Function at 0x40d4f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67374b
mov eax, dword fs:[0]
push eax
mov eax, 0x229c
call fcn.00611bb0
mov eax, dword [0x730b1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x221c], ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
mov dword [ebp - 0x2224], 0
push 0xc
push str.Num_Els___d_n
push 2
lea eax, [ebp - 0x2240]
mov dword [ebp - 4], 0
push 8
push eax
mov dword [ebp - 0x2240], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
mov dword [ebp - 0x223c], 0x58c
call fcn.0040af50
add esp, 0x14
mov ecx, ebx
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dcf6
cmp word [edi], 0x7d
je 0x40dce3
nop word [eax + eax]
push str.Delete
push edi
mov dword [ebp - 0x2238], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40d5e3
test ebx, ebx
je 0x40d6e5
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
cmp dword [ebp + 0x10], 0
je 0x40d6e5
movzx ecx, word [edi]
mov eax, edi
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2244], 0
test cx, cx
je 0x40d644
mov edx, ecx
cmp dx, 0x5c
je 0x40d63c
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x40d623
jmp 0x40d644
test eax, eax
jne 0x40dec5
mov esi, 0x70e6c4
nop dword [eax]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40d69e
add esi, 4
cmp esi, 0x70e6f4
jl 0x40d650
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x224c]
push edi
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], 0
call fcn.0040cf40
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2244], 0
test ebx, ebx
je 0x40d6db
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
push edi
mov ecx, ebx
call fcn.0040cd50
mov esi, eax
test esi, esi
js 0x40dce3
mov dword [ebp - 0x2248], 0
jmp 0x40daf3
mov dword [ebp - 0x2248], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d715
mov ecx, dword [ebp - 0x221c]
xor ebx, ebx
push edi
mov dword [ebp - 0x2238], ebx
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
jmp 0x40d71b
mov ebx, dword [ebp - 0x2238]
push 0x70e344
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d8f3
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
push eax
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
cmp word [edi], 0x3d
jne 0x40dec5
cmp dword [ebp + 0x10], 0
je 0x40d7ec
mov eax, dword [ebp - 0x2220]
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2258]
mov dword [ebp - 0x2254], 0
push eax
mov dword [ebp - 0x2250], 0
call fcn.0040c580
mov esi, eax
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
mov dword [ebp - 0x2250], 0
test esi, esi
js 0x40dce3
mov byte [ebp - 4], 0
mov dword [ebp - 0x2254], 0
jmp 0x40daf3
cmp dword [ebp + 0x14], 0
jne 0x40d8d8
test ebx, ebx
je 0x40d8d8
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2278], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push eax
push str.Deleting__Ts_n
push 1
lea eax, [ebp - 0x2278]
mov dword [ebp - 0x2274], 0x5d7
push 8
push eax
call fcn.0040af50
add esp, 0x14
mov dword [ebp - 0x2264], 0
lea ecx, [ebp - 0x2264]
mov dword [ebp - 0x2260], 0
mov dword [ebp - 0x225c], 0
push 0x20006
push 0
push dword [ebp - 0x2220]
call fcn.0040cdc0
test eax, eax
jne 0x40dea2
mov ebx, dword [ebp - 0x2264]
test ebx, ebx
jne 0x40d89e
push str.m_hKey___0
push 0x70d8fc
push ebx
push 0x16a5
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_atlbase.h
push 2
call fcn.00619920
add esp, 0x18
cmp eax, 1
jne 0x40d89e
int3
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40d8b9
cmp eax, 2
jne 0x40de85
test ebx, ebx
je 0x40d8ce
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2264], 0
mov dword [ebp - 0x2260], 0
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040cd50
mov esi, eax
test esi, esi
js 0x40dce3
jmp 0x40de76
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x40d921
mov edx, ecx
nop
cmp dx, 0x5c
je 0x40d919
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x40d900
jmp 0x40d921
test eax, eax
jne 0x40dec5
cmp dword [ebp + 0x10], 0
je 0x40db4e
mov ebx, dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
push 0x2001f
push edi
push ebx
call fcn.0040cdc0
test eax, eax
je 0x40daba
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x222c]
call fcn.0040cdc0
test eax, eax
je 0x40daba
push edi
push str.Creating_key__Ts_n
push 2
lea eax, [ebp - 0x2280]
mov dword [ebp - 0x2280], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push 8
push eax
mov dword [ebp - 0x227c], 0x5fe
call fcn.0040af50
add esp, 0x14
mov byte [ebp - 4], 2
test ebx, ebx
jne 0x40d9bf
push str.hKeyParent___0
push 0x70d8fc
push ebx
push 0x16e2
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_atlbase.h
push 2
call fcn.00619920
add esp, 0x18
cmp eax, 1
jne 0x40d9bf
int3
mov esi, dword [ebp - 0x2224]
mov dword [ebp - 0x2234], 0
test esi, esi
je 0x40da5c
cmp dword [esi], 0
je 0x40da4f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40da1a
push str.hAdvAPI32___0
push 0x70d8fc
push eax
push 0x27d
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_atltransactionmanager.h
push 2
call fcn.00619920
add esp, 0x18
cmp eax, 1
jne 0x40da10
int3
mov ecx, 1
jmp 0x40daae
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40da55
push 0
