Function at 0x4069f0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x45bbf6
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.00455930
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x2248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4773f0]
xor eax, esp
push eax
lea eax, [esp + 0x2260]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2274]
mov ebx, dword [esp + 0x2270]
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov edx, dword [esp + 0x227c]
mov eax, ebx
mov dword [esp + 0x2268], esi
mov dword [esp + 0x50], edx
call fcn.00406880
mov ebp, eax
cmp ebp, esi
jl 0x4070ad
cmp word [ebx], 0x7d
je 0x4070ab
lea esp, [esp]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [esp + 0x2c], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x406ab1
test edi, edi
je 0x406bef
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x40709c
xor ebp, ebp
cmp dword [esp + 0x2278], ebp
je 0x406be9
movzx ecx, word [ebx]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov eax, ebx
cmp cx, bp
je 0x406b0b
mov esi, dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, cx
cmp cx, 0x5c
je 0x406b03
push eax
call esi
movzx ecx, word [eax]
cmp cx, bp
jne 0x406af0
jmp 0x406b0b
cmp eax, ebp
jne 0x40703c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebp, 0x469c24
mov eax, dword [ebp]
push eax
push ebx
call esi
test eax, eax
je 0x406b4c
add ebp, 4
cmp ebp, 0x469c54
jl 0x406b16
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], ecx
xor ebp, ebp
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], ebp
call fcn.00406630
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
test edi, edi
je 0x406bdf
mov esi, dword [esp + 0x18]
mov eax, ebx
mov ecx, esi
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x407055
mov edi, ebx
mov ecx, esi
call fcn.00406580
mov ebp, eax
test ebp, ebp
jl 0x407055
mov dword [esp + 0x30], 0
cmp word [ebx], 0x7b
jne 0x406bd0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x406bd0
mov ecx, dword [esp + 0x2278]
mov edx, dword [esp + 0x1c]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ebx
call fcn.004069f0
mov ebp, eax
test ebp, ebp
jl 0x40709c
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x40709c
cmp word [ebx], 0x7d
jne 0x406a80
jmp 0x40709c
mov dword [esp + 0x30], 0
jmp 0x406bef
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebp, dword [esp + 0x1c]
push str.NoRemove
push ebx
call esi
test eax, eax
jne 0x406c22
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, ebx
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x40709c
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x469358
push ebx
xor edi, edi
call esi
test eax, eax
jne 0x406d4e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x25c]
call fcn.00406880
mov ebp, eax
cmp ebp, edi
jl 0x40709c
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x40709c
cmp word [ebx], 0x3d
jne 0x407045
xor esi, esi
cmp dword [esp + 0x2278], esi
je 0x406cc5
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x2268], 1
push ebx
lea eax, [esp + 0x44]
mov dword [esp + 0x44], edx
push eax
lea edx, [esp + 0x264]
mov dword [esp + 0x4c], esi
call fcn.00406210
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
jl 0x40705b
mov byte [esp + 0x2268], 0
mov dword [esp + 0x44], esi
jmp 0x406b86
cmp dword [esp + 0x227c], esi
jne 0x406d3a
cmp dword [esp + 0x24], esi
je 0x406d3a
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push ecx
push 0x20006
push esi
push esi
push edx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40706f
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x25c]
push eax
push edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x406d27
cmp eax, 2
jne 0x40706f
cmp edi, esi
je 0x406d36
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x18]
mov edi, ebx
call fcn.00406580
mov ebp, eax
cmp ebp, esi
jmp 0x406bca
movzx ecx, word [ebx]
mov eax, ebx
