Function at 0x439de0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c2e6
mov eax, dword fs:[0]
push eax
mov eax, 0x2254
call fcn.00555e60
mov eax, dword [0x5eb6e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2224], ebx
mov dword [ebp - 0x2220], ebx
mov edx, dword [ebp + 0x14]
mov eax, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2244], edx
call fcn.00439c60
mov edi, eax
cmp edi, ebx
jl 0x43a514
cmp word [esi], 0x7d
je 0x43a512
lea esp, [esp]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push esi
mov dword [ebp - 0x2238], 1
call edi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push esi
inc ebx
call edi
test eax, eax
je 0x439e93
test ebx, ebx
je 0x439fda
mov ecx, dword [ebp - 0x2228]
mov eax, esi
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a4fc
xor edx, edx
cmp dword [ebp + 0x10], edx
je 0x439fda
movzx ecx, word [esi]
mov dword [ebp - 0x2234], edx
mov dword [ebp - 0x2230], edx
mov eax, esi
cmp cx, dx
je 0x439eef
mov edi, dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, cx
cmp cx, 0x5c
je 0x439ee7
push eax
call edi
movzx ecx, word [eax]
test cx, cx
jne 0x439ed4
jmp 0x439eef
test eax, eax
jne 0x43a478
mov edi, 0x5bbcd0
mov eax, dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x439f3b
add edi, 4
cmp edi, 0x5bbd00
jl 0x439ef4
mov ecx, dword [ebp - 0x222c]
mov dword [ebp - 0x2234], ecx
xor edi, edi
push esi
lea ecx, [ebp - 0x2234]
mov dword [ebp - 0x2230], edi
call fcn.00439960
mov dword [ebp - 0x2234], edi
mov dword [ebp - 0x2230], edi
jmp 0x439f3d
xor edi, edi
cmp ebx, edi
je 0x439fd4
mov ebx, dword [ebp - 0x2228]
mov eax, esi
mov ecx, ebx
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a495
mov edi, esi
mov ecx, ebx
call fcn.00439860
mov edi, eax
test edi, edi
jl 0x43a495
mov dword [ebp - 0x2230], 0
cmp word [esi], 0x7b
jne 0x439fc5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x439fc5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2224]
mov ebx, dword [ebp - 0x2228]
push 0
push eax
push ecx
push esi
mov ecx, ebx
call fcn.00439de0
mov edi, eax
test edi, edi
jl 0x43a4fc
mov eax, esi
mov ecx, ebx
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a4fc
cmp word [esi], 0x7d
jne 0x439e60
jmp 0x43a4fc
mov dword [ebp - 0x2230], edi
push str.NoRemove
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43a007
mov ecx, dword [ebp - 0x2228]
mov dword [ebp - 0x2238], eax
mov eax, esi
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a4fc
push 0x5baf24
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43a13a
mov ecx, dword [ebp - 0x2228]
lea eax, [ebp - 0x2218]
call fcn.00439c60
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl 0x43a4fc
mov ecx, dword [ebp - 0x2228]
mov eax, esi
call fcn.00439c60
mov edi, eax
cmp edi, ebx
jl 0x43a4fc
cmp word [esi], 0x3d
jne 0x43a483
cmp dword [ebp + 0x10], ebx
je 0x43a0b3
mov edx, dword [ebp - 0x222c]
lea eax, [ebp - 0x2218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x224c]
mov dword [ebp - 0x224c], edx
mov edx, dword [ebp - 0x2228]
push ecx
mov ecx, esi
mov dword [ebp - 0x2248], ebx
call fcn.00439460
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
jl 0x43a49d
mov byte [ebp - 4], bl
mov dword [ebp - 0x2248], ebx
jmp 0x439f7b
cmp dword [ebp + 0x14], ebx
jne 0x43a124
cmp dword [ebp - 0x2238], ebx
je 0x43a124
mov edx, dword [ebp - 0x222c]
push 0x20006
push ebx
push edx
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
call fcn.00439900
cmp eax, ebx
jne 0x43a4b5
mov edi, dword [ebp - 0x2240]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x43a10d
cmp eax, 2
jne 0x43a4b5
cmp edi, ebx
je 0x43a11e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
mov ecx, dword [ebp - 0x2228]
mov edi, esi
call fcn.00439860
mov edi, eax
cmp edi, ebx
jmp 0x439fbf
movzx ecx, word [esi]
mov eax, esi
test cx, cx
je 0x43a166
movzx ecx, cx
cmp cx, 0x5c
je 0x43a15e
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x43a147
jmp 0x43a166
test eax, eax
jne 0x43a483
cmp dword [ebp + 0x10], 0
je 0x43a281
mov edi, dword [ebp - 0x222c]
lea ecx, [ebp - 0x221c]
