Function at 0x409490
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42417b
mov eax, dword fs:[0]
push eax
mov eax, 0x2244
call fcn.004136a0
mov eax, dword [0x431078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
push ebx
mov dword [ebp - 4], 0
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409ea1
cmp word [ebx], 0x7d
je 0x409e8e
jmp 0x409520
push str.Delete
push ebx
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4259a4
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x409553
test edi, edi
je 0x409655
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
cmp dword [ebp + 0x10], 0
je 0x409655
movzx eax, word [ebx]
mov edx, ebx
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x223c], 0
test ax, ax
je 0x4095b4
cmp ax, 0x5c
je 0x4095ac
push edx
call dword [sym.imp.USER32.dll_CharNextW]
mov edx, eax
movzx ecx, word [edx]
mov eax, ecx
test cx, cx
jne 0x409591
jmp 0x4095b4
test edx, edx
jne 0x409e7c
mov esi, 0x4259e0
lea esp, [esp]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40960e
add esi, 4
cmp esi, 0x425a10
jl 0x4095c0
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2244]
push ebx
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], 0
call fcn.00408f20
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x223c], 0
test edi, edi
je 0x40964b
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
push ebx
mov ecx, edi
call fcn.0040a170
mov esi, eax
test esi, esi
js 0x409e8e
mov dword [ebp - 0x2240], 0
jmp 0x409aba
mov dword [ebp - 0x2240], 0
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x409685
mov ecx, dword [ebp - 0x2224]
xor edi, edi
push ebx
mov dword [ebp - 0x2234], edi
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
jmp 0x40968b
mov edi, dword [ebp - 0x2234]
push 0x42599c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4097df
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2218]
push eax
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
cmp word [ebx], 0x3d
jne 0x409e7c
cmp dword [ebp + 0x10], 0
je 0x40975c
mov eax, dword [ebp - 0x2220]
mov edi, dword [ebp - 0x2224]
mov ecx, edi
mov dword [ebp - 0x2250], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2250]
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
call fcn.00407f60
mov esi, eax
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
test esi, esi
js 0x409e8e
mov byte [ebp - 4], 0
mov dword [ebp - 0x224c], 0
jmp 0x409aba
cmp dword [ebp + 0x14], 0
jne 0x4097c4
test edi, edi
je 0x4097c4
xor edi, edi
lea eax, [ebp - 0x2234]
mov dword [ebp - 0x2234], edi
push eax
push 0x20006
push edi
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409792
mov edi, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
test eax, eax
jne 0x409e64
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4097b9
cmp eax, 2
jne 0x409e64
test edi, edi
je 0x4097c4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.0040a170
mov esi, eax
test esi, esi
js 0x409e8e
jmp 0x409e58
movzx ecx, word [ebx]
mov eax, ebx
test cx, cx
je 0x409811
mov edx, ecx
jmp 0x4097f0
cmp dx, 0x5c
je 0x409809
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x4097f0
jmp 0x409811
test eax, eax
jne 0x409e7c
cmp dword [ebp + 0x10], 0
je 0x409b1c
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 3
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x4098dc
cmp dword [esi], 0
je 0x4098cf
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4098a2
mov eax, 1
mov edi, dword [ebp - 0x2230]
mov byte [ebp - 4], 0
test eax, eax
je 0x409a81
mov byte [ebp - 4], 4
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x409965
cmp dword [esi], 0
je 0x409958
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40992b
mov eax, 1
jmp 0x4099a5
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4098d5
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x2001f
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x4098f7
cmp dword [esi + 4], 0
jne 0x4098dc
mov eax, 1
jmp 0x4098f7
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409854
mov ecx, dword [ebp - 0x2230]
test ecx, ecx
je 0x409910
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
jmp 0x40985a
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40995e
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x409980
cmp dword [esi + 4], 0
jne 0x409965
mov eax, 1
jmp 0x409980
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4099a5
test edi, edi
je 0x40998f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
mov byte [ebp - 4], 0
test eax, eax
je 0x409a81
