Function at 0x40885c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41b037
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2264
call fcn.00415d80
mov eax, dword [0x427280]
xor eax, esp
mov dword [esp + 0x2260], eax
push ebx
push esi
push edi
mov eax, dword [0x427280]
xor eax, esp
push eax
lea eax, [esp + 0x2278]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov eax, dword [ebp + 0xc]
lea edi, [esp + 0x28]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2280], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
push ebx
mov dword [esp + 0x24], eax
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e37
push 0x7d
pop eax
cmp word [ebx], ax
je 0x408e28
xor eax, eax
inc eax
push str.Delete
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push ebx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40892a
test esi, esi
je 0x4089dd
push ebx
mov ecx, edi
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4089df
xor eax, eax
lea edi, [esp + 0x34]
stosd dword es:[edi], eax
mov ecx, ebx
push 0x5c
pop edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call fcn.00407d87
test eax, eax
jne 0x408e23
push ebx
call fcn.00408474
test eax, eax
je 0x40899e
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x34]
push ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call fcn.004084a3
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov edi, dword [esp + 0x10]
cmp dword [esp + 0x18], esi
je 0x4089d7
push ebx
mov ecx, edi
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
push ebx
mov ecx, edi
call fcn.0040840d
mov esi, eax
test esi, esi
js 0x408e28
xor eax, eax
mov dword [esp + 0x38], eax
jmp 0x408d92
mov dword [esp + 0x38], esi
jmp 0x4089df
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408a05
push ebx
mov ecx, edi
mov dword [esp + 0x20], esi
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
push 0x42424c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408b3f
lea eax, [esp + 0x26c]
mov ecx, edi
push eax
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
push ebx
mov ecx, edi
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x408e23
cmp dword [ebp + 0x10], 0
je 0x408abc
xor eax, eax
lea edi, [esp + 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
xor eax, eax
inc eax
mov ecx, edi
mov byte [esp + 0x2280], al
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x26c]
push ebx
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00407fb3
xor ecx, ecx
mov esi, eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
test esi, esi
js 0x408e28
mov byte [esp + 0x2280], cl
mov dword [esp + 0x50], ecx
jmp 0x408d92
cmp dword [ebp + 0x14], 0
jne 0x408b32
cmp dword [esp + 0x1c], 0
je 0x408b32
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
lea ecx, [esp + 0x40]
xor esi, esi
push 0x20006
push esi
push dword [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
call fcn.00401f68
test eax, eax
jne 0x408e07
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x26c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x408b1b
cmp eax, 2
jne 0x408df7
test edi, edi
je 0x408b2a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x40], esi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x44], esi
push ebx
mov ecx, edi
call fcn.0040840d
jmp 0x408ddd
push 0x5c
pop edx
mov ecx, ebx
call fcn.00407d87
test eax, eax
jne 0x408e23
cmp dword [ebp + 0x10], eax
je 0x408bd5
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push 0x2001f
push ebx
push esi
call fcn.00401f68
test eax, eax
je 0x408b98
push 0x20019
push ebx
push esi
lea ecx, [esp + 0x34]
call fcn.00401f68
test eax, eax
je 0x408b98
sub esp, 0x14
lea ecx, [esp + 0x3c]
push ebx
push esi
call fcn.00407e26
test eax, eax
jne 0x408cc4
push ebx
mov ecx, edi
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x408d92
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00407fb3
mov esi, eax
test esi, esi
js 0x408e28
jmp 0x408d92
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x408bf1
push 0x20019
push ebx
push dword [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.00401f68
jmp 0x408bf4
push 2
pop eax
push 1
test eax, eax
mov dword [esp + 0x1c], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
lea eax, [esp + 0x68]
push ebx
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.00409f7a
push eax
call fcn.00401c47
add esp, 0x14
mov ecx, edi
push ebx
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
push ebx
mov ecx, edi
call fcn.0040840d
mov esi, eax
test esi, esi
js 0x408e28
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x408ca0
mov ecx, ebx
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x408c51
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x408ca0
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x30]
push edi
push ebx
call fcn.0040885c
mov esi, eax
test esi, esi
jns 0x408c8a
cmp dword [ebp + 0x14], 0
je 0x408e28
mov ecx, dword [esp + 0x10]
push ebx
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
jmp 0x408ca4
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x408de3
test eax, eax
je 0x408cd2
test ecx, ecx
jne 0x408de3
mov ecx, eax
call fcn.004086fc
mov esi, eax
jmp 0x408e28
test ecx, ecx
je 0x408d10
push edi
call fcn.004085e4
test eax, eax
je 0x408d10
lea eax, [esp + 0x64]
push eax
call fcn.00408474
test eax, eax
je 0x408de3
cmp dword [esp + 0x1c], 0
je 0x408de3
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x2c]
call fcn.004084a3
jmp 0x408de3
push edi
call fcn.004085e4
mov ecx, eax
xor edx, edx
mov dword [esp + 0x18], ecx
mov eax, edx
test edi, edi
je 0x408d35
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
test eax, eax
jne 0x408cc4
cmp dword [esp + 0x1c], eax
je 0x408de5
test ecx, ecx
jne 0x408de5
lea edi, [esp + 0x58]
stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], edx
call fcn.00408683
xor ecx, ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
test eax, eax
jne 0x408cc4
mov edi, dword [esp + 0x10]
mov dword [esp + 0x5c], ecx
cmp dword [ebp + 0x10], 0
je 0x408de3
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x408de3
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x24]
jne 0x408da5
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x408de6
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [esp + 0x30]
push ebx
call fcn.0040885c
mov esi, eax
test esi, esi
js 0x408e28
push ebx
mov ecx, edi
call fcn.0040870a
mov esi, eax
test esi, esi
js 0x408e28
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [ebx], cx
je 0x408e28
mov edi, dword [esp + 0x10]
jmp 0x4088f9
mov ecx, eax
call fcn.004086fc
mov esi, eax
test edi, edi
je 0x408e28
push edi
jmp 0x408e1b
mov ecx, eax
call fcn.004086fc
cmp dword [esp + 0x40], 0
mov esi, eax
je 0x408e28
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408e28
mov esi, 0x80020009
mov eax, dword [esp + 0x28]
test eax, eax
je 0x408e37
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x2278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2260]
xor ecx, esp
call fcn.0040946c
mov esp, ebp
pop ebp
ret 0x10