Function at 0x408eda
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412462
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00410525
mov eax, dword [0x403a2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x222c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x221c], ecx
xor ecx, ecx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x226c], ecx
mov ecx, eax
jmp 0x409455
push 0x401418
push edi
mov dword [ebp - 0x2240], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4013ec
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408f7a
test ebx, ebx
je 0x40904e
mov ecx, dword [ebp - 0x222c]
push edi
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x409050
push 0x5c
push edi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
call fcn.004095a4
test eax, eax
jne 0x409477
mov ecx, dword [ebp - 0x222c]
push edi
call fcn.00408e76
test eax, eax
je 0x409003
mov eax, dword [ebp - 0x221c]
push edi
lea ecx, [ebp - 0x2238]
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
call fcn.00408267
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
mov dword [ebp - 0x2230], esi
test ebx, ebx
je 0x409041
mov ebx, dword [ebp - 0x222c]
push edi
mov ecx, ebx
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x40946f
push edi
mov ecx, ebx
call fcn.0040951f
lea ecx, [ebp - 0x2238]
mov esi, eax
call fcn.004081d4
test esi, esi
js 0x409487
jmp 0x409420
lea ecx, [ebp - 0x2238]
call fcn.004081d4
jmp 0x409050
xor esi, esi
push 0x401404
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x222c]
test eax, eax
jne 0x40907e
push edi
mov ecx, ebx
mov dword [ebp - 0x2240], esi
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
push 0x4013e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4091a8
lea eax, [ebp - 0x2218]
push eax
mov ecx, ebx
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
push edi
mov ecx, ebx
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
push 0x3d
pop eax
cmp word [edi], ax
jne 0x409482
cmp dword [ebp + 0x10], 0
je 0x40912e
mov eax, dword [ebp - 0x221c]
and dword [ebp - 0x2248], 0
and dword [ebp - 0x2244], 0
mov dword [ebp - 0x224c], eax
push edi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x224c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00408ae6
mov esi, eax
xor eax, eax
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
lea ecx, [ebp - 0x224c]
test esi, esi
js 0x4094be
mov byte [ebp - 4], al
jmp 0x40941b
cmp dword [ebp + 0x14], 0
jne 0x40919b
cmp dword [ebp - 0x2240], 0
je 0x40919b
xor eax, eax
push 0x20006
push eax
push dword [ebp - 0x221c]
lea ecx, [ebp - 0x2264]
mov dword [ebp - 0x2264], eax
mov dword [ebp - 0x2260], eax
mov dword [ebp - 0x225c], eax
call fcn.0040817f
test eax, eax
jne 0x4094b0
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2264]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x409190
cmp eax, 2
jne 0x4094b0
lea ecx, [ebp - 0x2264]
call fcn.004081d4
push edi
mov ecx, ebx
call fcn.0040951f
jmp 0x40945b
push 0x5c
push edi
call fcn.004095a4
test eax, eax
jne 0x409482
cmp dword [ebp + 0x10], eax
je 0x40924b
mov esi, dword [ebp - 0x221c]
push 0x2001f
push edi
push esi
lea ecx, [ebp - 0x2228]
call fcn.0040817f
test eax, eax
je 0x409215
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2228]
call fcn.0040817f
test eax, eax
je 0x409215
xor eax, eax
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
lea ecx, [ebp - 0x2228]
call fcn.00408110
mov esi, eax
test esi, esi
jne 0x4094c5
push edi
mov ecx, ebx
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
push 0x3d
pop eax
cmp word [edi], ax
jne 0x409420
push edi
push 0
lea eax, [ebp - 0x2228]
push eax
mov ecx, ebx
call fcn.00408ae6
mov esi, eax
jmp 0x409034
cmp dword [ebp + 0x14], 0
jne 0x40926a
push 0x20019
push edi
push dword [ebp - 0x221c]
lea ecx, [ebp - 0x2228]
call fcn.0040817f
jmp 0x40926d
push 2
pop eax
mov dword [ebp - 0x223c], eax
test eax, eax
je 0x40927e
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
push eax
call fcn.00407852
push edi
mov ecx, ebx
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
push edi
mov ecx, ebx
call fcn.0040951f
mov esi, eax
test esi, esi
js 0x409487
push 0x7b
pop eax
cmp word [edi], ax
jne 0x409309
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x409309
push dword [ebp + 0x14]
mov ecx, ebx
push 0
push dword [ebp - 0x2228]
push edi
call fcn.00408eda
mov esi, eax
test esi, esi
jns 0x4092f7
cmp dword [ebp + 0x14], 0
je 0x409487
push edi
mov ecx, ebx
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
mov eax, dword [ebp - 0x223c]
mov ecx, dword [ebp - 0x226c]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x409461
test eax, eax
je 0x40933a
test ecx, ecx
jne 0x409461
push eax
call fcn.004078cc
mov esi, eax
jmp 0x409487
test ecx, ecx
je 0x409389
push dword [ebp - 0x2228]
mov ecx, ebx
call fcn.00408ea5
test eax, eax
je 0x409389
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.00408e76
test eax, eax
je 0x409461
cmp dword [ebp - 0x2240], 0
je 0x409461
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2228]
call fcn.00408267
jmp 0x409461
push dword [ebp - 0x2228]
mov ecx, ebx
call fcn.00408ea5
lea ecx, [ebp - 0x2228]
mov dword [ebp - 0x223c], eax
call fcn.004081d4
mov dword [ebp - 0x2268], eax
test eax, eax
jne 0x4094e6
cmp dword [ebp - 0x2240], eax
je 0x409461
cmp dword [ebp - 0x223c], eax
jne 0x409461
mov eax, dword [ebp - 0x221c]
and dword [ebp - 0x2254], 0
and dword [ebp - 0x2250], 0
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2258]
call fcn.004081ee
xor ecx, ecx
mov dword [ebp - 0x2258], ecx
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2250], ecx
test eax, eax
jne 0x4094d8
lea ecx, [ebp - 0x2258]
call fcn.004081d4
cmp dword [ebp + 0x10], 0
je 0x409461
push 0x7b
pop eax
cmp word [edi], ax
jne 0x409461
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x409461
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2228]
push edi
call fcn.00408eda
mov esi, eax
test esi, esi
js 0x409487
mov ecx, ebx
push edi
call fcn.004089ad
mov esi, eax
test esi, esi
js 0x409487
push 0x7d
pop eax
cmp word [edi], ax
jne 0x408f47
jmp 0x409487
lea ecx, [ebp - 0x2238]
jmp 0x4094be
lea ecx, [ebp - 0x2238]
call fcn.004081d4
mov esi, 0x80020009
lea ecx, [ebp - 0x2228]
call fcn.004081d4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f678
leave
ret 0x10
push eax
call fcn.004078cc
lea ecx, [ebp - 0x2264]
mov esi, eax
call fcn.004081d4
jmp 0x409487
lea ecx, [ebp - 0x2228]
call fcn.004081d4
push esi
call fcn.004078cc
jmp 0x409494
push eax
call fcn.004078cc
lea ecx, [ebp - 0x2258]
jmp 0x4094bc
lea ecx, [ebp - 0x2228]
call fcn.004081d4
push dword [ebp - 0x2268]
jmp 0x4094d1