Function at 0x40ed10
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x225c
call fcn.004309c0
push ebx
mov eax, ecx
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov ecx, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebx
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f271
push 0x7d
pop eax
cmp word [edi], ax
je 0x40f262
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x40ed92
test esi, esi
je 0x40ee3d
mov ecx, dword [esp + 0x10]
push edi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x40ee3f
push 0x5c
pop edx
mov ecx, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.0040e2d9
test eax, eax
jne 0x40f25d
push edi
call fcn.0040e8b0
test eax, eax
je 0x40edfe
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x28]
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.0040e99d
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x14], esi
je 0x40ee37
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push edi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
push edi
mov ecx, ebx
call fcn.0040e85d
mov esi, eax
test esi, esi
js 0x40f262
xor ebx, ebx
mov dword [esp + 0x2c], ebx
jmp 0x40f1d7
mov dword [esp + 0x2c], esi
jmp 0x40ee3f
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40ee67
mov ecx, dword [esp + 0x10]
push edi
mov dword [esp + 0x28], esi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
push 0x45e0ec
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40ef88
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x268]
push eax
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
mov ecx, dword [esp + 0x10]
push edi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40f25d
cmp dword [ebp + 0x10], 0
je 0x40ef03
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x268]
push edi
push eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x50], ebx
push eax
mov dword [esp + 0x58], ebx
call fcn.0040e4a2
mov esi, eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
test esi, esi
js 0x40f262
mov dword [esp + 0x48], ebx
jmp 0x40f1d7
cmp dword [ebp + 0x14], 0
jne 0x40ef6f
cmp dword [esp + 0x24], 0
je 0x40ef6f
xor esi, esi
lea ecx, [esp + 0x38]
push 0x20006
push esi
push dword [ebp + 0xc]
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
call fcn.0040e93f
test eax, eax
jne 0x40f241
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x268]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40ef58
cmp eax, 2
jne 0x40f231
test ebx, ebx
je 0x40ef67
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x38], esi
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x10]
push edi
call fcn.0040e85d
mov esi, eax
test esi, esi
js 0x40f262
jmp 0x40ed52
push 0x5c
pop edx
mov ecx, edi
call fcn.0040e2d9
test eax, eax
jne 0x40f25d
cmp dword [ebp + 0x10], eax
je 0x40f023
mov ebx, dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push 0x2001f
push edi
push ebx
call fcn.0040e93f
test eax, eax
je 0x40efe4
push 0x20019
push edi
push ebx
lea ecx, [esp + 0x24]
call fcn.0040e93f
test eax, eax
je 0x40efe4
sub esp, 0x14
lea ecx, [esp + 0x2c]
push edi
push ebx
call fcn.0040e386
test eax, eax
jne 0x40f111
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push edi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40f01c
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040e4a2
mov esi, eax
test esi, esi
js 0x40f262
xor ebx, ebx
jmp 0x40f1d7
cmp dword [ebp + 0x14], 0
jne 0x40f041
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [esp + 0x24]
call fcn.0040e93f
mov ebx, dword [esp + 0x18]
jmp 0x40f044
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [esp + 0x18], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [esp + 0x64]
push edi
push 0x104
push eax
mov dword [esp + 0x44], ecx
call fcn.00423035
push eax
call fcn.0040e825
mov ecx, dword [esp + 0x24]
add esp, 0x14
push edi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
mov ecx, dword [esp + 0x10]
push edi
call fcn.0040e85d
mov esi, eax
test esi, esi
js 0x40f262
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40f0f6
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x5c]
jne 0x40f0a7
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x40f0f6
push dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
xor eax, eax
push eax
push ebx
push edi
call fcn.0040ed10
mov esi, eax
test esi, esi
jns 0x40f0e2
cmp dword [esp + 0x34], 0
je 0x40f262
mov ecx, dword [esp + 0x10]
push edi
call fcn.0040ebb1
mov esi, eax
test esi, esi
js 0x40f262
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x40ed52
test eax, eax
je 0x40f11f
cmp dword [ebp + 0x14], 0
jne 0x40ed52
mov ecx, eax
call fcn.0040eba3
mov esi, eax
jmp 0x40f262
cmp dword [ebp + 0x14], 0
je 0x40f15f
push ebx
call fcn.0040ea8b
test eax, eax
je 0x40f15f
lea eax, [esp + 0x60]
push eax
call fcn.0040e8b0
test eax, eax
je 0x40ed52
cmp dword [esp + 0x24], 0
je 0x40ed52
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040e99d
jmp 0x40ed52
push ebx
call fcn.0040ea8b
mov ecx, eax
xor eax, eax
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x40f184
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov ebx, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
xor edx, edx
mov dword [esp + 0x1c], edx
test eax, eax
jne 0x40f111
cmp dword [esp + 0x24], edx
je 0x40ed52
test ecx, ecx
jne 0x40ed52
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], eax
xor ebx, ebx
lea eax, [esp + 0x60]
mov dword [esp + 0x54], ebx
push eax
mov dword [esp + 0x5c], ebx
call fcn.0040eb2b
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
test eax, eax
jne 0x40f111
mov dword [esp + 0x54], ebx
cmp dword [ebp + 0x10], 0
je 0x40f228
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40f228
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f1ea
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x40f228
mov ecx, dword [esp + 0x10]
push ebx
push dword [ebp + 0x10]
mov ebx, dword [esp + 0x20]
push ebx
push edi
call fcn.0040ed10
mov esi, eax
test esi, esi
js 0x40f262
mov ecx, dword [esp + 0x10]
push edi
call fcn.0040ebb1
jmp 0x40ef79
mov ebx, dword [esp + 0x18]
jmp 0x40ed52
mov ecx, eax
call fcn.0040eba3
mov esi, eax
test ebx, ebx
je 0x40f262
push ebx
jmp 0x40f255
mov ecx, eax
call fcn.0040eba3
cmp dword [esp + 0x38], 0
mov esi, eax
je 0x40f262
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f262
mov esi, 0x80020009
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40f271
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10