Function at 0x40ef68
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x4377f4]
and dword [ebp - 0x6c], 0
xor eax, ebp
mov dword [ebp + 0x1a4], eax
mov eax, dword [ebp + 0x1b4]
push esi
push edi
mov edi, dword [ebp + 0x1b0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1bc]
push edi
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x7c], eax
call fcn.0040eb61
mov esi, eax
test esi, esi
jge 0x40efbf
lea ecx, [ebp - 0x6c]
call fcn.0040f502
mov eax, esi
jmp 0x40f468
push ebx
jmp 0x40f0eb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [ebp - 0x74], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x40eff5
test ebx, ebx
je 0x40f108
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
cmp dword [ebp + 0x1b8], 0
je 0x40f108
and dword [ebp - 0x68], 0
mov cl, byte [edi]
mov eax, edi
jmp 0x40f02d
cmp cl, 0x5c
je 0x40f033
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x40f01f
jmp 0x40f03b
test eax, eax
jne 0x40f481
mov esi, 0x42c368
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40f06b
add esi, 4
cmp esi, str.TypeLib
jl 0x40f040
mov eax, dword [ebp - 0x78]
push edi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], eax
call fcn.0040f5e7
and dword [ebp - 0x68], 0
test ebx, ebx
je 0x40f0f9
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040eb61
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x40f4b2
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040f583
mov esi, eax
cmp esi, ebx
jl 0x40f4b2
cmp dword [ebp - 0x68], ebx
je 0x40f0a9
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0x7b
jne 0x40f0eb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x40f0eb
mov ecx, dword [ebp - 0x70]
push 0
push dword [ebp + 0x1b8]
push dword [ebp - 0x6c]
push edi
call fcn.0040ef68
mov esi, eax
test esi, esi
jl 0x40f456
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
cmp byte [edi], 0x7d
jne 0x40efc5
jmp 0x40f456
cmp dword [ebp - 0x68], 0
je 0x40f108
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40f12e
mov ecx, dword [ebp - 0x70]
and dword [ebp - 0x74], eax
push edi
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
push 0x42c458
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40f20a
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x64]
push eax
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
cmp byte [edi], 0x3d
jne 0x40f4c2
xor ebx, ebx
cmp dword [ebp + 0x1b8], ebx
je 0x40f1a7
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0040f697
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x74], ebx
jl 0x40f4d1
jmp 0x40f0a9
cmp dword [ebp + 0x1bc], ebx
jne 0x40f1f8
cmp dword [ebp - 0x74], ebx
je 0x40f1f8
push 0x20006
push ebx
push dword [ebp - 0x78]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
call fcn.0040f519
cmp eax, ebx
jne 0x40f4a9
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x40f1ea
cmp eax, 2
jne 0x40f4a9
cmp dword [ebp - 0x68], ebx
je 0x40f1f8
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040f583
mov esi, eax
cmp esi, ebx
jmp 0x40f0e5
mov cl, byte [edi]
mov eax, edi
jmp 0x40f21e
cmp cl, 0x5c
je 0x40f224
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x40f210
jmp 0x40f22c
test eax, eax
jne 0x40f4c2
xor esi, esi
cmp dword [ebp + 0x1b8], esi
je 0x40f2e1
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x78]
lea ecx, [ebp - 0x6c]
call fcn.0040f519
test eax, eax
je 0x40f2a7
push 0x20019
push edi
push dword [ebp - 0x78]
lea ecx, [ebp - 0x6c]
call fcn.0040f519
test eax, eax
je 0x40f2a7
lea eax, [ebp - 0x80]
push eax
xor ebx, ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40f4c8
xor eax, eax
cmp dword [ebp - 0x6c], ebx
je 0x40f299
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x6c], ecx
jne 0x40f4c8
mov ecx, dword [ebp - 0x70]
push edi
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
cmp byte [edi], 0x3d
jne 0x40f0a9
mov ecx, dword [ebp - 0x70]
push edi
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.0040f697
mov esi, eax
test esi, esi
jl 0x40f456
jmp 0x40f0a9
cmp dword [ebp + 0x1bc], esi
jne 0x40f2ff
push 0x20019
push edi
push dword [ebp - 0x78]
lea ecx, [ebp - 0x6c]
call fcn.0040f519
mov dword [ebp - 0x68], eax
jmp 0x40f306
mov dword [ebp - 0x68], 2
cmp dword [ebp - 0x68], esi
je 0x40f315
mov dword [ebp + 0x1bc], 1
push 0x104
push edi
lea eax, [ebp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [ebp - 0x70]
push edi
mov ecx, ebx
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
push edi
mov ecx, ebx
call fcn.0040f583
mov esi, eax
test esi, esi
jl 0x40f456
cmp byte [edi], 0x7b
jne 0x40f38c
push dword [ebp + 0x1bc]
mov ecx, ebx
push 0
push dword [ebp - 0x6c]
push edi
call fcn.0040ef68
mov esi, eax
test esi, esi
jge 0x40f37a
cmp dword [ebp + 0x1bc], 0
je 0x40f456
push edi
mov ecx, ebx
call fcn.0040eb61
mov esi, eax
test esi, esi
jl 0x40f456
cmp dword [ebp - 0x68], 2
mov eax, dword [ebp - 0x7c]
mov dword [ebp + 0x1bc], eax
je 0x40f0eb
xor ebx, ebx
cmp dword [ebp - 0x68], ebx
je 0x40f3b6
cmp eax, ebx
jne 0x40f0eb
push dword [ebp - 0x68]
jmp 0x40f44e
cmp dword [ebp - 0x7c], ebx
je 0x40f40f
push dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
call fcn.0040f54e
test eax, eax
je 0x40f40f
mov ebx, 0x42c368
push dword [ebx]
lea eax, [ebp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40f0eb
add ebx, 4
cmp ebx, str.TypeLib
jl 0x40f3cf
cmp dword [ebp - 0x74], 0
je 0x40f0eb
lea eax, [ebp + 0xa0]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f5e7
jmp 0x40f0eb
cmp dword [ebp - 0x6c], ebx
je 0x40f42b
push dword [ebp - 0x6c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
and dword [ebp - 0x6c], 0
test eax, eax
jne 0x40f4d6
cmp dword [ebp - 0x74], 0
je 0x40f0eb
lea eax, [ebp + 0xa0]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40f0eb
push eax
call fcn.0040f4ef
pop ecx
mov esi, eax
cmp dword [ebp - 0x6c], 0
je 0x40f465
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebx
mov ecx, dword [ebp + 0x1a4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041c2f6
add ebp, 0x1a8
leave
ret 0x10
xor esi, esi
cmp dword [ebp - 0x68], esi
je 0x40f494
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x68], esi
cmp dword [ebp - 0x6c], esi
je 0x40f4a2
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x40f467
push eax
call fcn.0040f4ef
pop ecx
mov esi, eax
cmp dword [ebp - 0x68], ebx
je 0x40f456
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f456
cmp dword [ebp - 0x6c], 0
jmp 0x40f497
push eax
call fcn.0040f4ef
pop ecx
mov esi, eax
cmp dword [ebp - 0x6c], ebx
jmp 0x40f45a
push eax
call fcn.0040f4ef
cmp dword [ebp - 0x6c], 0
pop ecx
mov esi, eax
je 0x40f465
push dword [ebp - 0x6c]
call ebx
jmp 0x40f465