Function at 0x40a6b0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x40f281
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
mov eax, dword [0x418110]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x430], eax
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x454]
mov edi, dword [esp + 0x448]
push edi
mov dword [esp + 0x444], ebx
mov dword [esp + 0x20], eax
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jge 0x40a71f
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a718
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40acdf
cmp word [edi], 0x7d
push ebp
je 0x40accd
lea ebx, [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x41267c
push edi
mov dword [esp + 0x18], 1
call esi
mov ebp, eax
neg ebp
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x40a761
cmp ebp, ebx
je 0x40a8a9
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
cmp dword [esp + 0x454], ebx
je 0x40a8a9
mov dword [esp + 0x1c], ebx
xor ecx, ecx
mov cx, word [edi]
cmp cx, bx
mov byte [esp + 0x444], 1
mov eax, edi
je 0x40a7bb
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x40a7b3
push eax
call esi
mov cx, word [eax]
cmp cx, bx
jne 0x40a7a0
jmp 0x40a7bb
cmp eax, ebx
jne 0x40ad05
mov esi, 0x412550
mov ecx, dword [esi]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a7f6
add esi, 4
cmp esi, 0x412580
jl 0x40a7c0
mov edx, dword [esp + 0x450]
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edx
call fcn.0040ae30
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x40a7fa
mov eax, dword [esp + 0x1c]
cmp ebp, ebx
je 0x40a897
mov ebp, dword [esp + 0x18]
push edi
mov ecx, ebp
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40ad1e
push edi
mov ecx, ebp
call fcn.0040adc0
mov esi, eax
cmp esi, ebx
jl 0x40ad1e
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov byte [esp + 0x444], bl
je 0x40a840
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [edi], 0x7b
jne 0x40a888
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x40a888
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x14]
push ebx
push ecx
mov ecx, dword [esp + 0x20]
push edx
push edi
call fcn.0040a6b0
mov esi, eax
cmp esi, ebx
jl 0x40accd
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
cmp word [edi], 0x7d
jne 0x40a730
jmp 0x40accd
cmp eax, ebx
mov byte [esp + 0x444], bl
je 0x40a8a9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a8d1
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], ebx
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
push 0x4126b8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a9d7
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x230]
push eax
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
cmp word [edi], 0x3d
jne 0x40ad0e
cmp dword [esp + 0x454], ebx
je 0x40a96b
mov ecx, dword [esp + 0x450]
push edi
lea edx, [esp + 0x234]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
push eax
mov byte [esp + 0x450], 2
call fcn.0040af90
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x10], ebx
jl 0x40ad24
mov byte [esp + 0x444], bl
jmp 0x40a840
cmp dword [esp + 0x458], ebx
jne 0x40a9c8
cmp dword [esp + 0x10], ebx
je 0x40a9c8
mov ecx, dword [esp + 0x450]
push 0x20006
push ebx
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
call fcn.00408ad0
cmp eax, ebx
jne 0x40acb9
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x230]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x40a9bd
cmp eax, 2
jne 0x40acb9
cmp esi, ebx
je 0x40a9c8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040adc0
jmp 0x40a87e
xor ecx, ecx
mov cx, word [edi]
cmp cx, bx
mov eax, edi
je 0x40aa0b
mov esi, dword [sym.imp.USER32.dll_CharNextW]
lea esp, [esp]
cmp cx, 0x5c
je 0x40aa03
push eax
call esi
mov cx, word [eax]
cmp cx, bx
jne 0x40a9f0
jmp 0x40aa0b
cmp eax, ebx
jne 0x40ad0e
cmp dword [esp + 0x454], ebx
je 0x40ab0a
mov esi, dword [esp + 0x450]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x2001f
push ebx
push edi
push esi
mov dword [esp + 0x24], ebx
call ebp
cmp eax, ebx
jne 0x40aa59
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x40aa4d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x40aacd
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push edi
push esi
mov dword [esp + 0x24], ebx
call ebp
cmp eax, ebx
jne 0x40aa8d
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x40aa81
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x40aacd
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x40ad38
lea ecx, [esp + 0x14]
call fcn.00408ab0
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
jne 0x40ad38
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
cmp word [edi], 0x3d
jne 0x40a840
mov ecx, dword [esp + 0x18]
push edi
push ebx
lea edx, [esp + 0x1c]
push edx
call fcn.0040af90
mov esi, eax
cmp esi, ebx
jl 0x40accd
jmp 0x40a840
cmp dword [esp + 0x458], ebx
jne 0x40ac11
mov ecx, dword [esp + 0x450]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push edi
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40ab52
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x40ab4a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], edx
cmp eax, ebx
mov ebp, eax
je 0x40ab63
mov dword [esp + 0x458], 1
push 0x104
push edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040adc0
mov esi, eax
cmp esi, ebx
jl 0x40accd
cmp word [edi], 0x7b
jne 0x40abe1
mov ecx, dword [esp + 0x458]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push edx
push edi
call fcn.0040a6b0
mov esi, eax
cmp esi, ebx
jge 0x40abcd
cmp dword [esp + 0x458], ebx
je 0x40accd
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040a1a0
mov esi, eax
cmp esi, ebx
jl 0x40accd
cmp ebp, 2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x458], eax
je 0x40a888
cmp ebp, ebx
je 0x40ac1b
cmp eax, ebx
jne 0x40a888
push ebp
call fcn.0040ad50
add esp, 4
mov esi, eax
jmp 0x40accd
mov ebp, 2
jmp 0x40ab58
cmp eax, ebx
je 0x40ac75
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0040ad70
test eax, eax
je 0x40ac75
mov ebp, 0x412550
mov edx, dword [ebp]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a888
add ebp, 4
cmp ebp, 0x412580
jl 0x40ac36
cmp dword [esp + 0x10], ebx
je 0x40a888
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040ae30
jmp 0x40a888
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40ac90
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov dword [esp + 0x14], ebx
jne 0x40ad38
cmp dword [esp + 0x10], ebx
je 0x40a888
mov eax, dword [esp + 0x450]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x40a888
push eax
call fcn.0040ad50
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.00408e70
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40acdc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x438]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
pop ebx
call fcn.0040e783
add esp, 0x438
ret 0x10
lea ecx, [esp + 0x1c]
call fcn.00408e70
lea ecx, [esp + 0x14]
call fcn.00408e70
mov eax, 0x80020009
jmp 0x40acde
lea ecx, [esp + 0x1c]
jmp 0x40acc8
lea ecx, [esp + 0x10]
call fcn.00408e70
lea ecx, [esp + 0x14]
call fcn.00408e70
jmp 0x40acdc
push eax
call fcn.0040ad50
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00408e70
jmp 0x40acdc