Function at 0x100040e8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2244
call fcn.10139950
mov eax, dword [ebp + 0x14]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x24], eax
push edi
mov eax, ebx
mov dword [ebp - 4], ecx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x100044ac
cmp word [ebx], 0x7d
je 0x100044aa
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x18], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x10004157
test esi, esi
je 0x100041e6
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x100041e8
push 0x5c
mov eax, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call fcn.10003873
pop ecx
test eax, eax
jne 0x100045ab
push ebx
call fcn.10003cd4
test eax, eax
je 0x100041ac
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
call fcn.100032a9
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
cmp esi, edi
je 0x100041e1
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.10003d35
mov edi, eax
test edi, edi
jl 0x1000449b
and dword [ebp - 0x1c], 0
jmp 0x10004555
mov dword [ebp - 0x1c], edi
jmp 0x100041e8
xor edi, edi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10004211
and dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
xor edi, edi
push 0x1018a000
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10004304
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x2240]
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
cmp word [ebx], 0x3d
jne 0x100045c3
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x10004297
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 0x2240]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x28], esi
call fcn.100039d5
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
jl 0x1000460a
mov dword [ebp - 0x28], esi
jmp 0x10004555
cmp dword [ebp + 0x14], esi
jne 0x100042f1
cmp dword [ebp - 0x18], esi
je 0x100042f1
push esi
push dword [ebp + 0xc]
mov eax, 0x20006
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.10003226
cmp eax, esi
jne 0x100045c9
lea eax, [ebp - 0x2240]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x100042dd
cmp eax, 2
jne 0x100045c9
cmp dword [ebp - 0x14], esi
je 0x100042ee
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.10003d35
mov edi, eax
cmp edi, esi
jmp 0x10004596
push 0x5c
mov eax, ebx
call fcn.10003873
pop ecx
test eax, eax
jne 0x100045ab
cmp dword [ebp + 0x10], edi
je 0x100043c8
push ebx
push dword [ebp + 0xc]
mov esi, 0x2001f
mov eax, esi
lea ecx, [ebp - 0xc]
call fcn.10003226
test eax, eax
je 0x1000438c
push ebx
push dword [ebp + 0xc]
lea eax, [esi - 6]
lea ecx, [ebp - 0xc]
call fcn.10003226
test eax, eax
je 0x1000438c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push edi
push edi
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x100045e7
xor eax, eax
cmp dword [ebp - 0xc], edi
je 0x1000437b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
cmp eax, edi
jne 0x100045e7
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
cmp word [ebx], 0x3d
jne 0x10004555
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.100039d5
mov edi, eax
test edi, edi
jl 0x1000449b
jmp 0x10004555
cmp dword [ebp + 0x14], edi
jne 0x100043e3
push ebx
push dword [ebp + 0xc]
mov eax, 0x20019
lea ecx, [ebp - 0xc]
call fcn.10003226
mov dword [ebp + 8], eax
jmp 0x100043ea
mov dword [ebp + 8], 2
cmp dword [ebp + 8], edi
je 0x100043f6
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x240]
push 0x104
push eax
call fcn.1013228d
push eax
call fcn.100029db
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.10003d35
mov edi, eax
test edi, edi
jl 0x1000449b
cmp word [ebx], 0x7b
jne 0x10004472
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x10004472
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 0xc]
push ebx
call fcn.100040e8
mov edi, eax
test edi, edi
jge 0x10004462
cmp dword [ebp + 0x14], 0
je 0x1000449b
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x14], eax
je 0x1000459c
xor esi, esi
cmp dword [ebp + 8], esi
je 0x100044b3
cmp eax, esi
jne 0x1000459c
mov eax, dword [ebp + 8]
call fcn.10002b2d
mov edi, eax
cmp dword [ebp - 0xc], 0
je 0x100044aa
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp eax, esi
je 0x100044f5
push dword [ebp - 0xc]
call fcn.10003d00
test eax, eax
je 0x100044f5
lea eax, [ebp - 0x240]
push eax
call fcn.10003cd4
test eax, eax
je 0x1000459c
cmp dword [ebp - 0x18], 0
je 0x1000459c
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0xc]
call fcn.100032a9
jmp 0x1000459c
push dword [ebp - 0xc]
call fcn.10003d00
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp - 0xc], esi
je 0x10004513
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
cmp eax, esi
jne 0x10004603
cmp dword [ebp - 0x18], esi
je 0x1000459c
cmp dword [ebp + 8], 0
jne 0x1000459c
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x240]
push eax
lea esi, [ebp - 0x34]
call fcn.100031b8
and dword [ebp - 0x34], 0
and dword [ebp - 0x30], 0
test eax, eax
jne 0x10004494
and dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
je 0x1000459c
cmp word [ebx], 0x7b
jne 0x1000459c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x1000459c
mov ecx, dword [ebp - 4]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push ebx
call fcn.100040e8
mov edi, eax
test edi, edi
jl 0x1000449b
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.100038bf
mov edi, eax
test edi, edi
jl 0x1000449b
cmp word [ebx], 0x7d
jne 0x10004127
jmp 0x1000449b
cmp dword [ebp - 0xc], edi
je 0x100045b9
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x100044ac
cmp dword [ebp - 0xc], 0
jmp 0x100045ae
call fcn.10002b2d
mov edi, eax
cmp dword [ebp - 0x14], esi
je 0x1000449b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000449b
call fcn.10002b2d
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x100045fc
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100044ac
call fcn.10002b2d
mov edi, eax
cmp dword [ebp - 0xc], esi
jmp 0x1000449f