Function at 0x407440
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449571
mov eax, dword fs:[0]
push eax
mov eax, 0x11d0
call fcn.0040da60
mov eax, dword [0x47bd14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1120], ecx
mov dword [ebp - 0x112c], 0
mov dword [ebp - 0x1128], 0
mov dword [ebp - 0x1124], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1138], 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x1118], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x4074fe
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0x11c8], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11c8]
jmp 0x4080da
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x7d
je 0x4080b6
mov dword [ebp - 0x1138], 1
mov edx, dword [str.Delete]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407538
mov dword [ebp - 0x1168], 1
jmp 0x407542
mov dword [ebp - 0x1168], 0
mov ecx, dword [ebp - 0x1168]
mov dword [ebp - 0x1178], ecx
mov edx, dword [str.ForceRemove]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x407570
cmp dword [ebp - 0x1178], 0
je 0x4077bb
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407593
jmp 0x4080b6
cmp dword [ebp + 0x10], 0
je 0x4077bb
mov dword [ebp - 0x1144], 0
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x113c], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1130], edx
mov dword [ebp - 0x116c], 0
cmp dword [ebp - 0x1130], 0
jne 0x4075e7
mov dword [ebp - 0x1170], 0
jmp 0x407631
mov eax, dword [ebp - 0x1130]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407625
mov edx, dword [ebp - 0x1130]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x407610
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x116c], ecx
jmp 0x407625
mov edx, dword [ebp - 0x1130]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1130], eax
jmp 0x4075e7
mov eax, dword [ebp - 0x116c]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x1170], 0
je 0x407670
mov dword [ebp - 0x11c4], 0x80020009
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1144]
call fcn.00401d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11c4]
jmp 0x4080da
mov dword [ebp - 0x1148], 0
jmp 0x40768b
mov ecx, dword [ebp - 0x1148]
add ecx, 1
mov dword [ebp - 0x1148], ecx
cmp dword [ebp - 0x1148], 0xc
jge 0x4076be
mov edx, dword [ebp - 0x1148]
mov eax, dword [edx*4 + 0x44c5fc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4076bc
mov dword [ebp - 0x1174], 0
jmp 0x4076c8
jmp 0x40767c
mov dword [ebp - 0x1174], 1
cmp dword [ebp - 0x1174], 0
je 0x40772b
xor edx, edx
jne 0x4076d1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1144], eax
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x113c], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1144]
call fcn.004068a0
mov edx, dword [ebp - 0x1144]
mov dword [ebp - 0x11dc], edx
mov dword [ebp - 0x1144], 0
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x113c], 0
cmp dword [ebp - 0x1178], 0
je 0x4077ac
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407766
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1144]
call fcn.00401d20
jmp 0x4080b6
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.004099b0
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407798
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1144]
call fcn.00401d20
jmp 0x4080b6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1144]
call fcn.00401d20
jmp 0x408042
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1144]
call fcn.00401d20
mov edx, dword [str.NoRemove]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4077fd
mov dword [ebp - 0x1138], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x4077fd
jmp 0x4080b6
mov edx, dword [0x44a8f8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407a9d
lea ecx, [ebp - 0x1114]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x40783c
jmp 0x4080b6
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x40785f
jmp 0x4080b6
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x3d
je 0x407891
mov dword [ebp - 0x11cc], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11cc]
jmp 0x4080da
cmp dword [ebp + 0x10], 0
je 0x407994
