Function at 0x409b90
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x424284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x20006
lea eax, [esi + 2]
mov dword [ebp - 0x20c], esi
call fcn.0040b410
mov edi, eax
mov dword [ebp - 0x210], edi
test edi, edi
jne 0x409bdb
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
push 1
lea eax, [ebp - 0x208]
xor edx, edx
lea ecx, [esi + 2]
call fcn.00409910
mov dword [ebp - 0x214], eax
add esp, 4
lea edx, [esi + 0x18416]
mov ebx, 0x420e88
mov eax, edi
call fcn.0040aab0
test eax, eax
je 0x409c44
cmp dword [ebp - 0x214], 0
jle 0x409c27
lea eax, [ebp - 0x208]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
lea edx, [esi + 0x28414]
mov ebx, str.AppParameters
mov eax, edi
call fcn.0040aab0
test eax, eax
je 0x409c92
cmp dword [ebp - 0x214], 0
jle 0x409c75
lea ecx, [ebp - 0x208]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
lea edx, [esi + 0x30412]
mov ebx, str.AppDirectory
mov eax, edi
call fcn.0040aab0
test eax, eax
je 0x409ce0
cmp dword [ebp - 0x214], 0
jle 0x409cc3
lea edx, [ebp - 0x208]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x4041c]
cmp eax, 0x20
je 0x409d06
push eax
mov esi, str.AppPriority
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
mov ebx, dword [ebp + 8]
add esp, 4
jmp 0x409d19
mov ebx, dword [ebp + 8]
test bl, bl
je 0x409d19
push str.AppPriority
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x40400]
mov ecx, dword [esi + 0x40404]
mov edx, eax
or edx, ecx
je 0x409dfe
lea edx, [ebp - 0x214]
push edx
push ecx
push eax
call fcn.0040c3d0
mov ebx, dword [ebp - 0x214]
add esp, 0xc
test eax, eax
jne 0x409dc3
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409d50
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.AppAffinity
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x409dc3
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push str.AppAffinity
push 0xc00003fb
push 1
call fcn.004021b0
add esp, 0x14
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x409dd7
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0x7049c]
not eax
test eax, eax
je 0x409e10
push eax
mov esi, str.AppStopMethodSkip
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409e20
test bl, bl
je 0x409dda
push str.AppAffinity
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x409dda
test bl, bl
je 0x409e20
push str.AppStopMethodSkip
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x70490]
cmp eax, 4
jae 0x409e4a
mov ecx, dword [ebp - 0x20c]
mov esi, dword [eax*4 + 0x424db0]
push ebx
add ecx, 2
call fcn.0040a5d0
mov esi, dword [ebp - 0x20c]
add esp, 4
mov eax, dword [esi + 0x70494]
test eax, eax
je 0x409e6c
push eax
mov esi, str.AppRestartDelay
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409e7c
test bl, bl
je 0x409e7c
push str.AppRestartDelay
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x70498]
cmp eax, 0x5dc
je 0x409ea1
push eax
mov esi, str.AppThrottle
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409eb1
test bl, bl
je 0x409eb1
push str.AppThrottle
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x704a0]
cmp eax, 0x5dc
je 0x409ed6
push eax
mov esi, str.AppStopMethodConsole
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409ee6
test bl, bl
je 0x409ee6
push str.AppStopMethodConsole
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x704a4]
cmp eax, 0x5dc
je 0x409f0b
push eax
mov esi, str.AppStopMethodWindow
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409f1b
test bl, bl
je 0x409f1b
push str.AppStopMethodWindow
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x704a8]
cmp eax, 0x5dc
je 0x409f40
push eax
mov esi, str.AppStopMethodThreads
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409f50
test bl, bl
je 0x409f50
