Function at 0x412fbd
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x41b040]
and dword [ebp - 0x6c], 0
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1b0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1b8]
push ebx
mov ebx, dword [ebp + 0x1ac]
mov dword [ebp - 0x80], eax
push esi
mov eax, ebx
mov dword [ebp - 0x70], ecx
call fcn.00412eaa
mov esi, eax
test esi, esi
jge 0x41300b
jmp 0x413372
cmp byte [ebx], 0x7d
push edi
je 0x41336f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push ebx
mov dword [ebp - 0x74], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x413041
test edi, edi
je 0x4130b0
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
cmp dword [ebp + 0x1b4], 0
je 0x4130b0
push 0x5c
mov eax, ebx
call fcn.00412cb9
test eax, eax
pop ecx
jne 0x413446
push ebx
call fcn.004139f2
test eax, eax
je 0x413089
mov eax, dword [ebp - 0x78]
push ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
call fcn.00413a1e
test edi, edi
je 0x4130b0
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
mov ecx, dword [ebp - 0x70]
mov edi, ebx
call fcn.00413959
jmp 0x413286
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4130d7
and dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
push 0x418fd0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4131f3
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x68]
call fcn.00412eaa
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x413360
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
cmp esi, edi
jl 0x413360
cmp byte [ebx], 0x3d
jne 0x413409
cmp dword [ebp + 0x1b4], edi
je 0x413198
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x74]
call fcn.004134b2
mov esi, eax
cmp esi, edi
jl 0x41340e
cmp byte [ebx], 0x7b
jne 0x41318a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x41318a
mov ecx, dword [ebp - 0x70]
push 0
push dword [ebp + 0x1b4]
push dword [ebp - 0x6c]
push ebx
call fcn.00412fbd
mov esi, eax
test esi, esi
jl 0x413360
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
cmp byte [ebx], 0x7d
jne 0x413015
jmp 0x413360
cmp dword [ebp + 0x1b8], edi
jne 0x4131e7
cmp dword [ebp - 0x74], edi
je 0x4131e7
push 0x20006
push edi
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], edi
call fcn.00413926
cmp eax, edi
jne 0x413428
mov edi, dword [ebp - 0x74]
lea eax, [ebp - 0x68]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4131dc
cmp eax, 2
jne 0x413416
test edi, edi
je 0x4131e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x70]
mov edi, ebx
call fcn.00413959
jmp 0x413180
push 0x5c
mov eax, ebx
call fcn.00412cb9
test eax, eax
pop ecx
jne 0x413446
xor esi, esi
cmp dword [ebp + 0x1b4], esi
je 0x413295
push 0x2001f
push ebx
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
call fcn.00413926
test eax, eax
je 0x41325b
push 0x20019
push ebx
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
call fcn.00413926
test eax, eax
je 0x41325b
push esi
push 0x2001f
push esi
push esi
push ebx
push dword [ebp - 0x78]
xor edi, edi
lea eax, [ebp - 0x6c]
call fcn.00413469
cmp eax, esi
jne 0x413359
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
cmp byte [ebx], 0x3d
jne 0x413147
mov ecx, dword [ebp - 0x70]
push ebx
push 0
lea edx, [ebp - 0x6c]
call fcn.004134b2
mov esi, eax
test esi, esi
jl 0x413360
jmp 0x413147
cmp dword [ebp + 0x1b8], esi
jne 0x4132b3
push 0x20019
push ebx
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
call fcn.00413926
mov dword [ebp - 0x7c], eax
jmp 0x4132ba
mov dword [ebp - 0x7c], 2
cmp dword [ebp - 0x7c], esi
je 0x4132c9
mov dword [ebp + 0x1b8], 1
push 0x104
push ebx
lea eax, [ebp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
mov ecx, dword [ebp - 0x70]
mov edi, ebx
call fcn.00413959
mov esi, eax
test esi, esi
jl 0x413360
cmp byte [ebx], 0x7b
jne 0x413334
push dword [ebp + 0x1b8]
mov ecx, dword [ebp - 0x70]
push 0
push dword [ebp - 0x6c]
push ebx
call fcn.00412fbd
mov esi, eax
test esi, esi
jge 0x413324
cmp dword [ebp + 0x1b8], 0
je 0x413360
mov ecx, dword [ebp - 0x70]
mov eax, ebx
call fcn.00412eaa
mov esi, eax
test esi, esi
jl 0x413360
cmp dword [ebp - 0x7c], 2
mov eax, dword [ebp - 0x80]
mov dword [ebp + 0x1b8], eax
je 0x41318a
mov eax, dword [ebp - 0x7c]
xor edi, edi
cmp eax, edi
je 0x41338b
cmp dword [ebp - 0x80], edi
jne 0x41318a
call fcn.00413b1b
mov esi, eax
cmp dword [ebp - 0x6c], 0
je 0x41336f
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp + 0x1a0]
pop esi
xor ecx, ebp
pop ebx
call fcn.00415ea8
add ebp, 0x1a4
leave
ret 0x10
cmp dword [ebp - 0x80], edi
je 0x4133ce
push dword [ebp - 0x6c]
call fcn.004139bd
test eax, eax
je 0x4133ce
lea eax, [ebp + 0x9c]
push eax
call fcn.004139f2
test eax, eax
je 0x41318a
cmp dword [ebp - 0x74], 0
je 0x41318a
lea eax, [ebp + 0x9c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00413a1e
jmp 0x41318a
cmp dword [ebp - 0x6c], edi
je 0x4133e3
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov dword [ebp - 0x6c], edi
jne 0x41345f
cmp dword [ebp - 0x74], edi
je 0x41318a
lea eax, [ebp + 0x9c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x413359
jmp 0x41318a
cmp dword [ebp - 0x6c], edi
jmp 0x41344a
cmp dword [ebp - 0x6c], edi
jmp 0x413364
call fcn.00413b1b
test edi, edi
mov esi, eax
je 0x413360
push edi
jmp 0x41343b
call fcn.00413b1b
cmp dword [ebp - 0x74], edi
mov esi, eax
je 0x413360
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413360
cmp dword [ebp - 0x6c], 0
je 0x413455
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x413371
call fcn.00413b1b
jmp 0x413371