Function at 0x4074f0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x490927
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.0047ce60
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0x2248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x2260]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2270]
mov eax, dword [esp + 0x2274]
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2268], ebx
mov edx, dword [esp + 0x227c]
mov eax, esi
mov dword [esp + 0x50], edx
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jge 0x407582
mov dword [esp + 0x2268], 0xffffffff
jmp 0x407c56
cmp word [esi], 0x7d
je 0x407c36
lea esp, [esp]
mov edi, dword [esp + 0x34]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x38], 1
call ebp
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push edi
inc esi
call ebp
test eax, eax
je 0x4075c5
cmp esi, ebx
je 0x40770c
mov ecx, dword [esp + 0x20]
mov eax, edi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
cmp dword [esp + 0x2278], ebx
je 0x40770c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x2268], 1
movzx ecx, word [edi]
mov eax, edi
cmp cx, bx
je 0x40762b
mov ebp, dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, cx
lea ebx, [ebx]
cmp cx, 0x5c
je 0x407623
push eax
call ebp
movzx ecx, word [eax]
cmp cx, bx
jne 0x407610
jmp 0x40762b
cmp eax, ebx
jne 0x407b89
mov ebp, 0x4a1760
mov eax, dword [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x407668
add ebp, 4
cmp ebp, 0x4a1790
jl 0x407630
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ebx
call fcn.00405c40
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp esi, ebx
je 0x407701
mov esi, dword [esp + 0x20]
mov eax, edi
mov ecx, esi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407bb7
mov ecx, esi
call fcn.00407000
mov ebp, eax
cmp ebp, ebx
jl 0x407bb7
mov byte [esp + 0x2268], bl
mov dword [esp + 0x2c], ebx
cmp word [edi], 0x7b
jne 0x407afc
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x407afc
mov ecx, dword [esp + 0x2278]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x20]
push ebx
push ecx
push edx
push edi
mov ecx, esi
call fcn.004074f0
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
mov eax, edi
mov ecx, esi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
jmp 0x407afc
mov byte [esp + 0x2268], bl
mov dword [esp + 0x2c], ebx
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x407735
mov ecx, dword [esp + 0x20]
mov eax, edi
mov dword [esp + 0x30], ebx
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
push 0x4a1704
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40787d
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x25c]
mov ecx, esi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
mov eax, edi
mov ecx, esi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
cmp word [edi], 0x3d
jne 0x407b99
cmp dword [esp + 0x2278], ebx
je 0x4077df
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2268], 2
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x25c]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], edx
push ecx
mov ecx, edi
mov edx, esi
mov dword [esp + 0x44], ebx
call fcn.00406bb0
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
jl 0x407bc4
mov byte [esp + 0x2268], bl
mov dword [esp + 0x3c], ebx
jmp 0x4076a3
cmp dword [esp + 0x227c], ebx
jne 0x407867
cmp dword [esp + 0x30], ebx
je 0x407867
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x2268], 3
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1c]
push edx
push 0x20006
push ebx
push ebx
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x407bec
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x25c]
push ecx
mov dword [esp + 0x50], ebx
push ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x40784d
cmp eax, 2
jne 0x407bec
mov byte [esp + 0x2268], bl
cmp ebp, ebx
je 0x407863
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov ecx, esi
call fcn.00407000
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
jmp 0x407afc
movzx ecx, word [edi]
mov eax, edi
cmp cx, bx
je 0x4078af
movzx ecx, cx
lea ebx, [ebx]
cmp cx, 0x5c
je 0x4078a7
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, bx
jne 0x407890
jmp 0x4078af
cmp eax, ebx
jne 0x407b99
cmp dword [esp + 0x2278], ebx
je 0x407999
