Function at 0x4079a5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2244
call fcn.00415b60
mov eax, dword [ebp + 0x14]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x24], eax
push edi
mov eax, ebx
mov dword [ebp - 4], ecx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d69
cmp word [ebx], 0x7d
je 0x407d67
mov edi, dword [0x41703c]
push 0x419a68
push ebx
mov dword [ebp - 0x18], 1
call edi
mov esi, eax
neg esi
push 0x419d9c
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x407a14
test esi, esi
je 0x407aa3
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x407aa5
push 0x5c
mov eax, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call fcn.0040728d
pop ecx
test eax, eax
jne 0x407e68
push ebx
call fcn.004076de
test eax, eax
je 0x407a69
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
call fcn.0040770a
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
cmp esi, edi
je 0x407a9e
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.00407695
mov edi, eax
test edi, edi
jl 0x407d58
and dword [ebp - 0x1c], 0
jmp 0x407e12
mov dword [ebp - 0x1c], edi
jmp 0x407aa5
xor edi, edi
push 0x419d88
push ebx
call dword [0x41703c]
test eax, eax
jne 0x407ace
and dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
xor edi, edi
push 0x419db4
push ebx
call dword [0x41703c]
test eax, eax
jne 0x407bc1
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x2240]
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
cmp word [ebx], 0x3d
jne 0x407e80
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x407b54
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 0x2240]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x28], esi
call fcn.00407396
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
jl 0x407ec7
mov dword [ebp - 0x28], esi
jmp 0x407e12
cmp dword [ebp + 0x14], esi
jne 0x407bae
cmp dword [ebp - 0x18], esi
je 0x407bae
push esi
push dword [ebp + 0xc]
mov eax, 0x20006
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00404260
cmp eax, esi
jne 0x407e86
lea eax, [ebp - 0x2240]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x407b9a
cmp eax, 2
jne 0x407e86
cmp dword [ebp - 0x14], esi
je 0x407bab
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.00407695
mov edi, eax
cmp edi, esi
jmp 0x407e53
push 0x5c
mov eax, ebx
call fcn.0040728d
pop ecx
test eax, eax
jne 0x407e68
cmp dword [ebp + 0x10], edi
je 0x407c85
push ebx
push dword [ebp + 0xc]
mov esi, 0x2001f
mov eax, esi
lea ecx, [ebp - 0xc]
call fcn.00404260
test eax, eax
je 0x407c49
push ebx
push dword [ebp + 0xc]
lea eax, [esi - 6]
lea ecx, [ebp - 0xc]
call fcn.00404260
test eax, eax
je 0x407c49
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push edi
push edi
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x407ea4
xor eax, eax
cmp dword [ebp - 0xc], edi
je 0x407c38
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
cmp eax, edi
jne 0x407ea4
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
cmp word [ebx], 0x3d
jne 0x407e12
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.00407396
mov edi, eax
test edi, edi
jl 0x407d58
jmp 0x407e12
cmp dword [ebp + 0x14], edi
jne 0x407ca0
push ebx
push dword [ebp + 0xc]
mov eax, 0x20019
lea ecx, [ebp - 0xc]
call fcn.00404260
mov dword [ebp + 8], eax
jmp 0x407ca7
mov dword [ebp + 8], 2
cmp dword [ebp + 8], edi
je 0x407cb3
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x240]
push 0x104
push eax
call fcn.0040f7c1
push eax
call fcn.00404bce
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
mov ecx, dword [ebp - 4]
mov edi, ebx
call fcn.00407695
mov edi, eax
test edi, edi
jl 0x407d58
cmp word [ebx], 0x7b
jne 0x407d2f
push ebx
call dword [0x4171f8]
cmp eax, 1
jne 0x407d2f
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 0xc]
push ebx
call fcn.004079a5
mov edi, eax
test edi, edi
jge 0x407d1f
cmp dword [ebp + 0x14], 0
je 0x407d58
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x14], eax
je 0x407e59
xor esi, esi
cmp dword [ebp + 8], esi
je 0x407d70
cmp eax, esi
jne 0x407e59
mov eax, dword [ebp + 8]
call fcn.00407860
mov edi, eax
cmp dword [ebp - 0xc], 0
je 0x407d67
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp eax, esi
je 0x407db2
push dword [ebp - 0xc]
call fcn.004077d4
test eax, eax
je 0x407db2
lea eax, [ebp - 0x240]
push eax
call fcn.004076de
test eax, eax
je 0x407e59
cmp dword [ebp - 0x18], 0
je 0x407e59
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040770a
jmp 0x407e59
push dword [ebp - 0xc]
call fcn.004077d4
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp - 0xc], esi
je 0x407dd0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
cmp eax, esi
jne 0x407ec0
cmp dword [ebp - 0x18], esi
je 0x407e59
cmp dword [ebp + 8], 0
jne 0x407e59
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x240]
push eax
lea esi, [ebp - 0x34]
call fcn.00407809
and dword [ebp - 0x34], 0
and dword [ebp - 0x30], 0
test eax, eax
jne 0x407d51
and dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
je 0x407e59
cmp word [ebx], 0x7b
jne 0x407e59
push ebx
call dword [0x4171f8]
cmp eax, 1
jne 0x407e59
mov ecx, dword [ebp - 4]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push ebx
call fcn.004079a5
mov edi, eax
test edi, edi
jl 0x407d58
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0040788f
mov edi, eax
test edi, edi
jl 0x407d58
cmp word [ebx], 0x7d
jne 0x4079e4
jmp 0x407d58
cmp dword [ebp - 0xc], edi
je 0x407e76
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x407d69
cmp dword [ebp - 0xc], 0
jmp 0x407e6b
call fcn.00407860
mov edi, eax
cmp dword [ebp - 0x14], esi
je 0x407d58
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407d58
call fcn.00407860
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x407eb9
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x407d69
call fcn.00407860
mov edi, eax
cmp dword [ebp - 0xc], esi
jmp 0x407d5c