cmp cx, di
je 0x406d7f
movzx ecx, cx
jmp 0x406d60
cmp cx, 0x5c
je 0x406d77
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, di
jne 0x406d60
jmp 0x406d7f
cmp eax, edi
jne 0x407045
cmp dword [esp + 0x2278], edi
je 0x406e61
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push ecx
push 0x2001f
push edi
push ebx
push edx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x406dcc
xor eax, eax
cmp ebp, edi
je 0x406db8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x406e22
xor edi, edi
mov ebp, ecx
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x406e08
xor eax, eax
cmp ebp, edi
je 0x406df8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x406e22
mov edx, dword [esp + 0x28]
push edx
mov edx, ebx
lea esi, [esp + 0x20]
call fcn.00405fd0
mov edi, eax
test edi, edi
jne 0x40707a
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x40709c
cmp word [ebx], 0x3d
jne 0x406b86
mov ecx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x20]
push eax
xor edx, edx
call fcn.00406210
mov ebp, eax
test ebp, ebp
jl 0x40709c
jmp 0x406b86
cmp dword [esp + 0x227c], edi
jne 0x406f78
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [esp + 0x48], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x406ea6
xor eax, eax
cmp ebp, edi
je 0x406e9a
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
mov esi, eax
cmp eax, edi
je 0x406eb7
mov dword [esp + 0x227c], 1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x5c]
push 0x104
push edx
call fcn.0044413e
push eax
call fcn.00402bb0
mov ecx, dword [esp + 0x2c]
add esp, 0x14
mov eax, ebx
call fcn.00406880
mov ebp, eax
cmp ebp, edi
jl 0x40709c
mov ecx, dword [esp + 0x18]
mov edi, ebx
call fcn.00406580
mov ebp, eax
test ebp, ebp
jl 0x40709c
cmp word [ebx], 0x7b
jne 0x406f4a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x406f4a
mov edi, dword [esp + 0x227c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edi
push 0
push eax
push ebx
call fcn.004069f0
mov ebp, eax
test ebp, ebp
jge 0x406f35
test edi, edi
je 0x40709c
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00406880
mov ebp, eax
test ebp, ebp
jl 0x40709c
mov eax, dword [esp + 0x50]
mov dword [esp + 0x227c], eax
cmp esi, 2
je 0x406bd0
test esi, esi
je 0x406f82
test eax, eax
jne 0x406bd0
mov eax, esi
call fcn.00406840
mov ebp, eax
jmp 0x40709c
mov esi, 2
jmp 0x406eac
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x406fc5
mov ecx, esi
call fcn.00406780
test eax, eax
je 0x406fc5
lea ecx, [esp + 0x54]
push ecx
call fcn.004065f0
test eax, eax
je 0x406bd0
cmp dword [esp + 0x24], 0
je 0x406bd0
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
call fcn.00406630
jmp 0x406bd0
mov ecx, esi
call fcn.00406780
xor edi, edi
mov dword [esp + 0x34], eax
test esi, esi
je 0x406fe7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test edi, edi
jne 0x40707a
cmp dword [esp + 0x24], edi
je 0x406bd0
cmp dword [esp + 0x34], edi
jne 0x406bd0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x4c], edi
lea edi, [esp + 0x54]
lea esi, [esp + 0x48]
mov dword [esp + 0x48], eax
call fcn.004067e0
xor ecx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
cmp eax, ecx
jne 0x40708c
call fcn.004067c0
jmp 0x406bd0
lea esi, [esp + 0x2c]
call fcn.004067c0
lea esi, [esp + 0x1c]
call fcn.004067c0
mov eax, 0x80020009
jmp 0x4070ad
lea esi, [esp + 0x2c]
jmp 0x407097
lea esi, [esp + 0x40]
call fcn.004067c0
lea esi, [esp + 0x1c]
call fcn.004067c0
jmp 0x4070ab
call fcn.00406840
lea esi, [esp + 0x38]
jmp 0x407095
lea esi, [esp + 0x1c]
call fcn.004067c0
mov eax, edi
call fcn.00406840
jmp 0x4070ad
call fcn.00406840
lea esi, [esp + 0x48]
mov ebp, eax
call fcn.004067c0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4070ab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x2260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2248]
xor ecx, esp
call fcn.0044331b
add esp, 0x2258
ret 0x10