Function at 0x402ec0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x41a1d6
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.0040e5a0
mov eax, dword [0x42365c]
xor eax, esp
mov dword [esp + 0x2258], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42365c]
xor eax, esp
push eax
lea eax, [esp + 0x2270]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2284]
mov ebp, dword [esp + 0x2280]
xor esi, esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov edx, dword [esp + 0x228c]
mov eax, ebp
mov edi, ecx
mov dword [esp + 0x2278], esi
mov dword [esp + 0x60], edx
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034fd
cmp word [ebp], 0x7d
je 0x4034fb
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebp
mov dword [esp + 0x40], 1
call edi
neg eax
push str.ForceRemove
sbb ebx, ebx
push ebp
inc ebx
call edi
test eax, eax
je 0x402f82
cmp ebx, esi
je 0x4030b7
mov edi, dword [esp + 0x14]
mov eax, ebp
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034ec
cmp dword [esp + 0x2288], esi
je 0x4030b7
movzx ecx, word [ebp]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov eax, ebp
cmp cx, si
je 0x402fdc
mov edi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x402fd4
push eax
call edi
movzx ecx, word [eax]
cmp cx, si
jne 0x402fc1
jmp 0x402fdc
cmp eax, esi
jne 0x4034c8
mov edi, 0x41ec90
mov eax, dword [edi]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403020
add edi, 4
cmp edi, 0x41ecc0
jl 0x402fe1
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
push ebp
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00401940
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
cmp ebx, esi
je 0x4030b3
mov edi, dword [esp + 0x14]
mov eax, ebp
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034e1
mov ecx, dword [esp + 0x14]
mov ebx, ebp
call fcn.00402940
mov edi, eax
test edi, edi
js 0x4034e1
mov dword [esp + 0x30], 0
xor esi, esi
cmp word [ebp], 0x7b
jne 0x403213
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x403213
mov ecx, dword [esp + 0x2288]
mov edx, dword [esp + 0x18]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ebp
call fcn.00402ec0
mov edi, eax
cmp edi, esi
jl 0x4034ec
mov edi, dword [esp + 0x14]
mov eax, ebp
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034ec
jmp 0x403213
mov dword [esp + 0x30], esi
push str.NoRemove
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4030e0
mov edi, dword [esp + 0x14]
mov eax, ebp
mov dword [esp + 0x38], esi
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034ec
push 0x41da84
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403223
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x26c]
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034ec
mov edi, dword [esp + 0x14]
mov eax, ebp
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034ec
cmp word [ebp], 0x3d
jne 0x4034d1
cmp dword [esp + 0x2288], esi
je 0x40318e
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x54]
mov byte [esp + 0x2278], 1
push eax
mov dword [esp + 0x58], edx
push ecx
mov edx, ebp
lea ecx, [esp + 0x274]
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
call fcn.004024f0
mov edi, eax
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
cmp edi, esi
jl 0x403527
mov byte [esp + 0x2278], 0
mov dword [esp + 0x58], esi
jmp 0x40305c
cmp dword [esp + 0x228c], esi
jne 0x4031fc
cmp dword [esp + 0x38], esi
je 0x4031fc
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x40]
push eax
mov eax, 0x20006
xor ebx, ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
call fcn.00401790
xor edi, edi
cmp eax, edi
jne 0x40353b
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x26c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x4031e9
cmp eax, 2
jne 0x40353b
cmp esi, edi
je 0x4031f8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov ecx, dword [esp + 0x14]
mov ebx, ebp
call fcn.00402940
mov edi, eax
test edi, edi
js 0x4034ea
xor esi, esi
cmp word [ebp], 0x7d
jne 0x402f53
jmp 0x4034ec
movzx ecx, word [ebp]
mov eax, ebp
cmp cx, si
je 0x40324f
