Function at 0x409ca1
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d69c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2254
call fcn.0043bd10
mov eax, dword [0x46b908]
xor eax, esp
mov dword [esp + 0x2250], eax
push ebx
push esi
push edi
mov eax, dword [0x46b908]
xor eax, esp
push eax
lea eax, [esp + 0x2268]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2270], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x50], ecx
push edi
mov ecx, eax
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a215
push 0x7d
pop eax
cmp word [edi], ax
je 0x40a20a
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb esi, esi
push str.ForceRemove
inc esi
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x409d66
test esi, esi
je 0x409e11
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x409e13
push 0x5c
pop edx
mov ecx, edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.0040962f
test eax, eax
jne 0x40a205
push edi
call fcn.00409af4
test eax, eax
je 0x409dd3
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.004077be
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
cmp dword [esp + 0x18], esi
je 0x409e0b
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409a8f
mov esi, eax
test esi, esi
js 0x40a20a
and dword [esp + 0x30], 0
jmp 0x40a00a
mov dword [esp + 0x30], esi
jmp 0x409e13
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x409e3b
mov ecx, dword [esp + 0x10]
push edi
mov dword [esp + 0x2c], esi
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
push 0x4632d4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x409f6f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x25c]
push eax
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40a205
cmp dword [ebp + 0x10], 0
je 0x409eeb
mov ecx, dword [esp + 0x10]
xor eax, eax
inc eax
mov byte [esp + 0x2270], al
mov eax, dword [esp + 0x14]
and dword [esp + 0x48], 0
and dword [esp + 0x4c], 0
mov dword [esp + 0x44], eax
push edi
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0040970a
mov esi, eax
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
test esi, esi
js 0x40a20a
mov byte [esp + 0x2270], al
mov dword [esp + 0x48], eax
jmp 0x40a00a
cmp dword [ebp + 0x14], 0
jne 0x409f56
cmp dword [esp + 0x28], 0
je 0x409f56
xor eax, eax
push 0x20006
push eax
push dword [esp + 0x1c]
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
call fcn.00407a06
test eax, eax
jne 0x40a1da
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x25c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x409f41
cmp eax, 2
jne 0x40a1da
test esi, esi
je 0x409f51
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esp + 0x38], 0
and dword [esp + 0x3c], 0
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409a8f
mov esi, eax
test esi, esi
js 0x40a20a
jmp 0x409d26
push 0x5c
pop edx
mov ecx, edi
call fcn.0040962f
test eax, eax
jne 0x40a205
cmp dword [ebp + 0x10], eax
je 0x40a051
mov ebx, dword [esp + 0x14]
mov esi, 0x2001f
push esi
push edi
push ebx
lea ecx, [esp + 0x28]
call fcn.00407a06
test eax, eax
je 0x409fcf
push 0x20019
push edi
push ebx
lea ecx, [esp + 0x28]
call fcn.00407a06
test eax, eax
je 0x409fcf
push ecx
push ecx
push esi
push ecx
push ecx
push edi
push ebx
lea ecx, [esp + 0x38]
call fcn.00407945
test eax, eax
jne 0x40a1f6
mov ebx, dword [esp + 0x10]
push edi
mov ecx, ebx
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a1ff
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40a006
push edi
push 0
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.0040970a
mov esi, eax
test esi, esi
js 0x40a1ff
mov ebx, dword [esp + 0x1c]
push 0x7b
pop eax
cmp word [edi], ax
jne 0x409d26
push edi
call fcn.0041f3b9
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x409d26
mov ecx, dword [esp + 0x10]
push 0
push dword [ebp + 0x10]
push ebx
push edi
call fcn.00409ca1
mov esi, eax
test esi, esi
js 0x40a20a
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409b63
jmp 0x409f60
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x40a071
push 0x20019
push edi
push dword [esp + 0x1c]
lea ecx, [esp + 0x28]
call fcn.00407a06
mov ebx, dword [esp + 0x1c]
jmp 0x40a074
push 2
pop eax
push 1
test eax, eax
mov dword [esp + 0x1c], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
push edi
lea eax, [esp + 0x5c]
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.00421430
push eax
call fcn.0040116b
mov ecx, dword [esp + 0x24]
add esp, 0x14
push edi
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409a8f
mov esi, eax
test esi, esi
js 0x40a20a
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40a110
push edi
call fcn.0041f3b9
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x40a110
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
push 0
push ebx
push edi
call fcn.00409ca1
mov esi, eax
test esi, esi
jns 0x40a0fc
cmp dword [ebp + 0x14], 0
je 0x40a20a
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409b63
mov esi, eax
test esi, esi
js 0x40a20a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x50]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x409d26
test eax, eax
je 0x40a13e
test ecx, ecx
jne 0x409d26
mov ecx, eax
call fcn.00409b55
mov esi, eax
jmp 0x40a20a
test ecx, ecx
je 0x40a180
push ebx
call fcn.00409b20
test eax, eax
je 0x40a180
lea eax, [esp + 0x54]
push eax
call fcn.00409af4
test eax, eax
je 0x409d26
cmp dword [esp + 0x28], 0
je 0x409d26
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x20]
call fcn.004077be
mov ebx, dword [esp + 0x1c]
jmp 0x409d26
push ebx
call fcn.00409b20
mov ecx, eax
xor eax, eax
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x40a1a3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
and dword [esp + 0x20], 0
test eax, eax
jne 0x40a130
cmp dword [esp + 0x28], eax
je 0x409d26
test ecx, ecx
jne 0x409d26
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40a130
jmp 0x409d26
mov ecx, eax
call fcn.00409b55
cmp dword [esp + 0x38], 0
mov esi, eax
je 0x40a20a
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a20a
mov ecx, eax
call fcn.00409b55
mov esi, eax
mov ebx, dword [esp + 0x1c]
jmp 0x40a20a
mov esi, 0x80020009
test ebx, ebx
je 0x40a215
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x2268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2250]
xor ecx, esp
call fcn.0041f3aa
mov esp, ebp
pop ebp
ret 0x10