Function at 0x4070ce
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ffb6
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.004fc700
mov eax, dword [0x6a34f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], ecx
xor ecx, ecx
mov dword [ebp - 0x2244], ecx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
push 0x7d
pop eax
cmp word [edi], ax
je 0x4076b2
xor eax, eax
inc eax
push str.Delete
push edi
mov dword [ebp - 0x2230], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x68ffd4
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x407181
test ebx, ebx
je 0x407245
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x407247
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.0040654c
test eax, eax
jne 0x4076a2
push edi
call fcn.00406bc1
test eax, eax
je 0x4071fa
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x223c]
push edi
mov dword [ebp - 0x223c], eax
call fcn.00405f47
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
test ebx, ebx
je 0x407238
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x40769a
push edi
mov ecx, ebx
call fcn.00406c25
lea ecx, [ebp - 0x223c]
mov esi, eax
call fcn.00405e39
test esi, esi
js 0x4076b2
jmp 0x407634
lea ecx, [ebp - 0x223c]
call fcn.00405e39
jmp 0x407247
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x221c]
test eax, eax
jne 0x407275
push edi
mov ecx, ebx
mov dword [ebp - 0x2230], esi
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
push 0x68ffcc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4073a6
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
push edi
mov ecx, ebx
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
push 0x3d
pop eax
cmp word [edi], ax
jne 0x4076ad
cmp dword [ebp + 0x10], 0
je 0x40732c
mov eax, dword [ebp - 0x2220]
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov ecx, ebx
mov dword [ebp - 0x2250], eax
xor eax, eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2250]
push eax
call fcn.0040671a
mov esi, eax
lea ecx, [ebp - 0x2250]
xor eax, eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
test esi, esi
js 0x4076ea
mov byte [ebp - 4], al
call fcn.00405e39
jmp 0x407634
cmp dword [ebp + 0x14], 0
jne 0x407399
cmp dword [ebp - 0x2230], 0
je 0x407399
xor eax, eax
lea ecx, [ebp - 0x225c]
push 0x20006
push eax
push dword [ebp - 0x2220]
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
call fcn.00405eeb
test eax, eax
jne 0x4076db
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x225c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40738e
cmp eax, 2
jne 0x4076db
lea ecx, [ebp - 0x225c]
call fcn.00405e39
push edi
mov ecx, ebx
call fcn.00406c25
jmp 0x407683
push 0x5c
pop edx
mov ecx, edi
call fcn.0040654c
test eax, eax
jne 0x4076ad
cmp dword [ebp + 0x10], eax
je 0x407442
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
push 0x2001f
push edi
push esi
call fcn.00405eeb
test eax, eax
je 0x40740b
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.00405eeb
test eax, eax
je 0x40740b
sub esp, 0x14
lea ecx, [ebp - 0x222c]
push edi
push esi
call fcn.00405e53
test eax, eax
jne 0x407700
push edi
mov ecx, ebx
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
push 0x3d
pop eax
cmp word [edi], ax
jne 0x407634
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x222c]
push eax
call fcn.0040671a
mov esi, eax
jmp 0x40722b
cmp dword [ebp + 0x14], 0
jne 0x407463
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
call fcn.00405eeb
mov ebx, eax
jmp 0x407466
push 2
pop ebx
mov eax, dword [ebp + 0x14]
test ebx, ebx
push 1
pop ecx
push 0xffffffffffffffff
cmovne eax, ecx
push edi
mov dword [ebp - 0x2240], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0051b002
push eax
call fcn.00405adc
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00406c25
mov esi, eax
test esi, esi
js 0x4076b2
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40752b
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2244]
jne 0x4074cd
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x40752b
push dword [ebp - 0x2240]
mov ecx, dword [ebp - 0x221c]
xor eax, eax
push eax
push dword [ebp - 0x222c]
push edi
call fcn.004070ce
mov esi, eax
test esi, esi
jns 0x407515
cmp dword [ebp - 0x2240], 0
je 0x4076b2
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
cmp ebx, 2
je 0x407689
test ebx, ebx
je 0x407550
cmp dword [ebp + 0x14], 0
jne 0x407689
mov ecx, ebx
call fcn.00405b7f
mov esi, eax
jmp 0x4076b2
cmp dword [ebp + 0x14], 0
je 0x40759d
push dword [ebp - 0x222c]
call fcn.00406bf0
test eax, eax
je 0x40759d
lea eax, [ebp - 0x218]
push eax
call fcn.00406bc1
test eax, eax
je 0x407689
cmp dword [ebp - 0x2230], 0
je 0x407689
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x222c]
call fcn.00405f47
jmp 0x407689
push dword [ebp - 0x222c]
call fcn.00406bf0
mov ecx, dword [ebp - 0x222c]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x4075c5
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x222c], ecx
xor ecx, ecx
mov dword [ebp - 0x2228], ecx
test eax, eax
jne 0x407700
cmp dword [ebp - 0x2230], ecx
je 0x407689
test ebx, ebx
jne 0x407689
mov eax, dword [ebp - 0x2220]
mov dword [ebp - 0x2268], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2264], ecx
mov dword [ebp - 0x2260], ecx
lea ecx, [ebp - 0x2268]
push eax
call fcn.00405dc0
xor ecx, ecx
mov dword [ebp - 0x2268], ecx
test eax, eax
jne 0x4076f1
lea ecx, [ebp - 0x2268]
call fcn.00405e39
mov ebx, dword [ebp - 0x221c]
cmp dword [ebp + 0x10], 0
je 0x407689
push 0x7b
pop eax
cmp word [edi], ax
jne 0x407689
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2244]
jne 0x407647
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x40768c
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x222c]
push edi
call fcn.004070ce
mov esi, eax
test esi, esi
js 0x4076b2
push edi
mov ecx, ebx
call fcn.004065d0
mov esi, eax
test esi, esi
js 0x4076b2
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [edi], cx
jne 0x407152
jmp 0x4076b2
lea ecx, [ebp - 0x223c]
jmp 0x4076ea
lea ecx, [ebp - 0x223c]
call fcn.00405e39
mov esi, 0x80020009
lea ecx, [ebp - 0x222c]
call fcn.00405e39
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fbae6
leave
ret 0x10
mov ecx, eax
call fcn.00405b7f
lea ecx, [ebp - 0x225c]
mov esi, eax
call fcn.00405e39
jmp 0x4076b2
mov ecx, eax
call fcn.00405b7f
lea ecx, [ebp - 0x2268]
jmp 0x4076e8
mov ecx, eax
jmp 0x407544