Function at 0x408827
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cba7
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.0041bec0
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2258], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2254]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x225c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x2268], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
push ebx
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
push 0x7d
pop eax
cmp word [ebx], ax
je 0x408e6d
xor eax, eax
inc eax
push str.Delete
push ebx
mov dword [ebp - 0x2260], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push ebx
mov dword [ebp - 0x2264], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4088e9
test esi, esi
je 0x4089ca
push ebx
mov ecx, edi
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4089cc
xor eax, eax
lea edi, [ebp - 0x2224]
stosd dword es:[edi], eax
mov ecx, ebx
push 0x5c
pop edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
call fcn.00407db6
test eax, eax
jne 0x408e5d
push ebx
call fcn.0040847b
test eax, eax
je 0x408975
mov eax, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2224]
push ebx
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
call fcn.004084aa
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov dword [ebp - 0x221c], esi
cmp dword [ebp - 0x2264], esi
je 0x4089b7
mov edi, dword [ebp - 0x2258]
mov ecx, edi
push ebx
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e55
push ebx
mov ecx, edi
call fcn.00408414
lea ecx, [ebp - 0x2224]
mov esi, eax
call fcn.00401e03
test esi, esi
js 0x408e6d
jmp 0x408dea
lea ecx, [ebp - 0x2224]
call fcn.00401e03
mov edi, dword [ebp - 0x2258]
jmp 0x4089cc
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4089f4
push ebx
mov ecx, edi
mov dword [ebp - 0x2260], esi
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
push 0x425394
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408b47
lea eax, [ebp - 0x2218]
mov ecx, edi
push eax
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
push ebx
mov ecx, edi
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x408e68
cmp dword [ebp + 0x10], 0
je 0x408abc
xor eax, eax
lea edi, [ebp - 0x2230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
xor ecx, ecx
mov edi, dword [ebp - 0x2258]
inc ecx
mov byte [ebp - 4], cl
mov ecx, edi
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.00407f66
mov esi, eax
lea ecx, [ebp - 0x2230]
xor eax, eax
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
test esi, esi
js 0x408ea7
mov byte [ebp - 4], al
call fcn.00401e03
jmp 0x408dea
cmp dword [ebp + 0x14], 0
jne 0x408b3a
cmp dword [ebp - 0x2260], 0
je 0x408b3a
xor eax, eax
lea edi, [ebp - 0x2248]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2248]
push 0x20006
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push dword [ebp - 0x225c]
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], eax
call fcn.00401d8a
test eax, eax
jne 0x408e98
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2248]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x408b29
cmp eax, 2
jne 0x408e98
lea ecx, [ebp - 0x2248]
call fcn.00401e03
mov edi, dword [ebp - 0x2258]
push ebx
mov ecx, edi
call fcn.00408414
jmp 0x408e39
push 0x5c
pop edx
mov ecx, ebx
call fcn.00407db6
test eax, eax
jne 0x408e68
cmp dword [ebp + 0x10], eax
je 0x408be3
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
push 0x2001f
push ebx
push esi
call fcn.00401d8a
test eax, eax
je 0x408bac
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x2254]
call fcn.00401d8a
test eax, eax
je 0x408bac
sub esp, 0x14
lea ecx, [ebp - 0x2254]
push ebx
push esi
call fcn.00407de2
test eax, eax
jne 0x408ebd
push ebx
mov ecx, edi
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x408dea
push ebx
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x2254]
push eax
call fcn.00407f66
mov esi, eax
jmp 0x4089aa
cmp dword [ebp + 0x14], 0
jne 0x408c04
push 0x20019
push ebx
push dword [ebp - 0x225c]
lea ecx, [ebp - 0x2254]
call fcn.00401d8a
mov edi, eax
jmp 0x408c07
push 2
pop edi
mov eax, dword [ebp + 0x14]
test edi, edi
push 1
pop ecx
push 0xffffffffffffffff
cmovne eax, ecx
push ebx
mov dword [ebp - 0x2264], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040fa64
push eax
call fcn.0040217f
mov ecx, dword [ebp - 0x2258]
add esp, 0x14
push ebx
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.00408414
mov esi, eax
test esi, esi
js 0x408e6d
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x408ccc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2268]
jne 0x408c6e
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x408ccc
push dword [ebp - 0x2264]
mov ecx, dword [ebp - 0x2258]
xor eax, eax
push eax
push dword [ebp - 0x2254]
push ebx
call fcn.00408827
mov esi, eax
test esi, esi
jns 0x408cb6
cmp dword [ebp - 0x2264], 0
je 0x408e6d
mov ecx, dword [ebp - 0x2258]
push ebx
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
cmp edi, 2
je 0x408e3f
test edi, edi
je 0x408cf1
cmp dword [ebp + 0x14], 0
jne 0x408e3f
mov ecx, edi
call fcn.004086c3
mov esi, eax
jmp 0x408e6d
cmp dword [ebp + 0x14], 0
je 0x408d3e
push dword [ebp - 0x2254]
call fcn.004085ab
test eax, eax
je 0x408d3e
lea eax, [ebp - 0x218]
push eax
call fcn.0040847b
test eax, eax
je 0x408e3f
cmp dword [ebp - 0x2260], 0
je 0x408e3f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2254]
call fcn.004084aa
jmp 0x408e3f
push dword [ebp - 0x2254]
call fcn.004085ab
mov ecx, dword [ebp - 0x2254]
mov edi, eax
xor eax, eax
test ecx, ecx
je 0x408d66
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2254], ecx
xor ecx, ecx
mov dword [ebp - 0x2250], ecx
test eax, eax
jne 0x408ebd
cmp dword [ebp - 0x2260], ecx
je 0x408e41
test edi, edi
jne 0x408e41
lea edi, [ebp - 0x223c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x223c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x225c]
xor edi, edi
mov dword [ebp - 0x223c], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
call fcn.0040864a
mov dword [ebp - 0x223c], edi
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
test eax, eax
jne 0x408eae
lea ecx, [ebp - 0x223c]
call fcn.00401e03
mov edi, dword [ebp - 0x2258]
cmp dword [ebp + 0x10], 0
je 0x408e3f
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x408e3f
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2268]
jne 0x408dfd
sub ecx, edx
xor eax, eax
sar ecx, 1
inc eax
cmp ecx, eax
jne 0x408e42
xor eax, eax
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2254]
push ebx
call fcn.00408827
mov esi, eax
test esi, esi
js 0x408e6d
push ebx
mov ecx, edi
call fcn.004086d1
mov esi, eax
test esi, esi
js 0x408e6d
xor eax, eax
inc eax
push 0x7d
pop ecx
cmp word [ebx], cx
je 0x408e6d
mov edi, dword [ebp - 0x2258]
jmp 0x4088b4
lea ecx, [ebp - 0x2224]
jmp 0x408ea7
lea ecx, [ebp - 0x2224]
call fcn.00401e03
mov esi, 0x80020009
lea ecx, [ebp - 0x2254]
call fcn.00401e03
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004097ab
mov esp, ebp
pop ebp
ret 0x10
mov ecx, eax
call fcn.004086c3
lea ecx, [ebp - 0x2248]
mov esi, eax
call fcn.00401e03
jmp 0x408e6d
mov ecx, eax
call fcn.004086c3
lea ecx, [ebp - 0x223c]
jmp 0x408ea5
mov ecx, eax
jmp 0x408ce5