Function at 0x40a1e2
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411677
mov eax, dword fs:[0]
push eax
mov eax, 0x2268
call fcn.00411150
mov eax, dword [0x413140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2224], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2238], ecx
mov dword [ebp - 0x2234], ebx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a352
push 0x7d
pop eax
cmp word [edi], ax
je 0x40a341
push 0x402858
push edi
mov dword [ebp - 0x2220], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x40282c
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2228], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a2a0
test esi, esi
je 0x40a370
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
cmp dword [ebp + 0x10], 0
je 0x40a370
xor eax, eax
mov ecx, edi
push 0x5c
pop edx
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], eax
call fcn.004097f6
test eax, eax
jne 0x40a85a
push edi
call fcn.00409e08
test eax, eax
je 0x40a310
mov eax, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2254]
push edi
mov dword [ebp - 0x2254], eax
call fcn.00409e87
xor eax, eax
mov dword [ebp - 0x2254], eax
cmp dword [ebp - 0x2228], 0
je 0x40a370
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00409d9b
mov esi, eax
test esi, esi
jns 0x40a5ba
mov ebx, dword [ebp - 0x2234]
test ebx, ebx
je 0x40a352
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004106d0
leave
ret 0x10
push 0x402844
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a398
mov ecx, dword [ebp - 0x221c]
push edi
mov dword [ebp - 0x2220], eax
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
push 0x402824
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a4d3
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
push eax
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40a85a
cmp dword [ebp + 0x10], 0
je 0x40a442
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov eax, dword [ebp - 0x2224]
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x2260], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2260]
push eax
call fcn.00409929
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2260], eax
test esi, esi
js 0x40a347
mov byte [ebp - 4], al
jmp 0x40a5ba
cmp dword [ebp + 0x14], 0
jne 0x40a4b8
cmp dword [ebp - 0x2220], 0
je 0x40a4b8
xor eax, eax
lea ecx, [ebp - 0x2248]
push 0x20006
push eax
push dword [ebp - 0x2224]
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], eax
call fcn.00409e3f
test eax, eax
jne 0x40a82e
mov ebx, dword [ebp - 0x2248]
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40a4a5
cmp eax, 2
jne 0x40a811
test ebx, ebx
je 0x40a4b8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x2248], eax
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00409d9b
mov esi, eax
test esi, esi
js 0x40a341
jmp 0x40a7fa
push 0x5c
pop edx
mov ecx, edi
call fcn.004097f6
test eax, eax
jne 0x40a85a
cmp dword [ebp + 0x10], eax
je 0x40a613
mov ebx, dword [ebp - 0x2224]
lea ecx, [ebp - 0x2234]
mov esi, 0x2001f
push esi
push edi
push ebx
call fcn.00409e3f
test eax, eax
je 0x40a578
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x2234]
call fcn.00409e3f
test eax, eax
je 0x40a578
lea eax, [ebp - 0x2270]
xor ecx, ecx
push eax
lea eax, [ebp - 0x2220]
mov dword [ebp - 0x2220], ecx
push eax
push ecx
push esi
push ecx
push ecx
push ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a56a
cmp dword [ebp - 0x2234], eax
je 0x40a55c
push dword [ebp - 0x2234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2234], ebx
jmp 0x40a570
mov ebx, dword [ebp - 0x2234]
test eax, eax
jne 0x40a84c
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40a5b4
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x2234]
push eax
call fcn.00409929
mov esi, eax
test esi, esi
js 0x40a341
mov ebx, dword [ebp - 0x2234]
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40a7fa
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2238]
jne 0x40a5cb
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40a7fa
xor eax, eax
push eax
push dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.0040a1e2
mov esi, eax
test esi, esi
js 0x40a341
push edi
mov ecx, ebx
call fcn.0040a094
jmp 0x40a4c4
cmp dword [ebp + 0x14], 0
jne 0x40a645
push 0x20019
push edi
push dword [ebp - 0x2224]
lea ecx, [ebp - 0x2234]
call fcn.00409e3f
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2228], eax
mov dword [ebp - 0x223c], ebx
test eax, eax
jne 0x40a64f
jmp 0x40a658
mov dword [ebp - 0x2228], 2
xor ebx, ebx
inc ebx
mov dword [ebp - 0x223c], ebx
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
mov ecx, eax
call fcn.00409d62
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.00409d9b
mov esi, eax
test esi, esi
js 0x40a341
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40a70a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2238]
jne 0x40a6b0
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40a70a
mov ecx, dword [ebp - 0x221c]
xor eax, eax
push ebx
mov ebx, dword [ebp - 0x2234]
push eax
push ebx
push edi
call fcn.0040a1e2
mov esi, eax
test esi, esi
jns 0x40a6f2
cmp dword [ebp - 0x223c], 0
je 0x40a341
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040a094
mov esi, eax
test esi, esi
js 0x40a341
jmp 0x40a710
mov ebx, dword [ebp - 0x2234]
mov eax, dword [ebp - 0x2228]
cmp eax, 2
je 0x40a7fa
test eax, eax
je 0x40a73b
cmp dword [ebp + 0x14], 0
jne 0x40a7fa
mov ecx, eax
call fcn.0040a07e
mov esi, eax
jmp 0x40a341
cmp dword [ebp + 0x14], 0
je 0x40a780
push ebx
call fcn.00409f57
test eax, eax
je 0x40a780
lea eax, [ebp - 0x218]
push eax
call fcn.00409e08
test eax, eax
je 0x40a7fa
cmp dword [ebp - 0x2220], 0
je 0x40a7fa
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2234]
call fcn.00409e87
jmp 0x40a7fa
push ebx
call fcn.00409f57
mov dword [ebp - 0x2228], eax
test ebx, ebx
je 0x40a7b1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2234], ebx
test eax, eax
jne 0x40a84c
mov eax, dword [ebp - 0x2228]
jmp 0x40a7b3
xor ecx, ecx
cmp dword [ebp - 0x2220], 0
je 0x40a7fa
test eax, eax
jne 0x40a7fa
mov eax, dword [ebp - 0x2224]
mov dword [ebp - 0x226c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2268], ecx
mov dword [ebp - 0x2264], ecx
lea ecx, [ebp - 0x226c]
push eax
call fcn.00409fb4
xor ecx, ecx
mov dword [ebp - 0x226c], ecx
test eax, eax
jne 0x40a72d
push 0x7d
pop eax
cmp word [edi], ax
je 0x40a341
mov ebx, dword [ebp - 0x2234]
jmp 0x40a267
mov ecx, eax
call fcn.0040a07e
mov esi, eax
test ebx, ebx
je 0x40a341
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a341
mov ecx, eax
call fcn.0040a07e
cmp dword [ebp - 0x2248], 0
mov esi, eax
je 0x40a341
push dword [ebp - 0x2248]
jmp 0x40a823
mov ecx, eax
call fcn.0040a07e
mov esi, eax
jmp 0x40a347
mov esi, 0x80020009
jmp 0x40a347