Function at 0x40cc90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x482716
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.0044c760
mov eax, dword [0x4ae364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2238], ebx
mov dword [ebp - 0x2234], ebx
mov dword [ebp - 0x2230], ebx
push edi
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3e6
cmp word [edi], 0x7d
je 0x40d3d9
nop dword [eax]
push 0x48a9d4
push edi
mov dword [ebp - 0x2220], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x48a9a8
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2224], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40cd49
test esi, esi
je 0x40ce36
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
cmp dword [ebp + 0x10], 0
je 0x40ce36
movzx ecx, word [edi]
mov eax, edi
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x2240], 0
mov dword [ebp - 0x223c], 0
test cx, cx
je 0x40cdb4
mov edx, ecx
cmp dx, 0x5c
je 0x40cdac
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x40cd93
jmp 0x40cdb4
test eax, eax
jne 0x40d39b
mov esi, 0x48a9e4
nop dword [eax]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40cdfa
add esi, 4
cmp esi, 0x48aa14
jl 0x40cdc0
mov eax, dword [ebp - 0x2228]
lea ecx, [ebp - 0x2244]
push edi
mov dword [ebp - 0x2244], eax
call fcn.0040c7b0
mov dword [ebp - 0x2244], 0
cmp dword [ebp - 0x2224], 0
je 0x40ce36
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40ce2b
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040d550
mov esi, eax
test esi, esi
jns 0x40d128
lea ecx, [ebp - 0x2244]
jmp 0x40d3d4
push 0x48a9c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40ce62
mov ecx, dword [ebp - 0x221c]
push edi
mov dword [ebp - 0x2220], eax
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
push 0x48a9a0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40cfcd
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
push eax
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
cmp word [edi], 0x3d
jne 0x40d3a6
cmp dword [ebp + 0x10], 0
je 0x40cf13
mov dword [ebp - 0x2264], 0
mov dword [ebp - 0x2260], 0
mov eax, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
mov dword [ebp - 0x2268], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2268]
mov byte [ebp - 4], 1
push eax
call fcn.0040b600
mov esi, eax
mov dword [ebp - 0x2268], 0
test esi, esi
js 0x40d3ad
mov byte [ebp - 4], 0
jmp 0x40d128
cmp dword [ebp + 0x14], 0
jne 0x40cfb2
cmp dword [ebp - 0x2220], 0
je 0x40cfb2
lea eax, [ebp - 0x2220]
mov dword [ebp - 0x2250], 0
push eax
push 0x20006
push 0
push 0
push dword [ebp - 0x2228]
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2220], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d3b5
mov esi, dword [ebp - 0x2220]
lea eax, [ebp - 0x2218]
push eax
push esi
mov dword [ebp - 0x2250], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40cf9d
cmp eax, 2
jne 0x40d3b5
test esi, esi
je 0x40cfb2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2250], 0
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040d550
mov esi, eax
test esi, esi
js 0x40d3d9
jmp 0x40d38f
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x40d001
mov edx, ecx
nop dword [eax]
cmp dx, 0x5c
je 0x40cff9
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x40cfe0
jmp 0x40d001
test eax, eax
jne 0x40d3a6
cmp dword [ebp + 0x10], 0
je 0x40d179
mov esi, dword [ebp - 0x2228]
lea eax, [ebp - 0x2220]
push eax
push 0x2001f
push 0
push edi
push esi
mov dword [ebp - 0x2220], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d054
test ebx, ebx
je 0x40d040
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2238], ebx
test eax, eax
je 0x40d0e7
lea eax, [ebp - 0x2220]
mov dword [ebp - 0x2220], 0
push eax
push 0x20019
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d093
