Function at 0x437300
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.004edde0
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.004f0310
add esp, 0xc
mov ecx, esi
push ebx
call fcn.0051ff50
mov dword [ebp - 0x223c], eax
test eax, eax
js 0x437e88
mov dword [ebp - 0x2238], esi
cmp word [ebx], 0x7d
je 0x437e88
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov esi, ecx
call ecx
mov edi, eax
push 0x585c98
push ebx
call esi
test eax, eax
je 0x4375e2
test edi, edi
je 0x4375e2
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.NoRemove
push ebx
mov esi, ecx
call ecx
mov edi, eax
test eax, eax
je 0x437645
mov dword [ebp - 0x2240], edi
test edi, edi
mov edi, ebx
setne bl
push 0x585c90
push edi
call esi
test eax, eax
je 0x43765e
test edi, edi
mov ebx, edi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x4373fa
mov eax, ebx
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x4373f2
test ecx, ecx
je 0x4373fa
push eax
call esi
jmp 0x4373e1
test eax, eax
jne 0x437e74
cmp dword [ebp + 0x10], 0
jne 0x437479
mov edx, 2
cmp dword [ebp + 0x14], 0
jne 0x4377d7
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
jne 0x4374ec
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x4377d7
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x43745e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x4377d7
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x43749c
cmp dword [edi], 0
jne 0x437509
cmp dword [edi + 4], 0
je 0x43752c
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43752c
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x43757d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x43752c
jmp 0x437705
cmp dword [edi], 0
jne 0x4377ae
cmp dword [edi + 4], 0
mov edx, 1
jne 0x437427
jmp 0x4377d7
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43752c
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x437ab7
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x43754f
cmp dword [edi], 0
jne 0x437598
cmp dword [edi + 4], 0
je 0x4376d1
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4376d1
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x4376b0
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x437705
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4376d1
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4376d1
mov ecx, eax
mov edi, dword [edi]
call dword [section..00cfg]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x437567
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0051ff50
mov esi, eax
test eax, eax
js 0x437e82
cmp dword [ebp + 0x10], 0
je 0x43739c
mov dword [ebp - 0x2234], esi
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x437af3
mov eax, ebx
movzx ecx, word [eax]
test ecx, ecx
je 0x437af3
cmp ecx, 0x5c
je 0x437add
push eax
call esi
jmp 0x43762c
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0051ff50
test eax, eax
jns 0x4373b6
jmp 0x437e80
push 0x2000
push 0xff
lea esi, [ebp - 0x2218]
push esi
call fcn.004f0310
add esp, 0xc
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0051ff50
mov edx, 3
test eax, eax
jns 0x437cba
mov esi, eax
mov ebx, edi
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test edx, edx
je 0x437cab
cmp edx, 2
je 0x437cab
jmp 0x437ecb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x437705
sub esp, 0x1c
movaps xmm0, xmmword [0x585c70]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.00438600
test eax, eax
jne 0x437eba
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0051ff50
mov esi, eax
test eax, eax
js 0x437e82
movzx eax, word [ebx]
cmp ax, 0x3d
jne 0x43774e
mov ecx, dword [ebp - 0x2238]
push ebx
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.00438160
mov esi, eax
test eax, eax
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
js 0x437e82
movzx eax, word [ebx]
jmp 0x437754
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp ax, 0x7b
jne 0x437cab
push ebx
call fcn.00508f54
add esp, 4
cmp eax, 1
jne 0x437ca5
mov edi, dword [ebp - 0x2238]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push ebx
