Function at 0x40f2a7
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call fcn.00413df9
push eax
push dword [ebp + 0x14]
call fcn.00413df9
push eax
push dword [ebp + 0x10]
call fcn.004144b1
push eax
push dword [edi + 0x50]
push 0x20000173
push 2
call fcn.00405678
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00443f62
cmp dword [ebp - 0x10], 5
jge 0x40f30f
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40f357
push dword [ebp + 0x10]
push str.Resume
push ebx
call fcn.0044194c
mov esi, eax
test esi, esi
jns 0x40f334
push str.Failed_to_write_Resume_value.
jmp 0x40f4b8
cmp dword [ebp + 0x10], 3
jne 0x40f357
push 1
push str.Installed
push ebx
call fcn.0044194c
mov esi, eax
test esi, esi
jns 0x40f35d
push str.Failed_to_write_Installed_value.
jmp 0x40f4b8
cmp dword [ebp + 0x10], 1
je 0x40f367
cmp dword [ebp + 0x14], 0
je 0x40f3fe
cmp dword [edi + 8], 0
jne 0x40f3fe
push str.burn.runonce
push dword [edi + 0x54]
lea eax, [ebp - 8]
push str.__ls____ls
push eax
call fcn.0040204d
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x40f39a
push str.Failed_to_format_resume_command_line_for_RunOnce.
jmp 0x40f4b8
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0xc]
push dword [edi + 0x4c]
call fcn.0044106b
mov esi, eax
test esi, esi
jns 0x40f3be
push str.Failed_to_create_run_key.
jmp 0x40f4b8
push dword [ebp - 8]
push dword [edi + 0x10]
push dword [ebp - 4]
call fcn.0044199a
mov esi, eax
test esi, esi
jns 0x40f3dc
push str.Failed_to_write_run_key_value.
jmp 0x40f4b8
push dword [edi + 0x58]
push str.BundleResumeCommandLine
push ebx
call fcn.0044199a
mov esi, eax
test esi, esi
jns 0x40f4c0
push str.Failed_to_write_resume_command_line_value.
jmp 0x40f4b8
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0xc]
push dword [edi + 0x4c]
call fcn.00441436
mov esi, eax
cmp esi, 0x80070002
je 0x40f46c
cmp esi, 0x80070003
je 0x40f46c
push dword [edi + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [eax - 2]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x40f46e
test ecx, ecx
jg 0x40f443
mov esi, ecx
jmp 0x40f44c
movzx esi, cx
or esi, 0x80070000
test esi, esi
js 0x40f455
mov esi, 0x80004005
push esi
push 0x4e7
push str.c:_agent_work138_s_src_burnengine_registration.cpp
call fcn.004038f5
push str.Failed_to_delete_run_key_value.
jmp 0x40f4b8
xor esi, esi
test ebx, ebx
je 0x40f4c0
push str.BundleResumeCommandLine
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [eax - 2]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x40f4c0
test ecx, ecx
jg 0x40f491
mov esi, ecx
jmp 0x40f49a
movzx esi, cx
or esi, 0x80070000
test esi, esi
js 0x40f4a3
mov esi, 0x80004005
push esi
push 0x4f1
push str.c:_agent_work138_s_src_burnengine_registration.cpp
call fcn.004038f5
push str.Failed_to_delete_resume_command_line_value.
push esi
call fcn.00440657
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x40f4ce
push dword [ebp - 8]
call fcn.0040278d
cmp dword [ebp - 4], 0
je 0x40f4dd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10