mov ebp, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x1c]
push edx
push 0x2001f
push ebx
push edi
push ebp
mov dword [esp + 0x30], ebx
call esi
cmp eax, ebx
jne 0x407906
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x4078f2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebx
je 0x40795a
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebx
push edi
push ebp
mov dword [esp + 0x30], ebx
call esi
cmp eax, ebx
jne 0x407946
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x407932
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebx
je 0x40795a
push ebp
mov edx, edi
lea esi, [esp + 0x18]
call fcn.00405b90
cmp eax, ebx
jne 0x407c00
mov ecx, dword [esp + 0x20]
mov eax, edi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
cmp word [edi], 0x3d
jne 0x4076a3
push ebx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x28]
mov ecx, edi
call fcn.00406bb0
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
jmp 0x4076a3
cmp dword [esp + 0x227c], ebx
jne 0x407ab8
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push edi
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4079ea
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x4079da
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x4079fd
mov dword [esp + 0x227c], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x5c]
push 0x104
push eax
call fcn.00471c1b
push eax
call fcn.00405620
mov esi, dword [esp + 0x34]
add esp, 0x14
mov eax, edi
mov ecx, esi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
mov ecx, esi
call fcn.00407000
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
cmp word [edi], 0x7b
jne 0x407a8e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x407a8e
mov ecx, dword [esp + 0x227c]
mov edx, dword [esp + 0x14]
push ecx
push ebx
push edx
push edi
mov ecx, esi
call fcn.004074f0
mov ebp, eax
cmp ebp, ebx
jge 0x407a7b
cmp dword [esp + 0x227c], ebx
je 0x407c36
mov eax, edi
mov ecx, esi
call fcn.00406a40
mov ebp, eax
cmp ebp, ebx
jl 0x407c36
mov eax, dword [esp + 0x50]
mov dword [esp + 0x227c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 2
je 0x407afc
cmp eax, ebx
je 0x407ac5
cmp dword [esp + 0x50], ebx
jne 0x407afc
call fcn.004057c0
mov ebp, eax
jmp 0x407c36
mov dword [esp + 0x1c], 2
jmp 0x4079f2
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x50], ebx
je 0x407b0f
mov ecx, esi
call fcn.00406fc0
test eax, eax
je 0x407b0f
lea ebx, [esp + 0x54]
call fcn.00406f80
test eax, eax
je 0x407afa
cmp dword [esp + 0x30], 0
je 0x407afa
mov ecx, ebx
push ecx
lea ecx, [esp + 0x18]
call fcn.00405c40
xor ebx, ebx
mov eax, dword [esp + 0x34]
cmp word [eax], 0x7d
jne 0x407590
jmp 0x407c36
mov ecx, esi
call fcn.00406fc0
mov edi, eax
xor eax, eax
cmp esi, ebx
je 0x407b29
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp eax, ebx
jne 0x407c00
cmp dword [esp + 0x30], ebx
je 0x407afc
cmp edi, ebx
jne 0x407afc
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x2268], 4
mov edx, dword [esp + 0x24]
lea edi, [esp + 0x54]
lea esi, [esp + 0x40]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
call fcn.00405b30
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
cmp eax, ebx
jne 0x407c1f
mov byte [esp + 0x2268], bl
call fcn.00405b10
jmp 0x407afc
mov byte [esp + 0x2268], bl
lea esi, [esp + 0x28]
call fcn.00405b10
mov dword [esp + 0x2268], 0xffffffff
lea esi, [esp + 0x14]
call fcn.00405b10
mov eax, 0x80020009
jmp 0x407c5a
mov byte [esp + 0x2268], bl
lea esi, [esp + 0x28]
jmp 0x407c31
mov byte [esp + 0x2268], bl
lea esi, [esp + 0x38]
call fcn.00405b10
mov dword [esp + 0x2268], 0xffffffff
lea esi, [esp + 0x14]
call fcn.00405b10
mov eax, ebp
jmp 0x407c5a
call fcn.004057c0
mov ebp, eax
mov byte [esp + 0x2268], bl
lea esi, [esp + 0x48]
jmp 0x407c31
call fcn.004057c0
mov edi, eax
mov dword [esp + 0x2268], 0xffffffff
lea esi, [esp + 0x14]
call fcn.00405b10
mov eax, edi
jmp 0x407c5a
call fcn.004057c0
mov ebp, eax
mov byte [esp + 0x2268], bl
lea esi, [esp + 0x40]
call fcn.00405b10
mov dword [esp + 0x2268], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x407c54
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov eax, ebp
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2248]
xor ecx, esp
call fcn.00470f4c
add esp, 0x2258
ret 0x10