Function at 0x412d60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584aa6
mov eax, dword fs:[0]
push eax
mov eax, 0x2258
call fcn.0041bea0
mov eax, dword [0x60c044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x2220], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
push edi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134d4
cmp word [edi], 0x7d
je 0x4134c1
nop word [eax + eax]
push str.Delete
push edi
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x6034d0
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x412e23
test ebx, ebx
je 0x412f3f
mov ecx, dword [ebp - 0x2220]
push edi
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
cmp dword [ebp + 0x10], 0
je 0x412f3f
movzx eax, word [edi]
mov ecx, edi
mov dword [ebp - 0x2240], 0
mov dword [ebp - 0x223c], 0
mov dword [ebp - 0x2238], 0
test ax, ax
je 0x412e91
nop dword [eax + eax]
cmp ax, 0x5c
je 0x412e89
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
jne 0x412e70
jmp 0x412e91
test ecx, ecx
jne 0x413460
mov esi, 0x603880
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x412ef8
add esi, 4
cmp esi, 0x6038b0
jl 0x412e96
mov eax, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2240]
push edi
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], 0
mov dword [ebp - 0x2238], 0
call fcn.004117a0
mov dword [ebp - 0x2240], 0
mov dword [ebp - 0x223c], 0
mov dword [ebp - 0x2238], 0
test ebx, ebx
je 0x412f35
mov ebx, dword [ebp - 0x2220]
mov ecx, ebx
push edi
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x413472
push edi
mov ecx, ebx
call fcn.00412850
mov esi, eax
test esi, esi
js 0x413472
mov dword [ebp - 0x223c], 0
jmp 0x41318a
mov dword [ebp - 0x223c], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x2220]
test eax, eax
jne 0x412f6d
push edi
mov ecx, ebx
mov dword [ebp - 0x2234], eax
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
push 0x6034c8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4130d8
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
push edi
mov ecx, ebx
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
cmp word [edi], 0x3d
jne 0x41346b
cmp dword [ebp + 0x10], 0
je 0x413030
mov eax, dword [ebp - 0x2224]
mov ecx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x224c], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x224c]
mov dword [ebp - 0x2248], 0
push eax
mov dword [ebp - 0x2244], 0
call fcn.00412360
mov esi, eax
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2244], 0
test esi, esi
js 0x41347f
mov byte [ebp - 4], 0
mov dword [ebp - 0x2248], 0
jmp 0x41318a
cmp dword [ebp + 0x14], 0
jne 0x4130c1
cmp dword [ebp - 0x2234], 0
je 0x4130c1
push 0x20006
push 0
push dword [ebp - 0x2224]
lea ecx, [ebp - 0x2258]
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
mov dword [ebp - 0x2250], 0
call fcn.004116f0
test eax, eax
jne 0x41348c
mov esi, dword [ebp - 0x2258]
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4130a2
cmp eax, 2
jne 0x41348c
test esi, esi
je 0x4130b7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
push edi
mov ecx, ebx
call fcn.00412850
mov esi, eax
test esi, esi
js 0x4134c1
jmp 0x413454
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x413103
cmp ax, 0x5c
je 0x4130fb
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
jne 0x4130e2
jmp 0x413103
test ecx, ecx
jne 0x41346b
cmp dword [ebp + 0x10], 0
je 0x4131ec
mov esi, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2230]
push 0x2001f
push edi
push esi
call fcn.004116f0
test eax, eax
je 0x413157
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2230]
call fcn.004116f0
test eax, eax
je 0x413157
sub esp, 0x14
lea ecx, [ebp - 0x2230]
push edi
push esi
call fcn.00411620
test eax, eax
jne 0x4134b8
push edi
mov ecx, ebx
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
cmp word [edi], 0x3d
jne 0x41318a
push edi
push 0
lea eax, [ebp - 0x2230]
mov ecx, ebx
push eax
call fcn.00412360
mov esi, eax
test esi, esi
js 0x4134c1
cmp word [edi], 0x7b
jne 0x413454
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4131a0
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x413454
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2230]
push edi
call fcn.00412d60
mov esi, eax
test esi, esi
js 0x4134c1
push edi
mov ecx, ebx
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
jmp 0x413454
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x41320e
push 0x20019
push edi
push dword [ebp - 0x2224]
lea ecx, [ebp - 0x2230]
call fcn.004116f0
mov ebx, eax
jmp 0x413213
mov ebx, 2
test ebx, ebx
mov ecx, 1
push 0xffffffffffffffff
mov eax, esi
cmovne eax, ecx
push edi
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00438686
push eax
call fcn.00411190
mov ecx, dword [ebp - 0x2220]
add esp, 0x14
push edi
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
mov ecx, dword [ebp - 0x2220]
push edi
call fcn.00412850
mov esi, eax
test esi, esi
js 0x4134c1
cmp word [edi], 0x7b
jne 0x4132d7
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413280
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x4132d7
push dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2220]
push 0
push dword [ebp - 0x2230]
push edi
call fcn.00412d60
mov esi, eax
test esi, esi
jns 0x4132c1
cmp dword [ebp - 0x221c], 0
je 0x4134c1
mov ecx, dword [ebp - 0x2220]
push edi
call fcn.004121c0
mov esi, eax
test esi, esi
js 0x4134c1
cmp ebx, 2
je 0x413454
test ebx, ebx
je 0x4132f5
cmp dword [ebp + 0x14], 0
jne 0x413454
mov ecx, ebx
jmp 0x4134ba
cmp dword [ebp + 0x14], 0
je 0x41338b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x41338b
cmp eax, dword [ebp - 0x221c]
sbb eax, eax
neg eax
je 0x41338b
mov ebx, 0x603880
push dword [ebx]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x413454
add ebx, 4
cmp ebx, 0x6038b0
jl 0x413345
cmp dword [ebp - 0x2234], 0
je 0x413454
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.004117a0
jmp 0x413454
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4133c4
xor ebx, ebx
jmp 0x4133d0
xor eax, eax
cmp eax, dword [ebp - 0x221c]
sbb ebx, ebx
neg ebx
mov ecx, dword [ebp - 0x2230]
xor eax, eax
test ecx, ecx
je 0x4133eb
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x4134b8
cmp dword [ebp - 0x2234], eax
je 0x413454
test ebx, ebx
jne 0x413454
mov eax, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2264]
mov dword [ebp - 0x2264], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2260], ebx
mov dword [ebp - 0x225c], ebx
call fcn.00411540
mov dword [ebp - 0x2264], ebx
mov dword [ebp - 0x2260], ebx
mov dword [ebp - 0x225c], ebx
test eax, eax
jne 0x4134a2
lea ecx, [ebp - 0x2264]
call fcn.00411520
cmp word [edi], 0x7d
jne 0x412df0
jmp 0x4134c1
lea ecx, [ebp - 0x2240]
call fcn.00411520
mov esi, 0x80020009
jmp 0x4134c1
lea ecx, [ebp - 0x2240]
call fcn.00411520
jmp 0x4134c1
lea ecx, [ebp - 0x224c]
call fcn.00411520
jmp 0x4134c1
mov ecx, eax
call fcn.00411280
lea ecx, [ebp - 0x2258]
mov esi, eax
call fcn.00411520
jmp 0x4134c1
mov ecx, eax
call fcn.00411280
lea ecx, [ebp - 0x2264]
mov esi, eax
call fcn.00411520
jmp 0x4134c1
mov ecx, eax
call fcn.00411280
mov esi, eax
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x4134d2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b443
mov esp, ebp
pop ebp
ret 0x10