Function at 0x402ef0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x40e761
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
mov eax, dword [0x413164]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x430], eax
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x454]
mov edi, dword [esp + 0x448]
push edi
mov dword [esp + 0x444], ebx
mov dword [esp + 0x20], eax
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jge 0x402f59
lea ecx, [esp + 0xc]
call fcn.004035a0
mov eax, esi
jmp 0x4034fc
cmp word [edi], 0x7d
push ebp
je 0x4034ea
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x40f3c8
push edi
mov dword [esp + 0x1c], 1
call esi
mov ebp, eax
neg ebp
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x402f95
cmp ebp, ebx
je 0x4030d7
mov ecx, dword [esp + 0x18]
push edi
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
cmp dword [esp + 0x454], ebx
je 0x4030d7
mov dword [esp + 0x1c], ebx
xor ecx, ecx
mov cx, word [edi]
cmp cx, bx
mov byte [esp + 0x444], 1
mov eax, edi
je 0x402fef
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x402fe7
push eax
call esi
mov cx, word [eax]
cmp cx, bx
jne 0x402fd4
jmp 0x402fef
cmp eax, ebx
jne 0x403522
mov esi, 0x40f29c
mov ecx, dword [esi]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40302a
add esi, 4
cmp esi, 0x40f2cc
jl 0x402ff4
mov edx, dword [esp + 0x450]
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edx
call fcn.004036a0
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x40302e
mov eax, dword [esp + 0x1c]
cmp ebp, ebx
je 0x4030c5
mov ebp, dword [esp + 0x18]
push edi
mov ecx, ebp
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x403541
push edi
mov ecx, ebp
call fcn.00403610
mov esi, eax
cmp esi, ebx
lea ecx, [esp + 0x1c]
jl 0x403552
mov byte [esp + 0x444], bl
call fcn.004035a0
cmp word [edi], 0x7b
jne 0x4030b6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4030b6
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x10]
push ebx
push ecx
mov ecx, dword [esp + 0x20]
push edx
push edi
call fcn.00402ef0
mov esi, eax
cmp esi, ebx
jl 0x4034ea
mov ecx, dword [esp + 0x18]
push edi
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
cmp word [edi], 0x7d
jne 0x402f64
jmp 0x4034ea
cmp eax, ebx
mov byte [esp + 0x444], bl
je 0x4030d7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4030ff
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x18], ebx
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
push 0x40f404
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403208
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x230]
push eax
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
mov ecx, dword [esp + 0x18]
push edi
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
cmp word [edi], 0x3d
jne 0x40352b
cmp dword [esp + 0x454], ebx
je 0x403199
mov ecx, dword [esp + 0x450]
push edi
lea edx, [esp + 0x234]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
mov byte [esp + 0x450], 2
call fcn.00403820
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], ebx
jl 0x4034ea
mov byte [esp + 0x444], bl
jmp 0x40306e
cmp dword [esp + 0x458], ebx
jne 0x4031f9
cmp dword [esp + 0x14], ebx
je 0x4031f9
mov edx, dword [esp + 0x450]
lea ecx, [esp + 0x14]
push ecx
push 0x20006
push ebx
push ebx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4034df
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x4031ee
cmp eax, 2
jne 0x403559
cmp ebp, ebx
je 0x4031f9
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push edi
call fcn.00403610
jmp 0x4030ac
xor ecx, ecx
mov cx, word [edi]
cmp cx, bx
mov eax, edi
je 0x40323b
mov esi, dword [sym.imp.USER32.dll_CharNextW]
lea ebx, [ebx]
cmp cx, 0x5c
je 0x403233
push eax
call esi
mov cx, word [eax]
cmp cx, bx
jne 0x403220
jmp 0x40323b
cmp eax, ebx
jne 0x40352b
cmp dword [esp + 0x454], ebx
je 0x403342
mov esi, dword [esp + 0x450]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebx
push edi
push esi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, ebx
jne 0x403289
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x40327d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edx
je 0x403305
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push edi
push esi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, ebx
jne 0x4032bd
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x4032b1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
je 0x403305
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push esi
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x4034df
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x4032f5
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
jne 0x4034df
mov ecx, dword [esp + 0x18]
push edi
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
cmp word [edi], 0x3d
jne 0x40306e
mov ecx, dword [esp + 0x18]
push edi
push ebx
lea edx, [esp + 0x18]
push edx
call fcn.00403820
mov esi, eax
cmp esi, ebx
jl 0x4034ea
jmp 0x40306e
cmp dword [esp + 0x458], ebx
jne 0x40343f
mov ecx, dword [esp + 0x450]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push edi
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40338a
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x403382
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
cmp eax, ebx
mov ebp, eax
je 0x40339b
mov dword [esp + 0x458], 1
push 0x104
push edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [esp + 0x18]
push edi
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
mov ecx, dword [esp + 0x18]
push edi
call fcn.00403610
mov esi, eax
cmp esi, ebx
jl 0x4034ea
cmp word [edi], 0x7b
jne 0x403419
mov ecx, dword [esp + 0x458]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push edx
push edi
call fcn.00402ef0
mov esi, eax
cmp esi, ebx
jge 0x403405
cmp dword [esp + 0x458], ebx
je 0x4034ea
mov ecx, dword [esp + 0x18]
push edi
call fcn.00402a00
mov esi, eax
cmp esi, ebx
jl 0x4034ea
cmp ebp, 2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x458], eax
je 0x4030b6
cmp ebp, ebx
je 0x403449
cmp eax, ebx
jne 0x4030b6
push ebp
jmp 0x4034e0
mov ebp, 2
jmp 0x403390
cmp eax, ebx
je 0x4034a3
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004035c0
test eax, eax
je 0x4034a3
mov ebp, 0x40f29c
mov edx, dword [ebp]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4030b6
add ebp, 4
cmp ebp, 0x40f2cc
jl 0x403464
cmp dword [esp + 0x14], ebx
je 0x4030b6
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.004036a0
jmp 0x4030b6
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4034ba
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jne 0x4034df
cmp dword [esp + 0x14], ebx
je 0x4030b6
mov eax, dword [esp + 0x450]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
je 0x4030b6
push eax
call fcn.00403580
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4034f9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x438]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
pop ebx
call fcn.00406cd3
add esp, 0x438
ret 0x10
lea ecx, [esp + 0x1c]
call fcn.004035a0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40353a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4034fb
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4034ea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4034ea
call fcn.004035a0
jmp 0x4034ea
push eax
call fcn.00403580
add esp, 4
cmp ebp, ebx
mov esi, eax
je 0x4034ea
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4034ea