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
mov byte [ebp - 4], 2
xor edx, edx
jne 0x4078bd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1158], eax
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1114]
push edx
lea eax, [ebp - 0x1158]
push eax
mov ecx, dword [ebp - 0x1120]
call fcn.00402d00
mov dword [ebp - 0x1118], eax
mov ecx, dword [ebp - 0x1158]
mov dword [ebp - 0x11d0], ecx
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
cmp dword [ebp - 0x1118], 0
jge 0x40796c
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0x11a0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1158]
call fcn.00401d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11a0]
jmp 0x4080da
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1158]
call fcn.00401d20
jmp 0x408042
cmp dword [ebp + 0x14], 0
jne 0x407a75
cmp dword [ebp - 0x1138], 0
je 0x407a75
mov dword [ebp - 0x119c], 0
mov dword [ebp - 0x1198], 0
mov dword [ebp - 0x1194], 0
push 0x20006
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x119c]
call fcn.00405d10
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
jne 0x407a45
xor ecx, ecx
jne 0x4079ee
lea edx, [ebp - 0x1114]
push edx
mov eax, dword [ebp - 0x119c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x407a43
cmp dword [ebp - 0x111c], 2
je 0x407a43
mov ecx, dword [ebp - 0x111c]
push ecx
call fcn.00403db0
add esp, 4
mov dword [ebp - 0x1118], eax
lea ecx, [ebp - 0x119c]
call fcn.00401d20
jmp 0x4080b6
jmp 0x407a6a
mov edx, dword [ebp - 0x111c]
push edx
call fcn.00403db0
add esp, 4
mov dword [ebp - 0x1118], eax
lea ecx, [ebp - 0x119c]
call fcn.00401d20
jmp 0x4080b6
lea ecx, [ebp - 0x119c]
call fcn.00401d20
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1120]
call fcn.004099b0
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407a98
jmp 0x4080b6
jmp 0x4074fe
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1134], ecx
mov dword [ebp - 0x117c], 0
cmp dword [ebp - 0x1134], 0
jne 0x407ac5
mov dword [ebp - 0x1180], 0
jmp 0x407b0f
mov edx, dword [ebp - 0x1134]
movsx eax, byte [edx]
test eax, eax
je 0x407b03
mov ecx, dword [ebp - 0x1134]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x407aee
mov eax, dword [ebp - 0x1134]
mov dword [ebp - 0x117c], eax
jmp 0x407b03
mov ecx, dword [ebp - 0x1134]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1134], eax
jmp 0x407ac5
mov edx, dword [ebp - 0x117c]
mov dword [ebp - 0x1180], edx
cmp dword [ebp - 0x1180], 0
je 0x407b3f
mov dword [ebp - 0x11a4], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11a4]
jmp 0x4080da
cmp dword [ebp + 0x10], 0
je 0x407c5b
push 0x2001f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x112c]
call fcn.00405d10
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x407bfc
push 0x20019
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x112c]
call fcn.00405d10
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x407bfc
push 0
push 0
push 0x2001f
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x112c]
call fcn.00404520
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x407bfc
mov eax, dword [ebp - 0x111c]
push eax
call fcn.00403db0
add esp, 4
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11a8]
jmp 0x4080da
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407c1f
jmp 0x4080b6
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x3d
jne 0x407c56
mov ecx, dword [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0x112c]
push edx
mov ecx, dword [ebp - 0x1120]
call fcn.00402d00
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407c56
jmp 0x4080b6
jmp 0x408042
cmp dword [ebp + 0x14], 0
jne 0x407c81
push 0x20019
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x112c]
call fcn.00405d10
mov dword [ebp - 0x111c], eax
jmp 0x407c8b
mov dword [ebp - 0x111c], 2
cmp dword [ebp - 0x111c], 0
je 0x407c9b
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x114]
push eax
call fcn.0041ce48
add esp, 0x10
mov dword [ebp - 0x1188], eax
mov ecx, dword [ebp - 0x1188]
mov dword [ebp - 0x1184], ecx
cmp dword [ebp - 0x1184], 0x50
ja case.0x407cdd.1
mov edx, dword [ebp - 0x1184]
movzx eax, byte [edx + 0x408108]
jmp dword [eax*4 + 0x4080f8]
push 0x8007000e
