Function at 0x442030
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467b26
mov eax, dword fs:[0]
push eax
mov eax, 0x2250
call fcn.00449830
mov eax, dword [0x4814f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], ebx
mov dword [ebp - 0x2224], ebx
mov edx, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2244], edx
call fcn.00440fa0
mov esi, eax
cmp esi, ebx
jl 0x442722
cmp word [edi], 0x7d
je 0x442720
jmp 0x4420b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x474a60
push edi
mov dword [ebp - 0x2238], 1
call esi
mov ebx, eax
neg ebx
push 0x474a84
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x4420e3
test ebx, ebx
je 0x4421fb
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4421fd
push 0x5c
push edi
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
call fcn.00440ef0
add esp, 8
test eax, eax
jne 0x442698
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00441120
test eax, eax
je 0x44215d
mov eax, dword [ebp - 0x222c]
push edi
lea ecx, [ebp - 0x2234]
mov dword [ebp - 0x2234], eax
mov dword [ebp - 0x2230], esi
call fcn.004412a0
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
cmp ebx, esi
je 0x4421f3
mov ebx, dword [ebp - 0x221c]
push edi
mov ecx, ebx
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x4426b5
push edi
mov ecx, ebx
call fcn.004411b0
mov esi, eax
test esi, esi
jl 0x4426b5
mov dword [ebp - 0x2230], 0
cmp word [edi], 0x7b
jne 0x4421e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4421e4
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
push 0
push edx
push eax
push edi
call fcn.00442030
mov esi, eax
test esi, esi
jl 0x44270f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
cmp word [edi], 0x7d
jne 0x4420b0
jmp 0x44270f
mov dword [ebp - 0x2230], esi
jmp 0x4421fd
xor esi, esi
push 0x474a70
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44222b
mov ecx, dword [ebp - 0x221c]
push edi
mov dword [ebp - 0x2238], eax
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
xor esi, esi
push 0x474a9c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44235c
lea ecx, [ebp - 0x2218]
push ecx
mov ecx, dword [ebp - 0x221c]
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
cmp word [edi], 0x3d
jne 0x4426a3
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x4422d6
mov edx, dword [ebp - 0x222c]
push edi
lea eax, [ebp - 0x2218]
push eax
lea ecx, [ebp - 0x224c]
push ecx
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x224c], edx
mov dword [ebp - 0x2248], ebx
call fcn.00441cb0
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
jl 0x4426bd
mov byte [ebp - 4], bl
mov dword [ebp - 0x2248], ebx
jmp 0x442199
cmp dword [ebp + 0x14], ebx
jne 0x442347
cmp dword [ebp - 0x2238], ebx
je 0x442347
mov edx, dword [ebp - 0x222c]
push 0x20006
push ebx
push edx
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
call fcn.00440b70
cmp eax, ebx
jne 0x4426d5
mov esi, dword [ebp - 0x2240]
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x442330
cmp eax, 2
jne 0x4426d5
cmp esi, ebx
je 0x442341
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004411b0
mov esi, eax
cmp esi, ebx
jmp 0x4421de
push 0x5c
push edi
call fcn.00440ef0
add esp, 8
test eax, eax
jne 0x4426a3
cmp dword [ebp + 0x10], esi
je 0x442480
mov ebx, dword [ebp - 0x222c]
lea ecx, [ebp - 0x2220]
push ecx
push 0x2001f
push esi
push edi
push ebx
mov dword [ebp - 0x2220], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4423c6
mov ecx, dword [ebp - 0x2228]
xor eax, eax
cmp ecx, esi
je 0x4423b0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2220]
mov dword [ebp - 0x2228], edx
mov dword [ebp - 0x2224], esi
