Function at 0x3005931b
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009ac6e
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x428], ebx
mov edx, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x438], edx
call fcn.30058408
mov esi, eax
cmp esi, ebx
jl 0x300599b5
cmp word [edi], 0x7d
je 0x300599b3
mov edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x3004046c
push edi
mov dword [ebp - 0x424], 1
call esi
mov ebx, eax
neg ebx
push 0x300599e8
sbb ebx, ebx
push edi
add ebx, 1
call esi
test eax, eax
je 0x300593c0
test ebx, ebx
je 0x300594b1
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x300594b1
push 0x5c
push edi
mov dword [ebp - 0x430], esi
call fcn.3005836b
test eax, eax
jne 0x3005993f
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058560
test eax, eax
je 0x30059425
mov eax, dword [ebp - 0x434]
push edi
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x430], eax
call fcn.30058716
mov dword [ebp - 0x430], esi
cmp ebx, esi
je 0x300594b1
mov ebx, dword [ebp - 0x42c]
push edi
mov ecx, ebx
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x3005995c
push edi
mov ecx, ebx
call fcn.30058618
mov esi, eax
test esi, esi
jl 0x3005995c
cmp word [edi], 0x7b
jne 0x300594a2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x300594a2
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x428]
push 0
push eax
push ecx
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.3005931b
mov esi, eax
test esi, esi
jl 0x300599a2
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
cmp word [edi], 0x7d
je 0x300599a2
jmp 0x3005938b
push 0x300599d4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x300594dd
mov ecx, dword [ebp - 0x42c]
push edi
mov dword [ebp - 0x424], eax
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
mov ebx, dword [ebp - 0x434]
push 0x30059a00
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x300595f0
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp - 0x42c]
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
cmp word [edi], 0x3d
jne 0x3005994a
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x3005957c
mov edx, dword [ebp - 0x434]
push edi
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x424]
push ecx
mov ecx, dword [ebp - 0x42c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x424], edx
call fcn.30058fa2
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x424], ebx
jl 0x30059964
mov byte [ebp - 4], bl
jmp 0x30059457
cmp dword [ebp + 0x14], ebx
jne 0x300595db
cmp dword [ebp - 0x424], ebx
je 0x300595db
mov edx, dword [ebp - 0x434]
push 0x20006
push ebx
push edx
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], ebx
call fcn.3005804f
cmp eax, ebx
jne 0x3005998f
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x300595d0
cmp eax, 2
jne 0x3005998f
cmp esi, ebx
je 0x300595db
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058618
mov esi, eax
cmp esi, ebx
jmp 0x3005949c
push 0x5c
push edi
call fcn.3005836b
test eax, eax
jne 0x3005994a
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x30059739
lea ecx, [ebp - 0x424]
push ecx
push 0x2001f
push esi
push edi
push ebx
mov dword [ebp - 0x424], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x30059652
mov ecx, dword [ebp - 0x428]
xor eax, eax
cmp ecx, esi
je 0x3005963d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov esi, dword [ebp - 0x424]
mov dword [ebp - 0x428], esi
jne 0x30059658
jmp 0x300596f5
mov esi, dword [ebp - 0x428]
lea edx, [ebp - 0x424]
push edx
push 0x20019
push 0
push edi
push ebx
mov dword [ebp - 0x424], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x30059697
test esi, esi
je 0x30059687
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov esi, dword [ebp - 0x424]
mov dword [ebp - 0x428], esi
je 0x300596f5
mov edx, dword [ebp - 0x434]
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x424]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push edx
mov dword [ebp - 0x424], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x3005997c
test esi, esi
je 0x300596df
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [ebp - 0x424]
mov ebx, eax
mov dword [ebp - 0x428], ecx
jne 0x3005997c
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
cmp word [edi], 0x3d
jne 0x30059457
mov ecx, dword [ebp - 0x42c]
push edi
push 0
lea edx, [ebp - 0x428]
push edx
call fcn.30058fa2
mov esi, eax
test esi, esi
jge 0x30059457
jmp 0x300599a2
cmp dword [ebp + 0x14], esi
jne 0x3005985b
lea eax, [ebp - 0x430]
push eax
push 0x20019
push esi
push edi
push ebx
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x30059780
mov ecx, dword [ebp - 0x428]
xor eax, eax
cmp ecx, esi
je 0x30059774
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x430]
mov dword [ebp - 0x428], ecx
cmp eax, esi
mov dword [ebp - 0x430], eax
je 0x30059791
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x218]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
push eax
call fcn.30057e78
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058618
mov esi, eax
test esi, esi
jl 0x300599a2
cmp word [edi], 0x7b
jne 0x3005982a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x3005982a
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x42c]
push ebx
push 0
push eax
push edi
call fcn.3005931b
mov esi, eax
test esi, esi
jge 0x30059814
test ebx, ebx
je 0x300599a2
mov ecx, dword [ebp - 0x42c]
push edi
call fcn.30058408
mov esi, eax
test esi, esi
jl 0x300599a2
mov eax, dword [ebp - 0x430]
cmp eax, 2
mov ecx, dword [ebp - 0x438]
mov dword [ebp + 0x14], ecx
je 0x300594a2
test eax, eax
je 0x3005986a
test ecx, ecx
jne 0x300594a2
push eax
call fcn.30057f4e
mov esi, eax
jmp 0x300599a2
mov dword [ebp - 0x430], 2
jmp 0x3005978a
test ecx, ecx
mov ebx, dword [ebp - 0x428]
je 0x300598c2
mov ecx, dword [ebp - 0x42c]
push ebx
call fcn.300585d0
test eax, eax
je 0x300598c2
mov ecx, dword [ebp - 0x42c]
lea edx, [ebp - 0x218]
push edx
call fcn.30058560
test eax, eax
je 0x300594a2
cmp dword [ebp - 0x424], 0
je 0x300594a2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.30058716
jmp 0x300594a2
mov ecx, dword [ebp - 0x42c]
push ebx
call fcn.300585d0
test ebx, ebx
mov dword [ebp - 0x430], eax
je 0x300598f3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x428], 0
jne 0x3005997c
cmp dword [ebp - 0x424], 0
je 0x300594a2
cmp dword [ebp - 0x430], 0
jne 0x300594a2
mov edx, dword [ebp - 0x434]
lea ecx, [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov dword [ebp - 0x424], 0
jne 0x3005998f
lea ecx, [ebp - 0x424]
call fcn.3008b289
jmp 0x300594a2
lea ecx, [ebp - 0x430]
call fcn.3008b289
lea ecx, [ebp - 0x428]
call fcn.3008b289
mov eax, 0x80020009
jmp 0x300599b5
lea ecx, [ebp - 0x430]
jmp 0x3005999d
lea ecx, [ebp - 0x424]
call fcn.3008b289
lea ecx, [ebp - 0x428]
call fcn.3008b289
jmp 0x300599b3
lea ecx, [ebp - 0x428]
call fcn.3008b289
push ebx
call fcn.30057f4e
jmp 0x300599b5
push eax
call fcn.30057f4e
mov esi, eax
lea ecx, [ebp - 0x424]
call fcn.3008b289
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x300599b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 0x10