call fcn.00437300
test eax, eax
js 0x437e80
mov ecx, edi
push ebx
call fcn.0051ff50
mov esi, eax
test eax, eax
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x437cab
jmp 0x437e82
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x4377d7
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
jne 0x437c20
mov dword [ebp - 0x2234], edx
test edx, edx
mov edi, 1
cmove edi, dword [ebp + 0x14]
push 0xffffffffffffffff
push ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.005098d4
add esp, 0x10
mov esi, ebx
cmp eax, 0x15
jle 0x437810
cmp eax, 0x50
je 0x437818
jmp 0x437efc
test eax, eax
jne 0x437f10
mov ebx, dword [ebp - 0x2238]
mov ecx, ebx
push esi
call fcn.0051ff50
test eax, eax
js 0x437e80
mov dword [ebp - 0x2244], edi
mov ecx, ebx
push esi
call fcn.00520130
mov edi, eax
test eax, eax
js 0x437eb6
mov ebx, esi
cmp word [esi], 0x7b
jne 0x4378aa
push ebx
call fcn.00508f54
add esp, 4
cmp eax, 1
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edi
mov edi, dword [ebp - 0x2244]
jne 0x4378b2
mov ecx, dword [ebp - 0x2238]
push edi
push 0
push dword [ebp - 0x2224]
push ebx
call fcn.00437300
test eax, eax
jns 0x43788d
mov esi, eax
test edi, edi
je 0x437e82
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0051ff50
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
test eax, eax
jns 0x4378b2
jmp 0x437e82
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edi
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x437cab
test eax, eax
je 0x4378d4
cmp dword [ebp + 0x14], 0
jne 0x437cab
jmp 0x437ed2
cmp dword [ebp + 0x14], 0
je 0x437a31
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x437a31
cmp dword [ebp - 0x2218], 0
je 0x437a31
mov dword [ebp - 0x2234], esi
push str.AppID
lea esi, [ebp - 0x218]
push esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x437c13
push str.CLSID
push esi
call edi
test eax, eax
je 0x437c13
push str.Component_Categories
push esi
call edi
test eax, eax
je 0x437c13
push str.FileType
push esi
call edi
test eax, eax
je 0x437c13
push str.Interface
push esi
call edi
test eax, eax
je 0x437c13
push str.Hardware
push esi
call edi
test eax, eax
je 0x437c13
push str.Mime
push esi
call edi
test eax, eax
je 0x437c13
push 0x585d54
push esi
call edi
test eax, eax
je 0x437c13
push str.SECURITY
push esi
call edi
test eax, eax
je 0x437c13
push str.SYSTEM
push esi
call edi
test eax, eax
je 0x437a26
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x437a26
push str.TypeLib
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x437a26
cmp dword [ebp - 0x2240], 0
je 0x437a26
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.00438020
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x437c15
mov edi, ebx
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor ecx, ecx
test eax, eax
sete bl
cmp dword [ebp - 0x2218], ecx
setne bh
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x437c46
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], ecx
test eax, eax
je 0x437c50
jmp 0x437eba
mov ecx, eax
mov edi, dword [edi]
call dword [section..00cfg]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x4374b4
test eax, eax
je 0x437af3
mov dword [ebp - 0x223c], 0x80020009
xor edx, edx
inc edx
jmp 0x437bdc
push str.AppID
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call esi
test eax, eax
je 0x437bd2
push str.CLSID
push ebx
call esi
test eax, eax
je 0x437bd2
push str.Component_Categories
push ebx
call esi
test eax, eax
je 0x437bd2
push str.FileType
push ebx
call esi
test eax, eax
je 0x437bd2
push str.Interface
push ebx
call esi
test eax, eax
je 0x437bd2
push str.Hardware
push ebx
call esi
test eax, eax
je 0x437bd2
push str.Mime
push ebx
call esi
test eax, eax
je 0x437bd2
push 0x585d54
push ebx
call esi
test eax, eax
je 0x437bd2
push str.SECURITY
push ebx
call esi
test eax, eax
je 0x437bd2
push str.SYSTEM
push ebx
call esi
test eax, eax
je 0x437bd2
push str.Software
push ebx
call esi
test eax, eax
je 0x437bd2
push str.TypeLib
push ebx
call esi
test eax, eax
