Function at 0x40677c
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x43705e
call fcn.0042c6e0
sub esp, 0x218
and dword [ebp - 0x10], 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jge 0x4067b4
jmp 0x406b10
cmp byte [ebx], 0x7d
push edi
je 0x406b0d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x43cd88
push ebx
mov dword [ebp - 0x18], 1
call esi
mov edi, eax
neg edi
push 0x43cd9c
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x4067ea
test edi, edi
je 0x406856
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
cmp dword [ebp + 0x10], 0
je 0x406856
push 0x5c
mov eax, ebx
call fcn.004064a3
test eax, eax
pop ecx
jne 0x406bdb
push ebx
call fcn.0040719e
test eax, eax
je 0x40682f
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.004071ca
test edi, edi
je 0x406856
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.00407121
jmp 0x406a33
push 0x43cd90
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40687d
and dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
push 0x43cda8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4069a2
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x224]
call fcn.00406669
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x406afe
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
cmp esi, edi
jl 0x406afe
cmp byte [ebx], 0x3d
jne 0x406b9e
cmp dword [ebp + 0x10], edi
je 0x406947
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [ebp + 8], eax
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
call fcn.00406c47
mov esi, eax
cmp esi, edi
jl 0x406ba3
mov byte [ebp - 4], 0
cmp byte [ebx], 0x7b
jne 0x406939
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x406939
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ebx
call fcn.0040677c
mov esi, eax
test esi, esi
jl 0x406afe
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
cmp byte [ebx], 0x7d
jne 0x4067be
jmp 0x406afe
cmp dword [ebp + 0x14], edi
jne 0x406996
cmp dword [ebp - 0x18], edi
je 0x406996
push 0x20006
push edi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.004070ee
cmp eax, edi
jne 0x406bbd
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x40698b
cmp eax, 2
jne 0x406bab
test edi, edi
je 0x406996
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.00407121
jmp 0x40692f
push 0x5c
mov eax, ebx
call fcn.004064a3
test eax, eax
pop ecx
jne 0x406bdb
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x406a42
push 0x2001f
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.004070ee
test eax, eax
je 0x406a07
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.004070ee
test eax, eax
je 0x406a07
push esi
push 0x2001f
push esi
push esi
push ebx
push dword [ebp + 0xc]
xor edi, edi
lea eax, [ebp - 0x10]
call fcn.00406bfe
cmp eax, esi
jne 0x406af7
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
cmp byte [ebx], 0x3d
jne 0x4068f9
push ebx
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.00406c47
mov esi, eax
test esi, esi
jl 0x406afe
jmp 0x4068f9
cmp dword [ebp + 0x14], esi
jne 0x406a5d
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.004070ee
mov dword [ebp + 8], eax
jmp 0x406a64
mov dword [ebp + 8], 2
cmp dword [ebp + 8], esi
je 0x406a70
mov dword [ebp + 0x14], 1
push 0x104
push ebx
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.00407121
mov esi, eax
test esi, esi
jl 0x406afe
cmp byte [ebx], 0x7b
jne 0x406ad5
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
push ebx
call fcn.0040677c
mov esi, eax
test esi, esi
jge 0x406ac5
cmp dword [ebp + 0x14], 0
je 0x406afe
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406669
mov esi, eax
test esi, esi
jl 0x406afe
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0x14], eax
je 0x406939
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
je 0x406b20
cmp dword [ebp - 0x1c], edi
jne 0x406939
call fcn.004072a6
mov esi, eax
cmp dword [ebp - 0x10], 0
je 0x406b0d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
cmp dword [ebp - 0x1c], edi
je 0x406b63
push dword [ebp - 0x10]
call fcn.00407169
test eax, eax
je 0x406b63
lea eax, [ebp - 0x120]
push eax
call fcn.0040719e
test eax, eax
je 0x406939
cmp dword [ebp - 0x18], 0
je 0x406939
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x10]
call fcn.004071ca
jmp 0x406939
cmp dword [ebp - 0x10], edi
je 0x406b78
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov dword [ebp - 0x10], edi
jne 0x406bf4
cmp dword [ebp - 0x18], edi
je 0x406939
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x406af7
jmp 0x406939
cmp dword [ebp - 0x10], edi
jmp 0x406bdf
cmp dword [ebp - 0x10], edi
jmp 0x406b02
call fcn.004072a6
test edi, edi
mov esi, eax
je 0x406afe
push edi
jmp 0x406bd0
call fcn.004072a6
cmp dword [ebp + 8], edi
mov esi, eax
je 0x406afe
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406afe
cmp dword [ebp - 0x10], 0
je 0x406bea
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x406b0f
call fcn.004072a6
jmp 0x406b0f