Function at 0x40b2e0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
sub esp, 0x208
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
mov ebp, dword [esp + 0x214]
push edi
lea ebx, [ebp + 2]
push 0x20006
push ebx
call fcn.0040ad70
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b330
lea eax, [edi + 1]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.00414aec
add esp, 0x208
ret
push esi
push 1
mov eax, 0xff
lea ecx, [esp + 0x18]
xor esi, esi
mov edx, ebx
call fcn.00409b10
mov esi, eax
lea eax, [ebp + 0x18416]
push eax
push 0x422ab0
push edi
call fcn.0040a2f0
add esp, 0x10
test eax, eax
je 0x40b385
test esi, esi
jle 0x40b374
lea ecx, [esp + 0x14]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
jmp 0x40bc5e
lea edx, [ebp + 0x28414]
push edx
push str.AppParameters
push edi
call fcn.0040a2f0
add esp, 0xc
test eax, eax
je 0x40b3c3
test esi, esi
jle 0x40b3b2
lea eax, [esp + 0x14]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x40bc5e
lea ecx, [ebp + 0x30412]
push ecx
push str.AppDirectory
push edi
call fcn.0040a2f0
add esp, 0xc
test eax, eax
je 0x40b401
test esi, esi
jle 0x40b3f0
lea edx, [esp + 0x14]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x40bc5e
mov eax, dword [ebp + 0x4041c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 0x20
je 0x40b423
push eax
push str.AppPriority
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b435
cmp byte [esp + 0x220], 0
je 0x40b435
push str.AppPriority
push edi
call esi
mov eax, dword [ebp + 0x40400]
mov ecx, dword [ebp + 0x40404]
mov edx, eax
or edx, ecx
je 0x40b4f4
lea edx, [esp + 0x10]
push edx
push ecx
push eax
call fcn.0040c570
add esp, 0xc
test eax, eax
jne 0x40b4da
mov edx, dword [esp + 0x10]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b467
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push str.AppAffinity
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b4d4
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppAffinity
push 0xc00003fb
push 1
call fcn.00402230
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 5
jmp 0x40bc5e
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40b506
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40b506
cmp byte [esp + 0x220], 0
je 0x40b506
push str.AppAffinity
push edi
call esi
mov eax, dword [ebp + 0x7049c]
not eax
test eax, eax
je 0x40b523
push eax
push str.AppStopMethodSkip
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b535
cmp byte [esp + 0x220], 0
je 0x40b535
push str.AppStopMethodSkip
push edi
call esi
mov eax, dword [ebp + 0x70490]
cmp eax, 4
jae 0x40b559
mov edx, dword [esp + 0x220]
mov eax, dword [eax*4 + 0x42802c]
push edx
push eax
push ebx
call fcn.00409d90
add esp, 0xc
mov eax, dword [ebp + 0x70494]
test eax, eax
je 0x40b574
push eax
push str.AppRestartDelay
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b586
cmp byte [esp + 0x220], 0
je 0x40b586
push str.AppRestartDelay
push edi
call esi
mov eax, dword [ebp + 0x70498]
cmp eax, 0x5dc
je 0x40b5a4
push eax
push str.AppThrottle
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b5b6
cmp byte [esp + 0x220], 0
je 0x40b5b6
push str.AppThrottle
push edi
call esi
mov eax, dword [ebp + 0x704a0]
cmp eax, 0x5dc
je 0x40b5d4
push eax
push str.AppStopMethodConsole
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b5e6
cmp byte [esp + 0x220], 0
je 0x40b5e6
push str.AppStopMethodConsole
push edi
call esi
mov eax, dword [ebp + 0x704a4]
cmp eax, 0x5dc
je 0x40b604
push eax
push str.AppStopMethodWindow
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b616
cmp byte [esp + 0x220], 0
je 0x40b616
push str.AppStopMethodWindow
push edi
call esi