call fcn.00403df0
jmp 0x407d08
push 0x80070057
call fcn.00403df0
jmp 0x407d08
jmp 0x407d08
push 0x80004005
call fcn.00403df0
mov ecx, dword [ebp - 0x1188]
mov dword [ebp - 0x11d4], ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407d37
jmp 0x4080b6
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1120]
call fcn.004099b0
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407d5a
jmp 0x4080b6
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x7b
jne 0x407dd1
mov eax, dword [ebp + 8]
push eax
call fcn.0041ce60
add esp, 4
cmp eax, 1
jne 0x407dd1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x112c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00407440
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407dae
cmp dword [ebp + 0x14], 0
jne 0x407dae
jmp 0x4080b6
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x407dd1
jmp 0x4080b6
mov eax, dword [ebp - 0x11ac]
mov dword [ebp + 0x14], eax
cmp dword [ebp - 0x111c], 2
jne 0x407de8
jmp 0x4074fe
cmp dword [ebp - 0x111c], 0
je 0x407e18
cmp dword [ebp + 0x14], 0
je 0x407dfe
jmp 0x4074fe
mov ecx, dword [ebp - 0x111c]
push ecx
call fcn.00403db0
add esp, 4
mov dword [ebp - 0x1118], eax
jmp 0x4080b6
cmp dword [ebp + 0x14], 0
je 0x407ecc
mov edx, dword [ebp - 0x112c]
mov dword [ebp - 0x11b0], edx
mov eax, dword [ebp - 0x11b0]
push eax
mov ecx, dword [ebp - 0x1120]
call fcn.00404da0
test eax, eax
je 0x407ecc
mov dword [ebp - 0x114c], 0
jmp 0x407e63
mov ecx, dword [ebp - 0x114c]
add ecx, 1
mov dword [ebp - 0x114c], ecx
cmp dword [ebp - 0x114c], 0xc
jge 0x407e99
mov edx, dword [ebp - 0x114c]
mov eax, dword [edx*4 + 0x44c5fc]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407e97
mov dword [ebp - 0x118c], 0
jmp 0x407ea3
jmp 0x407e54
mov dword [ebp - 0x118c], 1
cmp dword [ebp - 0x118c], 0
je 0x407ec7
cmp dword [ebp - 0x1138], 0
je 0x407ec7
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x112c]
call fcn.004068a0
jmp 0x4074fe
mov eax, dword [ebp - 0x112c]
mov dword [ebp - 0x11b4], eax
mov ecx, dword [ebp - 0x11b4]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00404da0
mov dword [ebp - 0x11bc], eax
mov dword [ebp - 0x1190], 0
cmp dword [ebp - 0x112c], 0
je 0x407f20
mov edx, dword [ebp - 0x112c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x112c], 0
mov dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x407f71
mov ecx, dword [ebp - 0x111c]
push ecx
call fcn.00403db0
add esp, 4
mov dword [ebp - 0x11b8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11b8]
jmp 0x4080da
cmp dword [ebp - 0x1138], 0
je 0x408042
cmp dword [ebp - 0x11bc], 0
jne 0x408042
mov dword [ebp - 0x1164], 0
mov dword [ebp - 0x1160], 0
mov dword [ebp - 0x115c], 0
xor edx, edx
jne 0x407fa9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1164], eax
mov dword [ebp - 0x1160], 0
mov dword [ebp - 0x115c], 0
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x1164]
call fcn.00404610
mov dword [ebp - 0x111c], eax
mov edx, dword [ebp - 0x1164]
mov dword [ebp - 0x11d8], edx
mov dword [ebp - 0x1164], 0
mov dword [ebp - 0x1160], 0
mov dword [ebp - 0x115c], 0
cmp dword [ebp - 0x111c], 0
je 0x408037
mov eax, dword [ebp - 0x111c]
push eax
call fcn.00403db0
add esp, 4
mov dword [ebp - 0x1118], eax
lea ecx, [ebp - 0x1164]
call fcn.00401d20
jmp 0x4080b6
lea ecx, [ebp - 0x1164]
call fcn.00401d20
cmp dword [ebp + 0x10], 0
je 0x4080b1
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x7b
jne 0x4080b1
mov eax, dword [ebp + 8]
push eax
call fcn.0041ce60
add esp, 4
cmp eax, 1
jne 0x4080b1
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x112c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1120]
call fcn.00407440
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x408091
jmp 0x4080b6
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1120]
call fcn.00405290
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0
jge 0x4080b1
jmp 0x4080b6
jmp 0x4074fe
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0x11c0], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x112c]
call fcn.00401d20
mov eax, dword [ebp - 0x11c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d9dd
mov esp, ebp
pop ebp
ret 0x10