test ebx, ebx
je 0x40d083
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2238], ebx
test eax, eax
je 0x40d0e7
lea eax, [ebp - 0x226c]
mov dword [ebp - 0x2220], 0
push eax
lea eax, [ebp - 0x2220]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d2a2
test ebx, ebx
je 0x40d0d3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2238], ebx
test eax, eax
jne 0x40d2a2
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
cmp word [edi], 0x3d
jne 0x40d128
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2238]
push edi
push 0
push eax
call fcn.0040b600
mov ebx, dword [ebp - 0x2238]
mov esi, eax
test esi, esi
js 0x40d3d9
cmp word [edi], 0x7b
jne 0x40d38f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x40d38f
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp + 0x10]
push ebx
push edi
call fcn.0040cc90
mov esi, eax
test esi, esi
js 0x40d3d9
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
jmp 0x40d38f
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x40d1cf
lea eax, [ebp - 0x2224]
mov dword [ebp - 0x2224], esi
push eax
push 0x20019
push esi
push edi
push dword [ebp - 0x2228]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x222c], eax
test eax, eax
jne 0x40d1da
mov dword [ebp - 0x222c], eax
test ebx, ebx
je 0x40d1c1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x222c], eax
mov ebx, dword [ebp - 0x2224]
mov dword [ebp - 0x2238], ebx
jmp 0x40d1da
mov eax, 2
mov dword [ebp - 0x222c], eax
test eax, eax
mov ecx, esi
push 0xffffffffffffffff
mov eax, 1
cmovne ecx, eax
lea eax, [ebp - 0x218]
push edi
push 0x104
push eax
mov dword [ebp - 0x2224], ecx
call fcn.0046856a
push eax
call fcn.0040bcd0
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040d550
mov esi, eax
test esi, esi
js 0x40d3d9
cmp word [edi], 0x7b
jne 0x40d285
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x40d285
push dword [ebp - 0x2224]
mov ecx, dword [ebp - 0x221c]
push 0
push ebx
push edi
call fcn.0040cc90
mov esi, eax
test esi, esi
jns 0x40d26f
cmp dword [ebp - 0x2224], 0
je 0x40d3d9
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040c360
mov esi, eax
test esi, esi
js 0x40d3d9
mov eax, dword [ebp - 0x222c]
cmp eax, 2
je 0x40d38f
test eax, eax
je 0x40d2b2
cmp dword [ebp + 0x14], 0
jne 0x40d38f
push eax
call fcn.0040bd90
add esp, 4
mov esi, eax
jmp 0x40d3d9
cmp dword [ebp + 0x14], 0
je 0x40d30c
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.0040c0c0
test eax, eax
je 0x40d30c
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x218]
push eax
call fcn.0040bdd0
test eax, eax
je 0x40d38f
cmp dword [ebp - 0x2220], 0
je 0x40d38f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2238]
call fcn.0040c7b0
mov ebx, dword [ebp - 0x2238]
jmp 0x40d38f
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.0040c0c0
mov dword [ebp - 0x2224], eax
test ebx, ebx
je 0x40d33f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x2238], ebx
test eax, eax
jne 0x40d2a2
mov eax, dword [ebp - 0x2224]
cmp dword [ebp - 0x2220], 0
je 0x40d38f
test eax, eax
jne 0x40d38f
mov dword [ebp - 0x2258], eax
lea ecx, [ebp - 0x225c]
mov dword [ebp - 0x2254], eax
mov eax, dword [ebp - 0x2228]
mov dword [ebp - 0x225c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040bed0
mov dword [ebp - 0x225c], 0
test eax, eax
jne 0x40d3c3
lea ecx, [ebp - 0x225c]
call fcn.0040b010
cmp word [edi], 0x7d
jne 0x40cd10
jmp 0x40d3d9
lea ecx, [ebp - 0x2244]
call fcn.0040b010
mov esi, 0x80020009
jmp 0x40d3d9
lea ecx, [ebp - 0x2268]
jmp 0x40d3d4
push eax
call fcn.0040bd90
lea ecx, [ebp - 0x2250]
jmp 0x40d3cf
push eax
call fcn.0040bd90
lea ecx, [ebp - 0x225c]
add esp, 4
mov esi, eax
call fcn.0040b010
test ebx, ebx
je 0x40d3e4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044c213
mov esp, ebp
pop ebp
ret 0x10