mov eax, dword [ebp + 0x704a8]
cmp eax, 0x5dc
je 0x40b634
push eax
push str.AppStopMethodThreads
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b646
cmp byte [esp + 0x220], 0
je 0x40b646
push str.AppStopMethodThreads
push edi
call esi
cmp byte [ebp + 0x704ac], 0
jne 0x40b661
push 0
push str.AppKillProcessTree
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40b673
cmp byte [esp + 0x220], 0
je 0x40b673
push str.AppKillProcessTree
push edi
call esi
movzx eax, word [ebp + 0x40424]
lea ecx, [ebp + 0x40424]
test ax, ax
jne 0x40b697
cmp byte [esp + 0x220], al
je 0x40b776
test ax, ax
je 0x40b6a8
push ecx
push str.AppStdin
push edi
call fcn.0040a2f0
add esp, 0xc
jmp 0x40b6ba
cmp byte [esp + 0x220], 0
je 0x40b6ba
push str.AppStdin
push edi
call esi
mov eax, dword [ebp + 0x50424]
cmp eax, 2
je 0x40b6db
push eax
push str.ShareMode
push str.AppStdin
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b6f8
cmp byte [esp + 0x220], 0
je 0x40b6f8
push str.ShareMode
push str.AppStdin
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x50428]
cmp eax, 3
je 0x40b719
push eax
push str.CreationDisposition
push str.AppStdin
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b736
cmp byte [esp + 0x220], 0
je 0x40b736
push str.CreationDisposition
push str.AppStdin
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x5042c]
cmp eax, 0x80
je 0x40b759
push eax
push str.FlagsAndAttributes
push str.AppStdin
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b776
cmp byte [esp + 0x220], 0
je 0x40b776
push str.FlagsAndAttributes
push str.AppStdin
push edi
call fcn.00406ea0
add esp, 0xc
movzx eax, word [ebp + 0x50430]
lea ecx, [ebp + 0x50430]
test ax, ax
jne 0x40b79a
cmp byte [esp + 0x220], al
je 0x40b8b6
test ax, ax
je 0x40b7ab
push ecx
push str.AppStdout
push edi
call fcn.0040a2f0
add esp, 0xc
jmp 0x40b7bd
cmp byte [esp + 0x220], 0
je 0x40b7bd
push str.AppStdout
push edi
call esi
mov eax, dword [ebp + 0x60430]
cmp eax, 3
je 0x40b7de
push eax
push str.ShareMode
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b7fb
cmp byte [esp + 0x220], 0
je 0x40b7fb
push str.ShareMode
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x60434]
cmp eax, 4
je 0x40b81c
push eax
push str.CreationDisposition
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b839
cmp byte [esp + 0x220], 0
je 0x40b839
push str.CreationDisposition
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x60438]
cmp eax, 0x80
je 0x40b85c
push eax
push str.FlagsAndAttributes
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b879
cmp byte [esp + 0x220], 0
je 0x40b879
push str.FlagsAndAttributes
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
cmp byte [ebp + 0x70473], 0
je 0x40b899
push 1
push str.CopyAndTruncate
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b8b6
cmp byte [esp + 0x220], 0
je 0x40b8b6
push str.CopyAndTruncate
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
movzx eax, word [ebp + 0x60450]
lea ecx, [ebp + 0x60450]
test ax, ax
jne 0x40b8da
cmp byte [esp + 0x220], al
je 0x40b9f6
test ax, ax
je 0x40b8eb
push ecx
push str.AppStderr
push edi
call fcn.0040a2f0
add esp, 0xc
jmp 0x40b8fd
cmp byte [esp + 0x220], 0
je 0x40b8fd
push str.AppStderr
push edi
call esi
mov eax, dword [ebp + 0x70450]
cmp eax, 3
je 0x40b91e
push eax
push str.ShareMode
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b93b
cmp byte [esp + 0x220], 0
je 0x40b93b
push str.ShareMode
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x70454]
cmp eax, 4
je 0x40b95c
push eax
push str.CreationDisposition
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b979
cmp byte [esp + 0x220], 0
je 0x40b979
push str.CreationDisposition