cmp eax, esi
je 0x44243c
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x2228]
call fcn.00440b70
test eax, eax
je 0x44243c
lea eax, [ebp - 0x225c]
push eax
lea ecx, [ebp - 0x2220]
push ecx
push esi
push 0x2001f
push esi
push esi
push esi
push edi
mov edx, ebx
push edx
mov dword [ebp - 0x2220], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x4426e3
mov ecx, dword [ebp - 0x2228]
xor eax, eax
cmp ecx, esi
je 0x442420
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2220]
mov ebx, eax
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], esi
cmp eax, esi
jne 0x4426e3
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
cmp word [edi], 0x3d
jne 0x442199
mov ecx, dword [ebp - 0x221c]
push edi
push 0
lea edx, [ebp - 0x2228]
push edx
call fcn.00441cb0
mov esi, eax
test esi, esi
jl 0x44270f
jmp 0x442199
cmp dword [ebp + 0x14], esi
jne 0x442580
mov eax, dword [ebp - 0x222c]
push 0x20019
push edi
push eax
lea ecx, [ebp - 0x2228]
call fcn.00440b70
mov ebx, eax
mov dword [ebp - 0x2220], ebx
cmp ebx, esi
je 0x4424b4
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.0044e1db
push eax
call fcn.00403ab0
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004411b0
mov esi, eax
test esi, esi
jl 0x44270f
cmp word [edi], 0x7b
jne 0x442552
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x442552
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
push edx
push edi
call fcn.00442030
mov esi, eax
test esi, esi
jge 0x442536
test ebx, ebx
je 0x44270f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00440fa0
mov esi, eax
test esi, esi
jl 0x44270f
mov ebx, dword [ebp - 0x2220]
mov eax, dword [ebp - 0x2244]
mov dword [ebp + 0x14], eax
cmp ebx, 2
je 0x4421e4
test ebx, ebx
je 0x442595
test eax, eax
jne 0x4421e4
push ebx
call fcn.004409e0
add esp, 4
mov esi, eax
jmp 0x44270f
mov dword [ebp - 0x2220], 2
mov ebx, dword [ebp - 0x2220]
jmp 0x4424ad
mov ebx, dword [ebp - 0x2228]
test eax, eax
je 0x4425ed
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.00441160
test eax, eax
je 0x4425ed
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x221c]
call fcn.00441120
test eax, eax
je 0x4421e4
cmp dword [ebp - 0x2238], 0
je 0x4421e4
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x2228]
call fcn.004412a0
jmp 0x4421e4
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.00441160
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2220], 0
test ebx, ebx
je 0x442624
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2228], 0
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2224], 0
test ebx, ebx
jne 0x4426e3
cmp dword [ebp - 0x2238], ebx
je 0x4421e4
cmp dword [ebp - 0x2258], ebx
jne 0x4421e4
mov eax, dword [ebp - 0x222c]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x2254]
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], ebx
call fcn.00440b00
mov dword [ebp - 0x2254], ebx
mov dword [ebp - 0x2250], ebx
cmp eax, ebx
jne 0x4426f9
lea ecx, [ebp - 0x2254]
call fcn.00403c40
jmp 0x4421e4
lea ecx, [ebp - 0x2234]
call fcn.00403c40
lea ecx, [ebp - 0x2228]
call fcn.00403c40
mov eax, 0x80020009
jmp 0x442722
lea ecx, [ebp - 0x2234]
jmp 0x44270a
lea ecx, [ebp - 0x224c]
call fcn.00403c40
lea ecx, [ebp - 0x2228]
call fcn.00403c40
jmp 0x442720
push eax
call fcn.004409e0
lea ecx, [ebp - 0x2240]
jmp 0x442705
lea ecx, [ebp - 0x2228]
call fcn.00403c40
push ebx
call fcn.004409e0
add esp, 4
jmp 0x442722
push eax
call fcn.004409e0
lea ecx, [ebp - 0x2254]
add esp, 4
mov esi, eax
call fcn.00403c40
mov eax, dword [ebp - 0x2228]
test eax, eax
je 0x442720
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447f52
mov esp, ebp
pop ebp
ret 0x10