Function at 0x40b9a0
Capabilities:
Delete registry key
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, edx
cmp edi, ebx
mov esi, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
jne 0x40b9e4
mov edi, 0x80070057
jmp 0x40bf4c
cmp eax, ebx
je 0x40b9ea
mov dword [eax], ebx
add esi, 4
push dword [esi]
mov dword [ebp - 0x80], esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov ecx, esi
mov dword [esi], ebx
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [ebp - 0x70]
add esi, 8
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x403a50
mov ecx, esi
mov dword [esi], ebx
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a64
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a78
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x80]
push dword [eax]
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [ebp - 0x70]
add esi, 8
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x404b98
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a50
lea ecx, [ebp - 0x78]
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
lea ecx, [ebp - 0x78]
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a64
lea ecx, [ebp - 0x78]
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
lea ecx, [ebp - 0x78]
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a30
lea ecx, [ebp - 0x78]
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
lea ecx, [ebp - 0x78]
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 4
push dword [eax]
lea esi, [ebp - 0x78]
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x74]
push eax
mov edi, 0x20019
push edi
push ebx
push dword [ebp - 0x78]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
lea eax, [ebp - 0x74]
push eax
push edi
push ebx
push dword [ebp - 0x78]
push reloc.OLEAUT32.dll_SysReAllocString
jg 0x40bb9a
call esi
mov edi, eax
jmp 0x40bbaa
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jl 0x40bf4c
mov edi, dword [ebp - 0x70]
lea esi, [edi + 0xc]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [edi + 4]
mov dword [esi], ebx
push dword [eax]
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push esi
push 0x403b6c
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x10
push eax
push 0x403b7c
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x14
push eax
push 0x403bb0
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x18
push eax
push 0x403bec
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x1c
push eax
push 0x403c28
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov edi, dword [ebp - 0x70]
add edi, 0x20
push dword [edi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], ebx
push dword [esi]
mov esi, edi
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x20
push eax
push 0x403c54
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [ebp - 0x70]
add esi, 0x24
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x40399c
mov ecx, esi
mov dword [esi], ebx
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x20
push dword [eax]
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x4039d4
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push esi
push 0x403c7c
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x105
lea eax, [ebp - 0x6c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
mov dword [esi], ebx
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [ebp - 0x70]
add esi, 0x28
mov ecx, esi
call fcn.0040d075
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a10
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a1c
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403958
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push esi
push 0x403ca4
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x2c
push eax
push 0x403cc4
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x30
push eax
push 0x403cdc
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [ebp - 0x70]
add esi, 0x34
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x404b98
mov ecx, esi
mov dword [esi], ebx
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push esi
push 0x403cf8
push dword [ebp - 0x74]
call fcn.0040ce5c
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [esi]
push 0x404b98
push esi
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x40bf37
mov esi, dword [ebp - 0x70]
add esi, 8
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x403a50
mov ecx, esi
mov dword [esi], ebx
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a64
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
push 0x403a78
mov ecx, esi
call fcn.0040919e
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 4
push dword [eax]
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov esi, dword [ebp - 0x70]
add esi, 8
mov ecx, esi
call fcn.0040d160
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov eax, dword [ebp - 0x70]
add eax, 0x34
push dword [eax]
call fcn.004090a2
mov edi, eax
cmp edi, ebx
jl 0x40bf4c
mov ecx, dword [ebp - 0x7c]
cmp ecx, ebx
je 0x40bf48
mov eax, dword [ebp - 0x70]
add eax, 8
mov eax, dword [eax]
mov dword [ecx], eax
cmp edi, ebx
jge 0x40bf9b
mov esi, dword [ebp - 0x70]
push dword [esi + 8]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jbe 0x40bf9b
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x74]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bf9b
cmp dword [ebp - 0x74], ebx
je 0x40bfa9
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 8]
mov dword [ebp - 0x74], ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor edi, edi
inc edi
cmp dword [ebp - 0x74], ebx
je 0x40bfa9
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x78]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp + 0x1a0]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x1a4
leave
ret 4