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x70458]
cmp eax, 0x80
je 0x40b99c
push eax
push str.FlagsAndAttributes
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b9b9
cmp byte [esp + 0x220], 0
je 0x40b9b9
push str.FlagsAndAttributes
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
cmp byte [ebp + 0x70474], 0
je 0x40b9d9
push 1
push str.CopyAndTruncate
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b9f6
cmp byte [esp + 0x220], 0
je 0x40b9f6
push str.CopyAndTruncate
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
cmp byte [ebp + 0x70472], 0
je 0x40ba11
push 1
push str.AppTimestampLog
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40ba23
cmp byte [esp + 0x220], 0
je 0x40ba23
push str.AppTimestampLog
push edi
call esi
cmp byte [ebp + 0x70470], 0
je 0x40ba3e
push 1
push str.AppRedirectHook
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40ba50
cmp byte [esp + 0x220], 0
je 0x40ba50
push str.AppRedirectHook
push edi
call esi
cmp byte [ebp + 0x70471], 0
je 0x40ba6b
push 1
push str.AppRotateFiles
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40ba7d
cmp byte [esp + 0x220], 0
je 0x40ba7d
push str.AppRotateFiles
push edi
call esi
cmp dword [ebp + 0x70478], 0
je 0x40ba98
push 1
push str.AppRotateOnline
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40baaa
cmp byte [esp + 0x220], 0
je 0x40baaa
push str.AppRotateOnline
push edi
call esi
mov eax, dword [ebp + 0x70480]
test eax, eax
je 0x40bac5
push eax
push str.AppRotateSeconds
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40bad7
cmp byte [esp + 0x220], 0
je 0x40bad7
push str.AppRotateSeconds
push edi
call esi
mov eax, dword [ebp + 0x70484]
test eax, eax
je 0x40baf2
push eax
push str.AppRotateBytes
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40bb04
cmp byte [esp + 0x220], 0
je 0x40bb04
push str.AppRotateBytes
push edi
call esi
mov eax, dword [ebp + 0x70488]
test eax, eax
je 0x40bb1f
push eax
push str.AppRotateBytesHigh
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40bb31
cmp byte [esp + 0x220], 0
je 0x40bb31
push str.AppRotateBytesHigh
push edi
call esi
mov eax, dword [ebp + 0x7048c]
test eax, eax
je 0x40bb4c
push eax
push str.AppRotateDelay
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40bb5e
cmp byte [esp + 0x220], 0
je 0x40bb5e
push str.AppRotateDelay
push edi
call esi
cmp dword [ebp + 0x40420], 0
je 0x40bb79
push 1
push str.AppNoConsole
push edi
call fcn.0040a310
add esp, 0xc
jmp 0x40bb8b
cmp byte [esp + 0x220], 0
je 0x40bb8b
push str.AppNoConsole
push edi
call esi
mov eax, dword [ebp + 0x403f8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40bbdd
mov ecx, dword [ebp + 0x40410]
add ecx, ecx
push ecx
push eax
push 7
push 0
push str.AppEnvironment
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bbf3
push 0
call esi
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppEnvironment
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
jmp 0x40bbf3
cmp byte [esp + 0x220], 0
je 0x40bbf3
push str.AppEnvironment
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp + 0x40414]
test eax, eax
je 0x40bc3f
mov edx, dword [ebp + 0x40418]
add edx, edx
push edx
push eax
push 7
push 0
push str.AppEnvironmentExtra
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bc55
push 0
call esi
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppEnvironmentExtra
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
jmp 0x40bc55
cmp byte [esp + 0x220], 0
je 0x40bc55
push str.AppEnvironmentExtra
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x214]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414aec
add esp, 0x208
ret