Function at 0x40e640
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x415941
push eax
mov eax, 0x311c
mov dword fs:[0], esp
call fcn.00414820
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x3144]
lea ecx, [esp + 0x12c]
push ecx
mov ecx, edi
mov dword [esp + 0x3138], ebx
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], eax
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp byte [esp + 0x12c], 0x7d
je 0x40ec92
mov edx, dword [str.Delete]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [esp + 0x12c]
push edx
push eax
call esi
mov ecx, dword [str.ForceRemove]
mov ebp, eax
neg ebp
lea edx, [esp + 0x12c]
push ecx
sbb ebp, ebp
push edx
inc ebp
call esi
test eax, eax
je 0x40e6e7
cmp ebp, ebx
je 0x40e7c1
lea eax, [esp + 0x12c]
mov ecx, edi
push eax
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp dword [esp + 0x3140], ebx
je 0x40e7c1
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x12c]
push 0x5c
push ecx
mov byte [esp + 0x313c], 1
call fcn.0040ecd0
add esp, 8
test eax, eax
jne 0x40ec48
lea edx, [esp + 0x12c]
mov ecx, edi
push edx
call fcn.0040e550
test eax, eax
je 0x40e766
mov eax, dword [esp + 0x313c]
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.004117e0
mov dword [esp + 0x14], ebx
cmp ebp, ebx
je 0x40e7b1
lea edx, [esp + 0x12c]
mov ecx, edi
push edx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec56
lea eax, [esp + 0x12c]
mov ecx, edi
push eax
call fcn.0040e5e0
mov esi, eax
mov byte [esp + 0x3134], bl
cmp esi, ebx
lea ecx, [esp + 0x14]
jl 0x40ec6f
call fcn.00411540
jmp 0x40ebfa
lea ecx, [esp + 0x14]
mov byte [esp + 0x3134], bl
call fcn.00411540
mov ecx, dword [str.NoRemove]
lea edx, [esp + 0x12c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40e7f7
lea eax, [esp + 0x12c]
mov ecx, edi
push eax
mov dword [esp + 0x20], ebx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
mov ecx, dword [0x4177b0]
lea edx, [esp + 0x12c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40e8d2
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
lea ecx, [esp + 0x12c]
push ecx
mov ecx, edi
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp byte [esp + 0x12c], 0x3d
jne 0x40ec68
cmp dword [esp + 0x3140], ebx
je 0x40e8a9
mov edx, dword [esp + 0x313c]
lea eax, [esp + 0x12c]
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, edi
mov byte [esp + 0x3140], 2
call fcn.0040e3a0
mov esi, eax
mov dword [esp + 0x14], ebx
cmp esi, ebx
mov byte [esp + 0x3134], bl
lea ecx, [esp + 0x14]
jl 0x40ec6f
call fcn.00411540
jmp 0x40ebfa
cmp dword [esp + 0x3144], ebx
jne 0x40e8c5
mov ecx, dword [esp + 0x313c]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea edx, [esp + 0x12c]
push edx
jmp 0x40eb14
lea eax, [esp + 0x12c]
push 0x5c
push eax
call fcn.0040ecd0
add esp, 8
test eax, eax
jne 0x40ec76
cmp dword [esp + 0x3140], ebx
je 0x40e9a4
mov esi, dword [esp + 0x313c]
lea ecx, [esp + 0x12c]
push 0xf003f
push ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.004115c0
cmp eax, ebx
je 0x40e959
lea edx, [esp + 0x12c]
push 0x20019
push edx
push esi
lea ecx, [esp + 0x1c]
call fcn.004115c0
cmp eax, ebx
je 0x40e959
push ebx
push ebx
push 0xf003f
push ebx
lea eax, [esp + 0x13c]
push ebx
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.00411560
cmp eax, ebx
jne 0x40ec7d
lea ecx, [esp + 0x12c]
push ecx
mov ecx, edi
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp byte [esp + 0x12c], 0x3d
jne 0x40ebfa
lea edx, [esp + 0x12c]
lea eax, [esp + 0x10]
push edx
push ebx
push eax
mov ecx, edi
call fcn.0040e3a0
mov esi, eax
cmp esi, ebx
jl 0x40ec92
jmp 0x40ebfa
mov ebp, dword [esp + 0x3144]
cmp ebp, ebx