mov byte [ebp - 4], 5
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x409a28
cmp dword [esi], 0
je 0x409a1b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4099e1
mov eax, 1
jmp 0x409a75
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409a21
push 0
push dword [esi]
lea ecx, [ebp - 0x2238]
push ecx
lea ecx, [ebp - 0x221c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x409a50
cmp dword [esi + 4], 0
jne 0x409a28
mov eax, 1
jmp 0x409a50
lea eax, [ebp - 0x2238]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409a75
test edi, edi
je 0x409a5f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x409e83
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
cmp word [ebx], 0x3d
jne 0x409aba
push ebx
push 0
lea eax, [ebp - 0x2230]
mov ecx, edi
push eax
call fcn.00407f60
mov esi, eax
test esi, esi
js 0x409e8e
cmp word [ebx], 0x7b
jne 0x409e58
mov ecx, ebx
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ad0
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x409e58
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x2230]
push ebx
call fcn.00409490
mov esi, eax
test esi, esi
js 0x409e8e
push ebx
mov ecx, edi
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
jmp 0x409e58
cmp dword [ebp + 0x14], 0
jne 0x409bf1
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 6
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x409b94
cmp dword [esi], 0
je 0x409b87
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x409b5a
lea edi, [eax + 1]
jmp 0x409bde
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409b8d
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x409baf
cmp dword [esi + 4], 0
jne 0x409b94
mov edi, 1
jmp 0x409bb1
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x409bde
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x409bc8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], 0
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0
mov dword [ebp - 0x221c], eax
test edi, edi
je 0x409c00
jmp 0x409bf6
mov edi, 2
mov dword [ebp - 0x221c], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0041849c
push eax
call fcn.00402d10
mov ecx, dword [ebp - 0x2224]
add esp, 0x14
push ebx
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.0040a170
mov esi, eax
test esi, esi
js 0x409e8e
cmp word [ebx], 0x7b
jne 0x409cab
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409c54
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x409cab
push dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2224]
push 0
push dword [ebp - 0x2230]
push ebx
call fcn.00409490
mov esi, eax
test esi, esi
jns 0x409c95
cmp dword [ebp - 0x221c], 0
je 0x409e8e
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00408930
mov esi, eax
test esi, esi
js 0x409e8e
cmp edi, 2
je 0x409e58
test edi, edi
je 0x409cc8
cmp dword [ebp + 0x14], 0
jne 0x409e58
push edi
jmp 0x409e84
cmp dword [ebp + 0x14], 0
je 0x409d5a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x409d5a
cmp dword [ebp - 0x221c], eax
jbe 0x409d5a
mov edi, 0x4259e0
push dword [edi]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x409e58
add edi, 4
cmp edi, 0x425a10
jl 0x409d14
cmp dword [ebp - 0x2234], 0
je 0x409e58
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.00408f20
jmp 0x409e58
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x409d93
xor edi, edi
jmp 0x409d9f
xor eax, eax
cmp eax, dword [ebp - 0x221c]
sbb edi, edi
neg edi
mov ecx, dword [ebp - 0x2230]
xor eax, eax
test ecx, ecx
je 0x409dba
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x409e83
cmp dword [ebp - 0x2234], eax
je 0x409e58
test edi, edi
jne 0x409e58
mov byte [ebp - 4], 7
cmp byte [0x431cac], al
jne 0x409e1f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409e11
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x431ca8], eax
mov byte [0x431cac], 1
jmp 0x409e24
mov eax, dword [0x431ca8]
mov byte [0x431cac], 1
jmp 0x409e24
mov eax, dword [0x431ca8]
test eax, eax
je 0x409e3d
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0x2220]
call eax
jmp 0x409e50
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 0
test eax, eax
jne 0x409e83
cmp word [ebx], 0x7d
jne 0x409520
jmp 0x409e8e
push eax
call fcn.00408560
add esp, 4
mov esi, eax
test edi, edi
je 0x409e8e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409e8e
mov esi, 0x80020009
jmp 0x409e8e
push eax
call fcn.00408560
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x409e9f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041345d
mov esp, ebp
pop ebp
ret 0x10