov dword [ebp - 0x1054], esi
mov dword [ebp - 0x1058], edi
mov byte [ebp - 0x103c], bl
call fcn.0043bdc9
mov dword [ebp - 0x1018], ebx
mov byte [ebp - 0x1014], bl
lea eax, [ebp - 0x104c]
push eax
push 0xf003f
push ebx
push edi
mov dword [ebp - 4], ebx
push dword [esi]
mov byte [ebp - 0x103d], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43d89f
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
push dword [ebp - 0x104c]
mov esi, 0x800
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 0x1048], esi
call edi
jmp 0x43d7b4
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1050]
mov byte [ebp - 0x103c], bl
lea ebx, [ebp - 0x103c]
call fcn.0043d8dd
xor ebx, ebx
cmp byte [ebp - 0x103c], bl
je 0x43d769
cmp byte [ebp - 0x1014], bl
je 0x43d769
mov byte [ebp - 0x103d], 1
jmp 0x43d786
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x104c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x43d786
dec dword [ebp - 0x1044]
inc dword [ebp - 0x1044]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1044]
mov dword [ebp - 0x1048], esi
push dword [ebp - 0x104c]
call edi
xor ebx, ebx
test eax, eax
je 0x43d730
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
push dword [ebp - 0x104c]
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 0x1048], esi
call edi
jmp 0x43d87d
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1050]
mov byte [ebp - 0x103c], bl
lea ebx, [ebp - 0x103c]
call fcn.0043d8dd
xor ebx, ebx
cmp byte [ebp - 0x103c], bl
je 0x43d81e
cmp byte [ebp - 0x1014], bl
jne 0x43d848
mov ecx, dword [ebp - 0x1050]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x104c]
push eax
call fcn.0043d669
cmp eax, ebx
jne 0x43d843
dec dword [ebp - 0x1044]
jmp 0x43d84f
cmp eax, 0xffffffff
jne 0x43d84f
mov byte [ebp - 0x103d], 1
inc dword [ebp - 0x1044]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1044]
mov dword [ebp - 0x1048], esi
push dword [ebp - 0x104c]
call edi
xor ebx, ebx
test eax, eax
je 0x43d7ee
push dword [ebp - 0x104c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x103d], bl
jne 0x43d8b1
mov esi, dword [ebp - 0x1054]
push dword [ebp - 0x1058]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x43d8b4
or esi, 0xffffffff
lea eax, [ebp - 0x1038]
call fcn.0043b39a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453655
leave
ret 8