Function at 0x4099e0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x434ea6
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.00429820
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x2248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x2260]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2274]
mov ebx, dword [esp + 0x2270]
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov edx, dword [esp + 0x227c]
mov eax, ebx
mov dword [esp + 0x2268], esi
mov dword [esp + 0x50], edx
call fcn.00409870
mov ebp, eax
cmp ebp, esi
jl 0x40a09d
cmp word [ebx], 0x7d
je 0x40a09b
lea esp, [esp]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [esp + 0x2c], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x409aa1
test edi, edi
je 0x409bdf
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a08c
xor ebp, ebp
cmp dword [esp + 0x2278], ebp
je 0x409bd9
movzx ecx, word [ebx]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov eax, ebx
cmp cx, bp
je 0x409afb
mov esi, dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, cx
cmp cx, 0x5c
je 0x409af3
push eax
call esi
movzx ecx, word [eax]
cmp cx, bp
jne 0x409ae0
jmp 0x409afb
cmp eax, ebp
jne 0x40a02c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebp, 0x43b168
mov eax, dword [ebp]
push eax
push ebx
call esi
test eax, eax
je 0x409b3c
add ebp, 4
cmp ebp, 0x43b198
jl 0x409b06
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], ecx
xor ebp, ebp
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], ebp
call fcn.00409620
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
test edi, edi
je 0x409bcf
mov esi, dword [esp + 0x18]
mov eax, ebx
mov ecx, esi
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a045
mov edi, ebx
mov ecx, esi
call fcn.00409570
mov ebp, eax
test ebp, ebp
jl 0x40a045
mov dword [esp + 0x30], 0
cmp word [ebx], 0x7b
jne 0x409bc0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x409bc0
mov ecx, dword [esp + 0x2278]
mov edx, dword [esp + 0x1c]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ebx
call fcn.004099e0
mov ebp, eax
test ebp, ebp
jl 0x40a08c
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a08c
cmp word [ebx], 0x7d
jne 0x409a70
jmp 0x40a08c
mov dword [esp + 0x30], 0
jmp 0x409bdf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebp, dword [esp + 0x1c]
push str.NoRemove
push ebx
call esi
test eax, eax
jne 0x409c12
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, ebx
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a08c
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x43aee0
push ebx
xor edi, edi
call esi
test eax, eax
jne 0x409d3e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x25c]
call fcn.00409870
mov ebp, eax
cmp ebp, edi
jl 0x40a08c
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a08c
cmp word [ebx], 0x3d
jne 0x40a035
xor esi, esi
cmp dword [esp + 0x2278], esi
je 0x409cb5
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x2268], 1
push ebx
lea eax, [esp + 0x44]
mov dword [esp + 0x44], edx
push eax
lea edx, [esp + 0x264]
mov dword [esp + 0x4c], esi
call fcn.00409200
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
jl 0x40a04b
mov byte [esp + 0x2268], 0
mov dword [esp + 0x44], esi
jmp 0x409b76
cmp dword [esp + 0x227c], esi
jne 0x409d2a
cmp dword [esp + 0x24], esi
je 0x409d2a
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push ecx
push 0x20006
push esi
push esi
push edx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40a05f
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x25c]
push eax
push edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x409d17
cmp eax, 2
jne 0x40a05f
cmp edi, esi
je 0x409d26
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x18]
mov edi, ebx
call fcn.00409570
mov ebp, eax
cmp ebp, esi
jmp 0x409bba
movzx ecx, word [ebx]
mov eax, ebx
cmp cx, di
je 0x409d6f
