Function at 0x404158
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x2254
call fcn.00425750
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0x2250], eax
mov eax, dword [esp + 0x225c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x2264]
mov ebp, ecx
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.00404016
mov esi, eax
test esi, esi
js 0x404680
push ebx
push 0x7d
pop eax
cmp word [edi], ax
je 0x40467f
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4041e2
test ebx, ebx
je 0x404294
push edi
mov ecx, ebp
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
xor esi, esi
cmp dword [esp + 0x2270], esi
je 0x404296
push 0x5c
pop edx
mov ecx, edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.0040378e
test eax, eax
jne 0x404671
push edi
call fcn.00403d02
test eax, eax
je 0x404251
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.00403def
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
test ebx, ebx
je 0x404289
push edi
mov ecx, ebp
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40466b
push edi
mov ecx, ebp
call fcn.00403c9b
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.00403f25
test esi, esi
js 0x40467f
xor ebx, ebx
jmp 0x404612
lea ecx, [esp + 0x24]
call fcn.00403f25
jmp 0x404296
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4042c0
mov ebx, esi
mov ecx, ebp
push edi
mov dword [esp + 0x24], ebx
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
jmp 0x4042c4
mov ebx, dword [esp + 0x20]
push 0x43f074
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4043d0
lea eax, [esp + 0x260]
mov ecx, ebp
push eax
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
push edi
mov ecx, ebp
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40467a
cmp dword [esp + 0x2270], 0
je 0x404364
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x260]
push edi
push eax
mov dword [esp + 0x3c], ebx
lea eax, [esp + 0x3c]
xor ebx, ebx
mov ecx, ebp
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.0040390a
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebx
mov esi, eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00403f25
test esi, esi
js 0x40467f
jmp 0x404612
cmp dword [esp + 0x2274], 0
jne 0x4043c3
test ebx, ebx
je 0x4043c3
xor eax, eax
lea ecx, [esp + 0x4c]
push 0x20006
push eax
push dword [esp + 0x18]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.00403d91
test eax, eax
jne 0x4046a5
lea eax, [esp + 0x260]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4043ba
cmp eax, 2
jne 0x4046a5
lea ecx, [esp + 0x4c]
call fcn.00403f25
push edi
mov ecx, ebp
call fcn.00403c9b
jmp 0x404660
push 0x5c
pop edx
mov ecx, edi
call fcn.0040378e
test eax, eax
jne 0x40467a
cmp dword [esp + 0x2270], eax
je 0x404462
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0x2001f
push edi
push ebx
call fcn.00403d91
test eax, eax
je 0x40442d
push 0x20019
push edi
push ebx
lea ecx, [esp + 0x20]
call fcn.00403d91
test eax, eax
je 0x40442d
sub esp, 0x14
lea ecx, [esp + 0x28]
push edi
push ebx
call fcn.004037ba
test eax, eax
jne 0x4046b9
push edi
mov ecx, ebp
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
push 0x3d
pop eax
xor ebx, ebx
cmp word [edi], ax
jne 0x404612
push edi
push ebx
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call fcn.0040390a
mov esi, eax
jmp 0x404357
cmp dword [esp + 0x2274], 0
jne 0x404483
push 0x20019
push edi
push dword [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.00403d91
mov ebx, eax
jmp 0x404486
push 2
pop ebx
mov eax, dword [esp + 0x2274]
test ebx, ebx
push 1
pop ecx
push 0xffffffffffffffff
cmovne eax, ecx
push edi
mov dword [esp + 0x38], eax
lea eax, [esp + 0x60]
push 0x104
push eax
call fcn.0042a222
push eax
call fcn.00404c55
add esp, 0x14
mov ecx, ebp
push edi
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
push edi
mov ecx, ebp
call fcn.00403c9b
mov esi, eax
test esi, esi
js 0x40467f
push 0x7b
pop eax
cmp word [edi], ax
jne 0x404523
push edi
call fcn.0042a08a
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x404523
push dword [esp + 0x30]
mov ecx, ebp
push 0
push dword [esp + 0x1c]
push edi
call fcn.00404158
mov esi, eax
test esi, esi
jns 0x404511
cmp dword [esp + 0x30], 0
je 0x40467f
push edi
mov ecx, ebp
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
cmp ebx, 2
je 0x4041a6
test ebx, ebx
je 0x40454c
cmp dword [esp + 0x2274], 0
jne 0x4041a6
mov ecx, ebx
call fcn.00404008
mov esi, eax
jmp 0x40467f
cmp dword [esp + 0x2274], 0
je 0x404594
push dword [esp + 0x14]
call fcn.00403eee
test eax, eax
je 0x404594
lea eax, [esp + 0x58]
push eax
call fcn.00403d02
test eax, eax
je 0x4041a6
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4041a6
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
call fcn.00403def
jmp 0x4041a6
push dword [esp + 0x14]
call fcn.00403eee
mov ecx, dword [esp + 0x14]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x4045b6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [esp + 0x14], ecx
and dword [esp + 0x18], 0
test eax, eax
jne 0x4046b9
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4041a6
test ebx, ebx
jne 0x4041a6
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call fcn.00403f90
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
test eax, eax
jne 0x4046c0
lea ecx, [esp + 0x40]
call fcn.00403f25
cmp dword [esp + 0x2270], 0
je 0x4041a6
push 0x7b
pop eax
cmp word [edi], ax
jne 0x4041a6
push edi
call fcn.0042a08a
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x4041a6
push ebx
push dword [esp + 0x2274]
mov ecx, ebp
push dword [esp + 0x1c]
push edi
call fcn.00404158
mov esi, eax
test esi, esi
js 0x40467f
push edi
mov ecx, ebp
call fcn.00404016
mov esi, eax
test esi, esi
js 0x40467f
jmp 0x4041a6
lea ecx, [esp + 0x24]
jmp 0x4046b2
lea ecx, [esp + 0x24]
call fcn.00403f25
mov esi, 0x80020009
pop ebx
lea ecx, [esp + 0x10]
call fcn.00403f25
mov ecx, dword [esp + 0x225c]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004246ea
add esp, 0x2254
ret 0x10
mov ecx, eax
call fcn.00404008
lea ecx, [esp + 0x4c]
mov esi, eax
call fcn.00403f25
jmp 0x40467f
mov ecx, eax
jmp 0x404540
mov ecx, eax
call fcn.00404008
lea ecx, [esp + 0x40]
jmp 0x4046b0