push dword [esi]
lea ecx, [ebp - 0x223c]
push ecx
lea ecx, [ebp - 0x2234]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ebx
call eax
jmp 0x40da7f
cmp dword [esi + 4], 0
jne 0x40da5c
mov ecx, 1
jmp 0x40da81
lea eax, [ebp - 0x223c]
push eax
lea eax, [ebp - 0x2234]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test ecx, ecx
jne 0x40daae
mov eax, dword [ebp - 0x222c]
test eax, eax
je 0x40da98
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x2234]
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], 0
mov byte [ebp - 4], 0
test ecx, ecx
jne 0x40dcdc
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
cmp word [edi], 0x3d
jne 0x40daf3
push edi
push 0
lea eax, [ebp - 0x222c]
mov ecx, ebx
push eax
call fcn.0040c580
mov esi, eax
test esi, esi
js 0x40dce3
cmp word [edi], 0x7b
jne 0x40de76
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40db02
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40de76
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x222c]
push edi
call fcn.0040d4f0
mov esi, eax
test esi, esi
js 0x40dce3
push edi
mov ecx, ebx
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
jmp 0x40de76
cmp dword [ebp + 0x14], 0
jne 0x40dbb4
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
call fcn.0040cdc0
mov esi, eax
mov ebx, 1
test esi, esi
mov dword [ebp - 0x2230], esi
cmove ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x40dbc3
push edi
push str.Opened_Key__Ts_n
push 1
lea eax, [ebp - 0x2288]
mov dword [ebp - 0x2288], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push 8
push eax
mov dword [ebp - 0x2284], 0x621
call fcn.0040af50
mov dword [ebp - 0x2230], esi
jmp 0x40dbed
mov dword [ebp - 0x2230], 2
mov ebx, 1
push edi
push str.Ignoring_Open_key_on__Ts_:_In_Recovery_mode_n
push 0
lea eax, [ebp - 0x2290]
mov dword [ebp - 0x2290], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push 8
push eax
mov dword [ebp - 0x228c], 0x623
call fcn.0040af50
add esp, 0x14
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push edi
push 0x104
push eax
call fcn.0062cfb0
push eax
call fcn.0040cd00
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040cd50
mov esi, eax
test esi, esi
js 0x40dce3
cmp word [edi], 0x7b
jne 0x40dc89
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dc44
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40dc89
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
push dword [ebp - 0x222c]
push edi
call fcn.0040d4f0
mov esi, eax
test esi, esi
jns 0x40dc77
test ebx, ebx
je 0x40dce3
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040d310
mov esi, eax
test esi, esi
js 0x40dce3
mov ecx, dword [ebp + 0x14]
cmp ebx, ecx
je 0x40dcbf
push str.Ending_Recovery_Mode_n
push 0
lea eax, [ebp - 0x2298]
mov dword [ebp - 0x2298], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push 8
push eax
mov dword [ebp - 0x2294], 0x63b
call fcn.0040af50
mov ecx, dword [ebp + 0x14]
add esp, 0x10
mov eax, dword [ebp - 0x2230]
cmp eax, 2
je 0x40de76
test eax, eax
je 0x40dd14
test ecx, ecx
jne 0x40de76
mov ecx, eax
call fcn.0040d300
mov esi, eax
mov ebx, dword [ebp - 0x222c]
test ebx, ebx
je 0x40dcf4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00610840
mov esp, ebp
pop ebp
ret 0x10
test ecx, ecx
je 0x40ddad
push dword [ebp - 0x222c]
call fcn.0040d0d0
test eax, eax
je 0x40ddad
mov ebx, 0x70e6c4
push dword [ebx]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40de76
add ebx, 4
cmp ebx, 0x70e6f4
jl 0x40dd34
cmp dword [ebp - 0x2238], 0
je 0x40de76
lea eax, [ebp - 0x218]
mov dword [ebp - 0x22a0], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push eax
push str.Deleting_non_empty_subkey__Ts_by_force_n
push 0
lea eax, [ebp - 0x22a0]
mov dword [ebp - 0x229c], 0x655
push 8
push eax
call fcn.0040af50
add esp, 0x14
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x222c]
push eax
call fcn.0040cf40
jmp 0x40de76
mov ebx, dword [ebp - 0x222c]
push ebx
call fcn.0040d0d0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2230], ecx
test ebx, ebx
je 0x40ddde
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2230]
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
test eax, eax
jne 0x40dcda
cmp dword [ebp - 0x2238], eax
je 0x40de76
test ecx, ecx
jne 0x40de76
lea eax, [ebp - 0x218]
mov dword [ebp - 0x22a8], str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30037_atlmfcinclude_statreg.h
push eax
push str.Deleting_Key__Ts_n
push ecx
lea eax, [ebp - 0x22a8]
mov dword [ebp - 0x22a4], 0x663
push 8
push eax
call fcn.0040af50
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2270]
add esp, 0x14
mov dword [ebp - 0x2270], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x226c], 0
mov dword [ebp - 0x2268], 0
push eax
call fcn.0040d180
mov dword [ebp - 0x2270], 0
test eax, eax
jne 0x40dcda
cmp word [edi], 0x7d
jne 0x40d5b0
jmp 0x40dce3
mov ecx, eax
call fcn.0040d300
mov esi, eax
test ebx, ebx
je 0x40dce3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dce3
mov ecx, eax
call fcn.0040d300
mov esi, eax
mov eax, dword [ebp - 0x2264]
test eax, eax
je 0x40dce3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dce3
mov esi, 0x80020009
jmp 0x40dce3