push ecx
push 0x2001f
push 0
push esi
push edi
mov dword [ebp - 0x221c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
cmp eax, ebx
jne 0x43a1c5
mov ecx, dword [ebp - 0x2224]
xor eax, eax
cmp ecx, ebx
je 0x43a1af
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x221c]
mov dword [ebp - 0x2224], edx
mov dword [ebp - 0x2220], ebx
cmp eax, ebx
je 0x43a23b
push 0x20019
push esi
push edi
lea ecx, [ebp - 0x2224]
call fcn.00439900
test eax, eax
je 0x43a23b
lea eax, [ebp - 0x225c]
push eax
lea ecx, [ebp - 0x221c]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push esi
push edi
mov dword [ebp - 0x221c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x43a4c2
mov ecx, dword [ebp - 0x2224]
test ecx, ecx
je 0x43a21b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x221c]
mov edi, eax
mov dword [ebp - 0x2224], edx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x43a4c2
mov ecx, dword [ebp - 0x2228]
mov eax, esi
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a4fc
cmp word [esi], 0x3d
jne 0x439f7b
mov edx, dword [ebp - 0x2228]
push 0
lea eax, [ebp - 0x2224]
push eax
mov ecx, esi
call fcn.00439460
mov edi, eax
test edi, edi
jl 0x43a4fc
jmp 0x439f7b
cmp dword [ebp + 0x14], 0
jne 0x43a377
mov ecx, dword [ebp - 0x222c]
push 0x20019
push esi
push ecx
lea ecx, [ebp - 0x2224]
call fcn.00439900
mov dword [ebp - 0x221c], eax
test eax, eax
je 0x43a2b4
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.00552c34
push eax
call fcn.004030c0
mov ebx, dword [ebp - 0x2228]
add esp, 0x14
mov eax, esi
mov ecx, ebx
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a4fc
mov edi, esi
mov ecx, ebx
call fcn.00439860
mov edi, eax
test edi, edi
jl 0x43a4fc
cmp word [esi], 0x7b
jne 0x43a347
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x43a347
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x2224]
push eax
push 0
push ecx
push esi
mov ecx, ebx
call fcn.00439de0
mov edi, eax
test edi, edi
jge 0x43a334
cmp dword [ebp + 0x14], 0
je 0x43a4fc
mov eax, esi
mov ecx, ebx
call fcn.00439c60
mov edi, eax
test edi, edi
jl 0x43a4fc
mov eax, dword [ebp - 0x221c]
mov edx, dword [ebp - 0x2244]
mov dword [ebp + 0x14], edx
cmp eax, 2
je 0x439fc5
test eax, eax
je 0x43a386
test edx, edx
jne 0x439fc5
call fcn.00439c20
mov edi, eax
jmp 0x43a4fc
mov dword [ebp - 0x221c], 2
jmp 0x43a2ad
mov ebx, dword [ebp - 0x2224]
test edx, edx
je 0x43a3ce
mov ecx, ebx
call fcn.00439b10
test eax, eax
je 0x43a3ce
lea ebx, [ebp - 0x218]
call fcn.004398c0
test eax, eax
je 0x439fc5
cmp dword [ebp - 0x2238], 0
je 0x439fc5
mov eax, ebx
push eax
lea ecx, [ebp - 0x2224]
call fcn.00439960
jmp 0x439fc5
mov ecx, ebx
call fcn.00439b10
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x221c], 0
test ebx, ebx
je 0x43a400
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x221c], eax
mov dword [ebp - 0x2224], 0
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2220], 0
test ebx, ebx
jne 0x43a4d6
cmp dword [ebp - 0x2238], ebx
je 0x439fc5
cmp dword [ebp - 0x2258], ebx
jne 0x439fc5
mov ecx, dword [ebp - 0x222c]
lea edx, [ebp - 0x218]
mov dword [ebp - 0x2254], ecx
push edx
lea ecx, [ebp - 0x2254]
mov dword [ebp - 0x2250], ebx
call fcn.00439bb0
mov dword [ebp - 0x2254], ebx
mov dword [ebp - 0x2250], ebx
cmp eax, ebx
jne 0x43a4ea
lea ecx, [ebp - 0x2254]
call fcn.00439b90
jmp 0x439fc5
lea ecx, [ebp - 0x2234]
call fcn.00439b90
lea ecx, [ebp - 0x2224]
call fcn.00439b90
mov eax, 0x80020009
jmp 0x43a514
lea ecx, [ebp - 0x2234]
jmp 0x43a4f7
lea ecx, [ebp - 0x224c]
call fcn.00439b90
lea ecx, [ebp - 0x2224]
call fcn.00439b90
jmp 0x43a512
call fcn.00439c20
lea ecx, [ebp - 0x2240]
jmp 0x43a4f5
lea ecx, [ebp - 0x2224]
call fcn.00439b90
mov eax, edi
call fcn.00439c20
jmp 0x43a514
lea ecx, [ebp - 0x2224]
call fcn.00439b90
mov eax, ebx
call fcn.00439c20
jmp 0x43a514
call fcn.00439c20
lea ecx, [ebp - 0x2254]
mov edi, eax
call fcn.00439b90
cmp dword [ebp - 0x2224], 0
je 0x43a512
mov edx, dword [ebp - 0x2224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055064f
mov esp, ebp
pop ebp
ret 0x10