Function at 0x516de0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x224c
call fcn.0053b8f0
push esi
mov eax, ecx
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
mov ecx, eax
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x5173ad
cmp word [edi], 0x7d
push ebx
je 0x51739c
nop
push 0x594b38
push edi
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x594b0c
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x516e60
test ebx, ebx
je 0x516f4e
mov ecx, dword [ebp - 4]
push edi
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
cmp dword [ebp + 0x10], 0
je 0x516f4e
movzx eax, word [edi]
mov ecx, edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ax, ax
je 0x516ec1
lea esp, [esp]
cmp ax, 0x5c
je 0x516eb9
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
jne 0x516ea0
jmp 0x516ec1
test ecx, ecx
jne 0x517344
mov esi, 0x594764
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x516f10
add esi, 4
cmp esi, 0x594794
jl 0x516ec6
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.00516a10
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ebx, ebx
je 0x516f47
mov ebx, dword [ebp - 4]
mov ecx, ebx
push edi
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x517353
push edi
mov ecx, ebx
call fcn.005178e0
mov esi, eax
test esi, esi
js 0x517353
mov dword [ebp - 0x18], 0
jmp 0x517153
mov dword [ebp - 0x18], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 4]
test eax, eax
jne 0x516f76
push edi
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
push 0x594b04
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x51709f
lea eax, [ebp - 0x224c]
mov ecx, ebx
push eax
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
push edi
mov ecx, ebx
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
cmp word [edi], 0x3d
jne 0x51734c
cmp dword [ebp + 0x10], 0
je 0x517016
mov eax, dword [ebp + 0xc]
mov ecx, ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x224c]
push edi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 0
call fcn.005154d0
mov esi, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
test esi, esi
js 0x51735d
mov dword [ebp - 0x24], 0
jmp 0x517153
cmp dword [ebp + 0x14], 0
jne 0x517088
cmp dword [ebp + 8], 0
je 0x517088
push 0x20006
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call fcn.0044ff5b
test eax, eax
jne 0x517367
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x224c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x51706f
cmp eax, 2
jne 0x517367
test esi, esi
je 0x517081
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push edi
mov ecx, ebx
call fcn.005178e0
mov esi, eax
test esi, esi
js 0x51739c
jmp 0x517338
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x5170d1
lea esp, [esp]
cmp ax, 0x5c
je 0x5170c9
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
jne 0x5170b0
jmp 0x5170d1
test ecx, ecx
jne 0x51734c
cmp dword [ebp + 0x10], 0
je 0x5171ab
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0x2001f
push edi
push esi
call fcn.0044ff5b
test eax, eax
je 0x517123
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x10]
call fcn.0044ff5b
test eax, eax
je 0x517123
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push esi
lea ecx, [ebp - 0x10]
call fcn.00461bd9
test eax, eax
jne 0x517391
push edi
mov ecx, ebx
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
cmp word [edi], 0x3d
jne 0x517153
push edi
push 0
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.005154d0
mov esi, eax
test esi, esi
js 0x51739c
cmp word [edi], 0x7b
jne 0x517338
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x517162
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x517338
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x10]
push edi
call fcn.00516de0
mov esi, eax
test esi, esi
js 0x51739c
push edi
mov ecx, ebx
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
jmp 0x517338
cmp dword [ebp + 0x14], 0
jne 0x5171ca
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0044ff5b
mov ebx, eax
test ebx, ebx
jne 0x5171cf
jmp 0x5171d6
mov ebx, 2
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x24c]
push 0x104
push eax
call fcn.0053b832
push eax
call fcn.0041ca8c
mov ecx, dword [ebp - 4]
add esp, 0x14
push edi
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
mov ecx, dword [ebp - 4]
push edi
call fcn.005178e0
mov esi, eax
test esi, esi
js 0x51739c
cmp word [edi], 0x7b
jne 0x51726c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x517224
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x51726c
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 0x10]
push edi
call fcn.00516de0
mov esi, eax
test esi, esi
jns 0x517259
cmp dword [ebp + 0x14], 0
je 0x51739c
mov ecx, dword [ebp - 4]
push edi
call fcn.005164b0
mov esi, eax
test esi, esi
js 0x51739c
mov eax, dword [ebp - 0x44]
mov dword [ebp + 0x14], eax
cmp ebx, 2
je 0x517338
test ebx, ebx
je 0x51728d
test eax, eax
jne 0x517338
push ebx
jmp 0x517392
mov ebx, dword [ebp - 4]
test eax, eax
je 0x5172cf
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00516120
test eax, eax
je 0x5172cf
lea eax, [ebp - 0x24c]
mov ecx, ebx
push eax
call fcn.00515be0
test eax, eax
je 0x517338
cmp dword [ebp + 8], 0
je 0x517338
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00516a10
jmp 0x517338
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00516120
mov ecx, dword [ebp - 0x10]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x5172f0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
test eax, eax
jne 0x517391
cmp dword [ebp + 8], eax
je 0x517338
test ebx, ebx
jne 0x517338
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.00515d70
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
test eax, eax
jne 0x51737c
lea ecx, [ebp - 0x34]
call fcn.0044ffcc
cmp word [edi], 0x7d
jne 0x516e30
jmp 0x51739c
lea ecx, [ebp - 0x1c]
call fcn.0044ffcc
mov esi, 0x80020009
jmp 0x51739c
lea ecx, [ebp - 0x1c]
call fcn.0044ffcc
jmp 0x51739c
lea ecx, [ebp - 0x28]
call fcn.0044ffcc
jmp 0x51739c
push eax
call fcn.00515b60
add esp, 4
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.0044ffcc
jmp 0x51739c
push eax
call fcn.00515b60
add esp, 4
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.0044ffcc
jmp 0x51739c
push eax
call fcn.00515b60
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x10]
pop ebx
test eax, eax
je 0x5173ab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10