Function at 0x4041b9
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x452b16
mov eax, dword fs:[0]
push eax
mov eax, 0x1158
call fcn.0043c050
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x1154], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x116c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1180]
mov edi, dword [esp + 0x117c]
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x1188]
mov dword [esp + 0x60], ecx
push edi
mov ecx, ebx
mov dword [esp + 0x1178], ebp
call fcn.004024c0
mov esi, eax
cmp esi, ebp
jl 0x404361
cmp byte [edi], 0x7d
je 0x40435f
jmp 0x403de4
mov ebx, dword [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x458490
push edi
mov dword [esp + 0x38], 1
call esi
neg eax
push 0x458470
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x403e13
test ebp, ebp
je 0x403f3b
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
xor eax, eax
cmp dword [esp + 0x1184], eax
je 0x403f3b
mov cl, byte [edi]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, edi
test cl, cl
je 0x403e68
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov edi, edi
cmp cl, 0x5c
je 0x403e60
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x403e50
jmp 0x403e68
test eax, eax
jne 0x40432e
mov esi, 0x45950c
lea ecx, [ecx]
mov edx, dword [esi]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403eb3
add esi, 4
cmp esi, 0x45953c
jl 0x403e70
mov eax, dword [esp + 0x14]
xor esi, esi
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.004028a0
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
jmp 0x403eb5
xor esi, esi
cmp ebp, esi
je 0x403f37
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404347
push edi
mov ecx, ebx
call fcn.00402680
mov esi, eax
test esi, esi
js 0x404347
mov dword [esp + 0x28], 0
cmp byte [edi], 0x7b
jne 0x403f29
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x403f29
mov ecx, dword [esp + 0x1184]
mov edx, dword [esp + 0x18]
push 0
push ecx
push edx
push edi
mov ecx, ebx
call fcn.00403d40
mov esi, eax
test esi, esi
js 0x404350
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
cmp byte [edi], 0x7d
jne 0x403de0
jmp 0x404350
mov dword [esp + 0x28], esi
push 0x458480
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403f61
push edi
mov ecx, ebx
mov dword [esp + 0x34], eax
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
push 0x458468
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404089
lea ecx, [esp + 0x168]
push ecx
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
cmp byte [edi], 0x3d
jne 0x404337
xor ebp, ebp
cmp dword [esp + 0x1184], ebp
je 0x404008
mov edx, dword [esp + 0x14]
push edi
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebx
mov byte [esp + 0x1180], 1
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
call fcn.00403990
mov esi, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
cmp esi, ebp
jl 0x40438b
mov byte [esp + 0x1174], 0
mov dword [esp + 0x3c], ebp
jmp 0x403ee5
cmp dword [esp + 0x1188], ebp
jne 0x404072
cmp dword [esp + 0x30], ebp
je 0x404072
mov edx, dword [esp + 0x14]
push 0x20006
push ebp
push edx
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
call fcn.00402120
cmp eax, ebp
jne 0x40439f
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x168]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebp
je 0x40405f
cmp eax, 2
jne 0x40439f
cmp esi, ebp
je 0x40406e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
push edi
mov ecx, ebx
call fcn.00402680
mov esi, eax
cmp esi, ebp
jl 0x404350
jmp 0x403f29
mov cl, byte [edi]
mov eax, edi
test cl, cl
je 0x4040af
mov esi, dword [sym.imp.USER32.dll_CharNextA]
cmp cl, 0x5c
je 0x4040a7
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x404097
jmp 0x4040af
test eax, eax
jne 0x404337
cmp dword [esp + 0x1184], 0