push str.AppStopMethodThreads
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esi + 0x704ac], 0
jne 0x409f72
push 0
mov esi, str.AppKillProcessTree
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x409f82
test bl, bl
je 0x409f82
push str.AppKillProcessTree
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx eax, word [esi + 0x40424]
lea edx, [esi + 0x40424]
test ax, ax
jne 0x409fa1
test bl, bl
je 0x40a084
test ax, ax
je 0x409fb2
mov ebx, str.AppStdin
mov eax, edi
call fcn.0040aab0
mov ebx, dword [ebp + 8]
jmp 0x409fc2
test bl, bl
je 0x409fc2
push str.AppStdin
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x50424]
cmp eax, 2
je 0x409fe2
push eax
push str.AppStdin
mov ecx, str.ShareMode
call fcn.00406df0
add esp, 8
jmp 0x409ff8
test bl, bl
je 0x409ffe
push str.AppStdin
mov esi, str.ShareMode
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov eax, dword [esi + 0x50428]
cmp eax, 3
je 0x40a01e
push eax
push str.AppStdin
mov ecx, str.CreationDisposition
call fcn.00406df0
add esp, 8
jmp 0x40a034
test bl, bl
je 0x40a040
push str.AppStdin
mov esi, str.CreationDisposition
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
mov eax, dword [esi + 0x5042c]
cmp eax, 0x80
je 0x40a062
push eax
push str.AppStdin
mov ecx, str.FlagsAndAttributes
call fcn.00406df0
add esp, 8
jmp 0x40a078
test bl, bl
je 0x40a084
push str.AppStdin
mov esi, str.FlagsAndAttributes
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
movzx eax, word [esi + 0x50430]
lea edx, [esi + 0x50430]
test ax, ax
jne 0x40a0a3
test bl, bl
je 0x40a1cd
test ax, ax
je 0x40a0b4
mov ebx, str.AppStdout
mov eax, edi
call fcn.0040aab0
mov ebx, dword [ebp + 8]
jmp 0x40a0c4
test bl, bl
je 0x40a0c4
push str.AppStdout
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x60430]
cmp eax, 3
je 0x40a0e4
push eax
push str.AppStdout
mov ecx, str.ShareMode
call fcn.00406df0
add esp, 8
jmp 0x40a0fa
test bl, bl
je 0x40a106
push str.AppStdout
mov esi, str.ShareMode
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
mov eax, dword [esi + 0x60434]
cmp eax, 4
je 0x40a126
push eax
push str.AppStdout
mov ecx, str.CreationDisposition
call fcn.00406df0
add esp, 8
jmp 0x40a13c
test bl, bl
je 0x40a148
push str.AppStdout
mov esi, str.CreationDisposition
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
mov eax, dword [esi + 0x60438]
cmp eax, 0x80
je 0x40a16a
push eax
push str.AppStdout
mov ecx, str.FlagsAndAttributes
call fcn.00406df0
add esp, 8
jmp 0x40a180
test bl, bl
je 0x40a18c
push str.AppStdout
mov esi, str.FlagsAndAttributes
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
cmp byte [esi + 0x70473], 0
je 0x40a1ab
push 1
push str.AppStdout
mov ecx, str.CopyAndTruncate
call fcn.00406df0
add esp, 8
jmp 0x40a1c1
test bl, bl
je 0x40a1cd
push str.AppStdout
mov esi, str.CopyAndTruncate
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
movzx eax, word [esi + 0x60450]
lea edx, [esi + 0x60450]
test ax, ax
jne 0x40a1ec
test bl, bl
je 0x40a316
test ax, ax
je 0x40a1fd
mov ebx, str.AppStderr
mov eax, edi
call fcn.0040aab0
mov ebx, dword [ebp + 8]
jmp 0x40a20d
test bl, bl
je 0x40a20d
push str.AppStderr
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x70450]
cmp eax, 3
je 0x40a22d
push eax
push str.AppStderr
mov ecx, str.ShareMode
call fcn.00406df0
add esp, 8
jmp 0x40a243
test bl, bl
je 0x40a24f
push str.AppStderr
mov esi, str.ShareMode
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
mov eax, dword [esi + 0x70454]
cmp eax, 4
je 0x40a26f
push eax
push str.AppStderr
mov ecx, str.CreationDisposition
call fcn.00406df0
add esp, 8
jmp 0x40a285
test bl, bl
je 0x40a291
push str.AppStderr
mov esi, str.CreationDisposition
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
mov eax, dword [esi + 0x70458]
