Function at 0x416a73
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b141
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00438850
mov eax, dword [0x448008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2258], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2254]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x225c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x226c], eax
mov dword [ebp - 0x2254], edi
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
push ebx
mov dword [ebp - 4], eax
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417083
jmp 0x41702f
push str.Delete
push ebx
mov dword [ebp - 0x2260], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x416b29
test edi, edi
je 0x416bdf
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x416be1
push 0x5c
pop edx
mov ecx, ebx
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x221c], esi
call fcn.00415eca
test eax, eax
jne 0x41706d
push ebx
call fcn.004165f3
test eax, eax
je 0x416b9c
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2224]
push ebx
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], esi
call fcn.004166fc
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x221c], esi
test edi, edi
je 0x416bd7
mov edi, dword [ebp - 0x2258]
mov ecx, edi
push ebx
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
push ebx
mov ecx, edi
call fcn.00416587
mov esi, eax
test esi, esi
js 0x417072
xor eax, eax
mov dword [ebp - 0x2220], eax
jmp 0x416e02
mov dword [ebp - 0x2220], esi
jmp 0x416be1
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [ebp - 0x2258]
test eax, eax
jne 0x416c0f
push ebx
mov ecx, edi
mov dword [ebp - 0x2260], esi
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
push 0x4434dc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416d67
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
push ebx
mov ecx, edi
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x41706d
cmp dword [ebp + 0x10], 0
je 0x416cd0
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
mov edi, dword [ebp - 0x2258]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00416149
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
test esi, esi
js 0x417072
mov byte [ebp - 4], al
mov dword [ebp - 0x222c], eax
jmp 0x416e02
cmp dword [ebp + 0x14], 0
jne 0x416d50
cmp dword [ebp - 0x2260], 0
je 0x416d50
xor esi, esi
lea ecx, [ebp - 0x223c]
push 0x20006
push esi
push dword [ebp - 0x225c]
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.00416685
test eax, eax
jne 0x41704d
mov edi, dword [ebp - 0x223c]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x416d33
cmp eax, 2
jne 0x41703d
test edi, edi
je 0x416d44
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x223c], esi
mov edi, dword [ebp - 0x2258]
mov dword [ebp - 0x2238], esi
push ebx
mov ecx, edi
call fcn.00416587
mov esi, eax
test esi, esi
js 0x417072
jmp 0x41702f
push 0x5c
pop edx
mov ecx, ebx
call fcn.00415eca
test eax, eax
jne 0x41706d
cmp dword [ebp + 0x10], eax
je 0x416e5a
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
push 0x2001f
push ebx
push esi
call fcn.00416685
test eax, eax
je 0x416dcc
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x2254]
call fcn.00416685
test eax, eax
je 0x416dcc
sub esp, 0x14
lea ecx, [ebp - 0x2254]
push ebx
push esi
call fcn.00415f77
test eax, eax
jne 0x416f5d
push ebx
mov ecx, edi
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x416e02
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x2254]
push eax
call fcn.00416149
mov esi, eax
test esi, esi
js 0x417072
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x41702f
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x226c]
jne 0x416e13
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x41702f
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2254]
push ebx
call fcn.00416a73
mov esi, eax
test esi, esi
js 0x417072
push ebx
mov ecx, edi
call fcn.00416914
jmp 0x416d58
cmp dword [ebp + 0x14], 0
jne 0x416e79
push 0x20019
push ebx
push dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
call fcn.00416685
jmp 0x416e7c
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x2264], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push ebx
cmove ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp - 0x2268], ecx
call fcn.0042c187
push eax
call fcn.00403606
add esp, 0x14
mov ecx, edi
push ebx
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
push ebx
mov ecx, edi
call fcn.00416587
mov esi, eax
test esi, esi
js 0x417072
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x416f3a
mov ecx, ebx
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x416ee1
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x416f3a
push dword [ebp - 0x2268]
mov ecx, dword [ebp - 0x2258]
push edi
mov edi, dword [ebp - 0x2254]
push edi
push ebx
call fcn.00416a73
mov esi, eax
test esi, esi
jns 0x416f22
cmp dword [ebp - 0x2268], 0
je 0x417072
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.00416914
mov esi, eax
test esi, esi
js 0x417072
jmp 0x416f40
mov edi, dword [ebp - 0x2254]
mov eax, dword [ebp - 0x2264]
cmp eax, 2
je 0x41702f
test eax, eax
je 0x416f6b
cmp dword [ebp + 0x14], 0
jne 0x41702f
mov ecx, eax
call fcn.00416906
mov esi, eax
jmp 0x417072
cmp dword [ebp + 0x14], 0
je 0x416fb0
push edi
call fcn.004167d1
test eax, eax
je 0x416fb0
lea eax, [ebp - 0x218]
push eax
call fcn.004165f3
test eax, eax
je 0x41702f
cmp dword [ebp - 0x2260], 0
je 0x41702f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2254]
call fcn.004166fc
jmp 0x41702f
push edi
call fcn.004167d1
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2264], ecx
test edi, edi
je 0x416fdb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2264]
xor edi, edi
mov dword [ebp - 0x2254], edi
jmp 0x416fdd
xor edi, edi
mov dword [ebp - 0x2250], edi
test eax, eax
jne 0x416f5d
cmp dword [ebp - 0x2260], eax
je 0x41702f
test ecx, ecx
jne 0x41702f
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x2248], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2244], edi
mov dword [ebp - 0x2240], edi
call fcn.0041688d
mov dword [ebp - 0x2248], edi
test eax, eax
jne 0x416f5d
push 0x7d
pop eax
cmp word [ebx], ax
jne 0x416af6
jmp 0x417072
mov ecx, eax
call fcn.00416906
mov esi, eax
test edi, edi
je 0x417072
push edi
jmp 0x417065
mov ecx, eax
call fcn.00416906
cmp dword [ebp - 0x223c], 0
mov esi, eax
je 0x417072
push dword [ebp - 0x223c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417072
mov esi, 0x80020009
mov eax, dword [ebp - 0x2254]
test eax, eax
je 0x417083
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004219ad
leave
ret 0x10