mov edi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x403247
push eax
call edi
movzx ecx, word [eax]
cmp cx, si
jne 0x403234
jmp 0x40324f
cmp eax, esi
jne 0x4034d1
cmp dword [esp + 0x2288], esi
je 0x4032e2
mov esi, dword [esp + 0x24]
push esi
lea edx, [esp + 0x1c]
push edx
mov eax, 0x2001f
mov ebx, ebp
call fcn.00401790
test eax, eax
je 0x4032a2
push esi
lea eax, [esp + 0x1c]
push eax
mov eax, 0x20019
call fcn.00401790
test eax, eax
je 0x4032a2
lea ecx, [esp + 0x18]
push ecx
mov eax, ebp
mov ecx, esi
call fcn.00401710
mov edi, eax
test edi, edi
jne 0x403548
mov esi, dword [esp + 0x14]
mov eax, ebp
mov edi, esi
call fcn.00402350
mov edi, eax
test edi, edi
js 0x4034ea
cmp word [ebp], 0x3d
jne 0x40305a
lea edx, [esp + 0x18]
push edx
push esi
mov edx, ebp
xor ecx, ecx
call fcn.004024f0
mov edi, eax
test edi, edi
js 0x4034ea
jmp 0x40305a
cmp dword [esp + 0x228c], esi
jne 0x403342
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov eax, 0x20019
mov ebx, ebp
call fcn.00401790
xor esi, esi
mov dword [esp + 0x28], eax
test eax, eax
je 0x403316
mov dword [esp + 0x228c], 1
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x6c]
push 0x104
push edx
call fcn.00408bb9
add esp, 0x10
cmp eax, 0x50
ja case.0x40333b.1
movzx eax, byte [eax + 0x4035b0]
jmp dword [eax*4 + 0x4035a0]
mov dword [esp + 0x28], 2
jmp 0x40330b
mov edi, dword [esp + 0x14]
mov eax, ebp
call fcn.00402350
mov edi, eax
cmp edi, esi
jl 0x4034ec
mov ecx, dword [esp + 0x14]
mov ebx, ebp
call fcn.00402940
mov edi, eax
test edi, edi
js 0x4034ea
cmp word [ebp], 0x7b
jne 0x4033cd
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4033cd
mov ecx, dword [esp + 0x228c]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push ecx
push 0
push esi
push ebp
mov ecx, ebx
call fcn.00402ec0
mov edi, eax
test edi, edi
jns 0x4033b8
cmp dword [esp + 0x228c], 0
je 0x4034ea
mov eax, ebp
mov edi, ebx
call fcn.00402350
mov edi, eax
test edi, edi
js 0x4034ea
jmp 0x4033d1
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x228c], eax
cmp ecx, 2
je 0x403211
test ecx, ecx
je 0x403403
test eax, eax
jne 0x403211
mov eax, ecx
call fcn.00401380
mov edi, eax
jmp 0x4034ea
test eax, eax
je 0x40343f
mov ecx, esi
call fcn.00402900
test eax, eax
je 0x40343f
lea ebx, [esp + 0x64]
call fcn.004028c0
test eax, eax
je 0x403211
cmp dword [esp + 0x38], 0
je 0x403211
mov edx, ebx
push edx
lea ecx, [esp + 0x1c]
call fcn.00401940
jmp 0x403211
mov ecx, esi
call fcn.00402900
xor ebx, ebx
mov dword [esp + 0x28], eax
test esi, esi
je 0x403461
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
test ebx, ebx
jne 0x40356e
cmp dword [esp + 0x38], ebx
je 0x403211
cmp dword [esp + 0x28], ebx
jne 0x403211
mov eax, dword [esp + 0x24]
mov dword [esp + 0x48], eax
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
lea ebx, [esp + 0x64]
lea eax, [esp + 0x48]
call fcn.00401660
xor ecx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
cmp eax, ecx
jne 0x403583
lea esi, [esp + 0x48]
call fcn.00401640
jmp 0x403211
lea esi, [esp + 0x2c]
call fcn.00401640
lea esi, [esp + 0x18]
call fcn.00401640
mov eax, 0x80020009
jmp 0x4034fd
lea esi, [esp + 0x2c]
call fcn.00401640
xor esi, esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4034fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x2270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2258]
xor ecx, esp
call fcn.004089bc
add esp, 0x2268
ret 0x10
lea esi, [esp + 0x54]
call fcn.00401640
lea esi, [esp + 0x18]
call fcn.00401640
jmp 0x4034fb
call fcn.00401380
mov edi, eax
lea esi, [esp + 0x3c]
jmp 0x4034e5
lea esi, [esp + 0x18]
call fcn.00401640
mov eax, edi
call fcn.00401380
jmp 0x4034fd
push 0x8007000e
call fcn.004010b0
push 0x80070057
call fcn.004010b0
lea esi, [esp + 0x18]
call fcn.00401640
mov eax, ebx
call fcn.00401380
jmp 0x4034fd
call fcn.00401380
mov edi, eax
lea esi, [esp + 0x48]
jmp 0x4034e5
push 0x80004005
call fcn.004010b0
lea ecx, [ecx]
dec esp
xor eax, dword [eax]
pop edx
xor eax, 895746112
inc eax
add byte [ebx + 0x4035], dl
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3