cmp eax, 0x80
je 0x40a2b3
push eax
push str.AppStderr
mov ecx, str.FlagsAndAttributes
call fcn.00406df0
add esp, 8
jmp 0x40a2c9
test bl, bl
je 0x40a2d5
push str.AppStderr
mov esi, str.FlagsAndAttributes
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
cmp byte [esi + 0x70474], 0
je 0x40a2f4
push 1
push str.AppStderr
mov ecx, str.CopyAndTruncate
call fcn.00406df0
add esp, 8
jmp 0x40a30a
test bl, bl
je 0x40a316
push str.AppStderr
mov esi, str.CopyAndTruncate
call fcn.00406e70
add esp, 4
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
cmp byte [esi + 0x70472], 0
je 0x40a338
push 1
mov esi, str.AppTimestampLog
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a348
test bl, bl
je 0x40a348
push str.AppTimestampLog
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esi + 0x70470], 0
je 0x40a36a
push 1
mov esi, str.AppRedirectHook
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a37a
test bl, bl
je 0x40a37a
push str.AppRedirectHook
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esi + 0x70471], 0
je 0x40a39c
push 1
mov esi, str.AppRotateFiles
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a3ac
test bl, bl
je 0x40a3ac
push str.AppRotateFiles
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [esi + 0x70478], 0
je 0x40a3ce
push 1
mov esi, str.AppRotateOnline
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a3de
test bl, bl
je 0x40a3de
push str.AppRotateOnline
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x70480]
test eax, eax
je 0x40a400
push eax
mov esi, str.AppRotateSeconds
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a410
test bl, bl
je 0x40a410
push str.AppRotateSeconds
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x70484]
test eax, eax
je 0x40a432
push eax
mov esi, str.AppRotateBytes
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a442
test bl, bl
je 0x40a442
push str.AppRotateBytes
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x70488]
test eax, eax
je 0x40a464
push eax
mov esi, str.AppRotateBytesHigh
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a474
test bl, bl
je 0x40a474
push str.AppRotateBytesHigh
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x7048c]
test eax, eax
je 0x40a496
push eax
mov esi, str.AppRotateDelay
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a4a6
test bl, bl
je 0x40a4a6
push str.AppRotateDelay
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [esi + 0x40420], 0
je 0x40a4c8
push 1
mov esi, str.AppNoConsole
mov ecx, edi
call fcn.0040aac0
mov esi, dword [ebp - 0x20c]
add esp, 4
jmp 0x40a4d8
test bl, bl
je 0x40a4d8
push str.AppNoConsole
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x403f8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40a534
mov ecx, dword [esi + 0x40410]
add ecx, ecx
push ecx
push eax
push 7
push 0
push str.AppEnvironment
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40a546
push 0
call ebx
mov edi, eax
call fcn.00402080
push eax
push str.AppEnvironment
push 0xc00003fb
push 1
call fcn.004021b0
mov esi, dword [ebp - 0x20c]
mov edi, dword [ebp - 0x210]
add esp, 0x14
jmp 0x40a546
cmp byte [ebp + 8], 0
je 0x40a546
push str.AppEnvironment
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esi + 0x40414]
test eax, eax
je 0x40a596
mov edx, dword [esi + 0x40418]
add edx, edx
push edx
push eax
push 7
push 0
push str.AppEnvironmentExtra
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40a5a8
push 0
call ebx
mov edi, eax
call fcn.00402080
push eax
push str.AppEnvironmentExtra
push 0xc00003fb
push 1
call fcn.004021b0
mov edi, dword [ebp - 0x210]
add esp, 0x14
jmp 0x40a5a8
cmp byte [ebp + 8], 0
je 0x40a5a8
push str.AppEnvironmentExtra
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041427b
mov esp, ebp
pop ebp
ret