movzx ecx, cx
jmp 0x409d50
cmp cx, 0x5c
je 0x409d67
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, di
jne 0x409d50
jmp 0x409d6f
cmp eax, edi
jne 0x40a035
cmp dword [esp + 0x2278], edi
je 0x409e51
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push ecx
push 0x2001f
push edi
push ebx
push edx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x409dbc
xor eax, eax
cmp ebp, edi
je 0x409da8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x409e12
xor edi, edi
mov ebp, ecx
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x409df8
xor eax, eax
cmp ebp, edi
je 0x409de8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x409e12
mov edx, dword [esp + 0x28]
push edx
mov edx, ebx
lea esi, [esp + 0x20]
call fcn.00408f80
mov edi, eax
test edi, edi
jne 0x40a06a
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a08c
cmp word [ebx], 0x3d
jne 0x409b76
mov ecx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x20]
push eax
xor edx, edx
call fcn.00409200
mov ebp, eax
test ebp, ebp
jl 0x40a08c
jmp 0x409b76
cmp dword [esp + 0x227c], edi
jne 0x409f68
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [esp + 0x48], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x409e96
xor eax, eax
cmp ebp, edi
je 0x409e8a
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
mov esi, eax
cmp eax, edi
je 0x409ea7
mov dword [esp + 0x227c], 1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x5c]
push 0x104
push edx
call fcn.0041b647
push eax
call fcn.00402ed0
mov ecx, dword [esp + 0x2c]
add esp, 0x14
mov eax, ebx
call fcn.00409870
mov ebp, eax
cmp ebp, edi
jl 0x40a08c
mov ecx, dword [esp + 0x18]
mov edi, ebx
call fcn.00409570
mov ebp, eax
test ebp, ebp
jl 0x40a08c
cmp word [ebx], 0x7b
jne 0x409f3a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x409f3a
mov edi, dword [esp + 0x227c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edi
push 0
push eax
push ebx
call fcn.004099e0
mov ebp, eax
test ebp, ebp
jge 0x409f25
test edi, edi
je 0x40a08c
mov ecx, dword [esp + 0x18]
mov eax, ebx
call fcn.00409870
mov ebp, eax
test ebp, ebp
jl 0x40a08c
mov eax, dword [esp + 0x50]
mov dword [esp + 0x227c], eax
cmp esi, 2
je 0x409bc0
test esi, esi
je 0x409f72
test eax, eax
jne 0x409bc0
mov eax, esi
call fcn.00409830
mov ebp, eax
jmp 0x40a08c
mov esi, 2
jmp 0x409e9c
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x409fb5
mov ecx, esi
call fcn.00409770
test eax, eax
je 0x409fb5
lea ecx, [esp + 0x54]
push ecx
call fcn.004095e0
test eax, eax
je 0x409bc0
cmp dword [esp + 0x24], 0
je 0x409bc0
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
call fcn.00409620
jmp 0x409bc0
mov ecx, esi
call fcn.00409770
xor edi, edi
mov dword [esp + 0x34], eax
test esi, esi
je 0x409fd7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test edi, edi
jne 0x40a06a
cmp dword [esp + 0x24], edi
je 0x409bc0
cmp dword [esp + 0x34], edi
jne 0x409bc0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x4c], edi
lea edi, [esp + 0x54]
lea esi, [esp + 0x48]
mov dword [esp + 0x48], eax
call fcn.004097d0
xor ecx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
cmp eax, ecx
jne 0x40a07c
call fcn.004097b0
jmp 0x409bc0
lea esi, [esp + 0x2c]
call fcn.004097b0
lea esi, [esp + 0x1c]
call fcn.004097b0
mov eax, 0x80020009
jmp 0x40a09d
lea esi, [esp + 0x2c]
jmp 0x40a087
lea esi, [esp + 0x40]
call fcn.004097b0
lea esi, [esp + 0x1c]
call fcn.004097b0
jmp 0x40a09b
call fcn.00409830
lea esi, [esp + 0x38]
jmp 0x40a085
lea esi, [esp + 0x1c]
call fcn.004097b0
mov eax, edi
call fcn.00409830
jmp 0x40a09d
call fcn.00409830
lea esi, [esp + 0x48]
mov ebp, eax
call fcn.004097b0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a09b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x2260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2248]
xor ecx, esp
call fcn.0041a78f
add esp, 0x2258
ret 0x10