Function at 0x5d6904
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65a71c
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.006286f0
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2224], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x2234], ebx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f65
jmp 0x5d6f16
push str.Delete
push edi
mov dword [ebp - 0x2220], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x669288
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2228], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x5d69b3
test esi, esi
je 0x5d6a78
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
cmp dword [ebp + 0x10], 0
je 0x5d6a78
and dword [ebp - 0x2250], 0
and dword [ebp - 0x2248], 0
push 0x5c
push edi
call fcn.005d7568
pop ecx
pop ecx
test eax, eax
jne 0x5d6f55
mov esi, dword [ebp - 0x221c]
mov ecx, esi
push edi
call fcn.005d5b8b
test eax, eax
je 0x5d6a32
mov eax, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2250]
and dword [ebp - 0x224c], 0
push edi
mov dword [ebp - 0x2250], eax
call fcn.005d644c
and dword [ebp - 0x2250], 0
and dword [ebp - 0x2248], 0
cmp dword [ebp - 0x2228], 0
je 0x5d6a6f
push edi
mov ecx, esi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d7339
mov esi, eax
test esi, esi
js 0x5d6f5a
and dword [ebp - 0x224c], 0
jmp 0x5d6d01
and dword [ebp - 0x224c], 0
jmp 0x5d6a7e
mov esi, dword [ebp - 0x221c]
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x5d6aa6
and dword [ebp - 0x2220], eax
mov ecx, esi
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
push 0x669280
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x5d6bf9
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
push eax
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x5d6f55
cmp dword [ebp + 0x10], 0
je 0x5d6b62
mov eax, dword [ebp - 0x2224]
mov ecx, dword [ebp - 0x221c]
and dword [ebp - 0x2258], 0
and dword [ebp - 0x2254], 0
mov dword [ebp - 0x225c], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x225c]
mov byte [ebp - 4], 1
push eax
call fcn.005d563b
mov esi, eax
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
test esi, esi
js 0x5d6f5a
mov byte [ebp - 4], al
mov dword [ebp - 0x2258], eax
jmp 0x5d6d01
cmp dword [ebp + 0x14], 0
jne 0x5d6bde
cmp dword [ebp - 0x2220], 0
je 0x5d6bde
xor eax, eax
lea ecx, [ebp - 0x2240]
push 0x20006
push eax
push dword [ebp - 0x2224]
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
call fcn.005d616f
test eax, eax
jne 0x5d6f24
mov esi, dword [ebp - 0x2240]
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x5d6bc5
cmp eax, 2
jne 0x5d6f24
test esi, esi
je 0x5d6bd7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x2240], 0
and dword [ebp - 0x223c], 0
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d7339
mov esi, eax
test esi, esi
js 0x5d6f5a
jmp 0x5d6f16
push 0x5c
push edi
call fcn.005d7568
pop ecx
pop ecx
test eax, eax
jne 0x5d6f55
cmp dword [ebp + 0x10], eax
je 0x5d6d4a
mov ebx, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2234]
mov esi, 0x2001f
push esi
push edi
push ebx
call fcn.005d616f
test eax, eax
je 0x5d6cb8
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x2234]
call fcn.005d616f
test eax, eax
je 0x5d6cb8
mov ecx, dword [ebp - 0x222c]
lea eax, [ebp - 0x2260]
push eax
xor edx, edx
lea eax, [ebp - 0x2220]
mov dword [ebp - 0x2220], edx
push eax
push edx
push esi
push edx
push edx
push edx
push edi
push ebx
test ecx, ecx
je 0x5d6c79
call fcn.005d653a
jmp 0x5d6c7f
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x5d6f44
cmp dword [ebp - 0x2234], eax
je 0x5d6c9b
push dword [ebp - 0x2234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x2230], 0
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2234], ebx
test eax, eax
jne 0x5d6f4a
jmp 0x5d6cbe
mov ebx, dword [ebp - 0x2234]
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x5d6d01
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2234]
push edi
push 0
push eax
call fcn.005d563b
mov ebx, dword [ebp - 0x2234]
mov esi, eax
test esi, esi
js 0x5d6f5a
push 0x7b
pop eax
cmp word [edi], ax
jne 0x5d6f16
push edi
call fcn.0063436b
pop ecx
cmp eax, 1
jne 0x5d6f16
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp + 0x10]
push ebx
push edi
call fcn.005d6904
mov esi, eax
test esi, esi
js 0x5d6f5a
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d600a
jmp 0x5d6bea
cmp dword [ebp + 0x14], 0
jne 0x5d6d6f
push 0x20019
push edi
push dword [ebp - 0x2224]
lea ecx, [ebp - 0x2234]
call fcn.005d616f
mov ebx, dword [ebp - 0x2234]
jmp 0x5d6d72
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x2228], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push edi
cmove ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp - 0x2244], ecx
call fcn.00635497
push eax
call fcn.005cdd84
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d7339
mov esi, eax
test esi, esi
js 0x5d6f5a
push 0x7b
pop eax
cmp word [edi], ax
jne 0x5d6e22
push edi
call fcn.0063436b
pop ecx
cmp eax, 1
jne 0x5d6e22
push dword [ebp - 0x2244]
mov ecx, dword [ebp - 0x221c]
push 0
push ebx
push edi
call fcn.005d6904
mov esi, eax
test esi, esi
jns 0x5d6e0c
cmp dword [ebp - 0x2244], 0
je 0x5d6f5a
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.005d600a
mov esi, eax
test esi, esi
js 0x5d6f5a
mov eax, dword [ebp - 0x2228]
cmp eax, 2
je 0x5d6f16
test eax, eax
je 0x5d6e44
cmp dword [ebp + 0x14], 0
je 0x5d6f4a
jmp 0x5d6f16
cmp dword [ebp + 0x14], 0
je 0x5d6e9b
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.005d5e72
test eax, eax
je 0x5d6e9b
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x218]
push eax
call fcn.005d5b8b
test eax, eax
je 0x5d6f16
cmp dword [ebp - 0x2220], 0
je 0x5d6f16
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2234]
call fcn.005d644c
mov ebx, dword [ebp - 0x2234]
jmp 0x5d6f16
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.005d5e72
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2228], ecx
test ebx, ebx
je 0x5d6eca
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2228]
xor ebx, ebx
mov dword [ebp - 0x2234], ebx
and dword [ebp - 0x2230], 0
test eax, eax
jne 0x5d6f4a
cmp dword [ebp - 0x2220], eax
je 0x5d6f16
test ecx, ecx
jne 0x5d6f16
mov eax, dword [ebp - 0x2224]
and dword [ebp - 0x2268], ecx
and dword [ebp - 0x2264], ecx
lea ecx, [ebp - 0x226c]
mov dword [ebp - 0x226c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.005d5cf7
and dword [ebp - 0x226c], 0
test eax, eax
jne 0x5d6f4a
push 0x7d
pop eax
cmp word [edi], ax
jne 0x5d697a
jmp 0x5d6f5a
push eax
call fcn.005d5b58
cmp dword [ebp - 0x2240], 0
mov esi, eax
pop ecx
je 0x5d6f5a
push dword [ebp - 0x2240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5d6f5a
mov ebx, dword [ebp - 0x2234]
push eax
call fcn.005d5b58
pop ecx
mov esi, eax
jmp 0x5d6f5a
mov esi, 0x80020009
test ebx, ebx
je 0x5d6f65
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006285ca
leave
ret 0x10