jne 0x40e9e3
mov edx, dword [esp + 0x313c]
lea ecx, [esp + 0x12c]
push 0xf003f
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004115c0
test eax, eax
je 0x40e9e3
mov dword [esp + 0x3144], 1
mov ebp, dword [esp + 0x3144]
lea eax, [esp + 0x12c]
push 0x104
lea ecx, [esp + 0x1130]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp ebp, ebx
jne 0x40ea90
mov edx, dword [esp + 0x10]
mov ecx, edi
push edx
call fcn.0040e590
test eax, eax
jne 0x40ea90
push ebx
mov eax, dword [esp + 0x14]
push ebx
push ebx
lea ecx, [esp + 0x24]
push ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov esi, eax
mov dword [esp + 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
je 0x40ea3e
xor eax, eax
jmp 0x40ea88
mov eax, dword [esp + 0x18]
cmp eax, 1
jne 0x40ea80
push ebx
push ebx
push ebx
lea edx, [esp + 0x2c]
push ebx
lea eax, [esp + 0x213c]
push edx
push eax
push ebx
push esi
mov dword [esp + 0x40], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
jne 0x40ea7c
cmp byte [esp + 0x212c], bl
je 0x40ea7c
mov eax, 1
jmp 0x40ea88
xor eax, eax
jmp 0x40ea88
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, ebx
je 0x40eb93
lea edx, [esp + 0x12c]
mov ecx, edi
push edx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
lea eax, [esp + 0x12c]
mov ecx, edi
push eax
call fcn.0040e5e0
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp byte [esp + 0x12c], 0x7b
jne 0x40eb2a
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
mov ecx, edi
call fcn.0040e640
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp ebp, ebx
je 0x40eb32
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x12c]
push eax
mov ecx, edi
mov dword [esp + 0x3148], edx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
lea ecx, [esp + 0x12c]
push ecx
mov ecx, edi
call fcn.0040e5e0
mov esi, eax
cmp esi, ebx
jl 0x40ec92
jmp 0x40ec38
cmp ebp, ebx
jne 0x40ec38
mov edx, dword [esp + 0x10]
mov ecx, edi
push edx
call fcn.0040e590
test eax, eax
je 0x40eb84
lea eax, [esp + 0x112c]
mov ecx, edi
push eax
call fcn.0040e550
test eax, eax
je 0x40eb66
lea ecx, [esp + 0x112c]
push ecx
lea ecx, [esp + 0x14]
call fcn.004117e0
lea edx, [esp + 0x12c]
mov ecx, edi
push edx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
jmp 0x40ec38
cmp ebp, ebx
jne 0x40ec38
mov ebp, dword [esp + 0x3144]
cmp ebp, ebx
jne 0x40ebc8
lea ecx, [esp + 0x10]
call fcn.00411540
test eax, eax
jne 0x40ec84
cmp ebp, ebx
jne 0x40ebc8
cmp dword [esp + 0x1c], ebx
je 0x40ebc8
mov ecx, dword [esp + 0x313c]
lea eax, [esp + 0x112c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea edx, [esp + 0x12c]
mov ecx, edi
push edx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
lea eax, [esp + 0x12c]
mov ecx, edi
push eax
call fcn.0040e5e0
mov esi, eax
cmp esi, ebx
jl 0x40ec92
mov eax, dword [esp + 0x3140]
cmp eax, ebx
je 0x40ec38
cmp byte [esp + 0x12c], 0x7b
jne 0x40ec38
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ecx
mov ecx, edi
call fcn.0040e640
mov esi, eax
cmp esi, ebx
jl 0x40ec92
lea edx, [esp + 0x12c]
mov ecx, edi
push edx
call fcn.0040e290
mov esi, eax
cmp esi, ebx
jl 0x40ec92
cmp byte [esp + 0x12c], 0x7d
jne 0x40e6ac
jmp 0x40ec92
push 0x211
mov ecx, edi
call fcn.0040e1b0
mov esi, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3134], bl
call fcn.00411540
jmp 0x40ec92
push 0x206
jmp 0x40ec89
call fcn.00411540
jmp 0x40ec92
push 0x211
jmp 0x40ec89
push 0x207
jmp 0x40ec89
push 0x20a
mov ecx, edi
call fcn.0040e1b0
mov esi, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x3134], 0xffffffff
call fcn.00411540
mov ecx, dword [esp + 0x312c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3128
ret 0xc