je 0x40414c
mov ecx, dword [esp + 0x14]
push 0x2001f
push edi
push ecx
lea ecx, [esp + 0x24]
call fcn.00402120
test eax, eax
je 0x404113
mov edx, dword [esp + 0x14]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x24]
call fcn.00402120
test eax, eax
je 0x404113
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push eax
lea ecx, [esp + 0x34]
call fcn.00402070
mov esi, eax
test esi, esi
jne 0x4043b0
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
cmp byte [edi], 0x3d
jne 0x403ee5
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.00403990
mov esi, eax
test esi, esi
js 0x404350
jmp 0x403ee5
cmp dword [esp + 0x1188], 0
jne 0x4041ab
mov edx, dword [esp + 0x14]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x24]
call fcn.00402120
mov ebp, eax
mov dword [esp + 0x34], ebp
test ebp, ebp
je 0x40417f
mov dword [esp + 0x1188], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.0043b812
add esp, 0x10
cmp eax, 0x50
ja case.0x4041a4.107
movzx ecx, byte [eax + 0x404420]
jmp dword [ecx*4 + 0x404410]
mov dword [esp + 0x34], 2
mov ebp, dword [esp + 0x34]
jmp 0x404174
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
push edi
mov ecx, ebx
call fcn.00402680
mov esi, eax
test esi, esi
js 0x404350
cmp byte [edi], 0x7b
jne 0x404229
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x404229
mov ebp, dword [esp + 0x1188]
mov edx, dword [esp + 0x18]
push ebp
push 0
push edx
push edi
mov ecx, ebx
call fcn.00403d40
mov esi, eax
test esi, esi
jns 0x404213
test ebp, ebp
je 0x404350
push edi
mov ecx, ebx
call fcn.004024c0
mov esi, eax
test esi, esi
js 0x404350
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1188], eax
cmp ebp, 2
je 0x403f29
test ebp, ebp
je 0x404259
test eax, eax
jne 0x403f29
push ebp
call fcn.00401d90
add esp, 4
mov esi, eax
jmp 0x404350
test eax, eax
je 0x40429f
mov eax, dword [esp + 0x18]
push eax
mov ecx, ebx
call fcn.00402630
test eax, eax
je 0x40429f
lea ecx, [esp + 0x64]
push ecx
mov ecx, ebx
call fcn.004025f0
test eax, eax
je 0x403f29
cmp dword [esp + 0x30], 0
je 0x403f29
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x1c]
call fcn.004028a0
jmp 0x403f29
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x5c]
push eax
call fcn.00402630
xor ebp, ebp
mov ebx, eax
cmp dword [esp + 0x18], ebp
je 0x4042cc
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
test ebp, ebp
jne 0x4043d8
cmp dword [esp + 0x30], ebp
je 0x403f29
test ebx, ebx
jne 0x403f29
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call fcn.00401ff0
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
cmp eax, ebx
jne 0x4043ef
lea ecx, [esp + 0x50]
call fcn.00402880
jmp 0x403f29
lea ecx, [esp + 0x24]
call fcn.00402880
lea ecx, [esp + 0x18]
call fcn.00402880
mov eax, 0x80020009
jmp 0x404361
lea ecx, [esp + 0x24]
call fcn.00402880
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40435f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x116c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1154]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x1164
ret 0x10
lea ecx, [esp + 0x38]
call fcn.00402880
lea ecx, [esp + 0x18]
call fcn.00402880
jmp 0x40435f
push eax
call fcn.00401d90
add esp, 4
mov esi, eax
lea ecx, [esp + 0x44]
jmp 0x40434b
lea ecx, [esp + 0x18]
call fcn.00402880
push esi
call fcn.00401d90
add esp, 4
jmp 0x404361
push 0x8007000e
call fcn.00401bd0
push 0x80070057
call fcn.00401bd0
lea ecx, [esp + 0x18]
call fcn.00402880
push ebp
call fcn.00401d90
add esp, 4
jmp 0x404361
push eax
call fcn.00401d90
add esp, 4
mov esi, eax
lea ecx, [esp + 0x50]
jmp 0x40434b
push 0x80004005
call fcn.00401bd0
lea ecx, [ecx]
mov ecx, 0xc4004041
inc ebx
inc eax
add dh, cl
inc ebx
inc eax
add byte [ebx], al
inc esp
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3