je 0x437bd2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor esi, esi
mov dword [ebp - 0x2214], esi
mov dword [ebp - 0x2210], esi
lea ecx, [ebp - 0x2218]
push ebx
call fcn.00438020
mov dword [ebp - 0x2218], esi
mov dword [ebp - 0x2214], esi
mov dword [ebp - 0x2210], esi
xor edx, edx
test edi, edi
je 0x437d34
mov esi, dword [ebp - 0x2234]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x437bf7
push eax
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
cmp edx, 4
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
je 0x437749
test edx, edx
je 0x4373a2
jmp 0x43769a
mov ecx, edi
mov esi, dword [ebp - 0x2234]
jmp 0x437cab
mov ecx, eax
mov edi, dword [edi]
call dword [section..00cfg]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x43743f
mov dword [ebp - 0x2220], 0
and bl, bh
cmp dword [ebp - 0x2240], 0
sete al
or al, bl
jne 0x437ca3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], ecx
mov dword [ebp - 0x2210], ecx
xor ebx, ebx
lea ecx, [ebp - 0x2218]
lea eax, [ebp - 0x218]
push eax
call fcn.00438710
mov dword [ebp - 0x2218], ebx
mov dword [ebp - 0x2214], ebx
mov dword [ebp - 0x2210], ebx
test eax, eax
jne 0x437eda
mov ebx, edi
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp word [ebx], 0x7d
jne 0x437378
jmp 0x437e82
mov ecx, dword [ebp - 0x2238]
mov esi, edi
push edi
call fcn.0051ff50
mov edx, eax
test eax, eax
js 0x437d54
cmp word [esi], 0x3d
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jne 0x437d68
cmp dword [ebp + 0x10], 0
je 0x437d80
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2238]
mov ebx, edi
push edi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00438160
mov esi, eax
test eax, eax
js 0x437e11
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x437749
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0051ff50
test eax, eax
jns 0x437e1f
mov esi, eax
mov edx, 3
jmp 0x437be2
mov ebx, esi
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edx
mov edx, 3
jmp 0x43769a
mov dword [ebp - 0x223c], 0x80020009
xor eax, eax
inc eax
mov ebx, edi
mov esi, edx
mov edx, eax
jmp 0x43769a
cmp dword [ebp + 0x14], 0
sete al
and al, bl
cmp al, 1
jne 0x437e3a
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x2230], ebx
lea eax, [ebp - 0x2230]
push eax
push 0x20006
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437dbc
mov ebx, dword [ebp - 0x2230]
jne 0x437e5d
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x437e5d
xor edx, edx
mov al, 1
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test ebx, ebx
je 0x437e06
push ebx
mov ebx, edx
mov dword [ebp - 0x2240], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2240]
mov edx, ebx
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test al, al
jne 0x437e3a
mov ebx, edi
jmp 0x43769a
mov dword [ebp - 0x223c], esi
xor edx, edx
inc edx
jmp 0x437694
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.00520130
mov esi, eax
mov edx, eax
sar edx, 0x1f
add edx, 4
jmp 0x437be2
mov ecx, dword [ebp - 0x2238]
mov ebx, edi
push edi
call fcn.00520130
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
mov edx, eax
shr edx, 0x1f
or edx, 2
jmp 0x43769a
push eax
call fcn.005201f0
mov edx, 3
add esp, 4
mov esi, eax
xor eax, eax
jmp 0x437ddf
mov dword [ebp - 0x223c], 0x80020009
jmp 0x437e88
mov esi, eax
mov dword [ebp - 0x223c], esi
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x437e99
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, dword [ebp - 0x223c]
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, edi
jmp 0x437e82
push eax
call fcn.005201f0
add esp, 4
mov dword [ebp - 0x223c], eax
jmp 0x437e88
cmp edx, 3
je 0x437e82
jmp 0x437e88
push dword [ebp - 0x2234]
jmp 0x437ebb
push eax
call fcn.005201f0
add esp, 4
mov dword [ebp - 0x223c], eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x437e88
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x437e88
cmp eax, 0x16
je 0x437f06
cmp eax, 0x22
jne 0x437f1f
push 0x80070057
call fcn.0053fe80
cmp eax, 0xc
jne 0x437f1f
push 0x8007000e
call fcn.0053fe80
push 0x80004005
call fcn.0053fe80
int3