Function at 0x40a278
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x427009
call fcn.0041ba64
sub esp, 0x230
mov eax, dword [0x42c300]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x234], eax
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jge 0x40a419
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040a95c
jmp 0x40a92c
push 0x40154c
push edi
mov dword [ebp - 0x230], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
neg esi
sbb esi, esi
push 0x401560
inc esi
push edi
mov dword [ebp - 0x224], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40a30f
cmp esi, ebx
je 0x40a43b
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
cmp dword [ebp + 0x10], ebx
je 0x40a43b
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 1
mov cl, byte [edi]
mov eax, edi
jmp 0x40a349
cmp cl, 0x5c
je 0x40a34f
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
cmp cl, bl
jne 0x40a33b
jmp 0x40a357
cmp eax, ebx
jne 0x40a861
mov esi, 0x40147c
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40a386
add esi, 4
cmp esi, 0x4014ac
jl 0x40a35c
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.0040aa42
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x224], ebx
je 0x40a427
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a89d
mov ecx, dword [ebp - 0x220]
push edi
call fcn.0040a9dd
mov esi, eax
cmp esi, ebx
jl 0x40a89d
mov byte [ebp - 4], bl
cmp dword [ebp + 8], ebx
je 0x40a3d2
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
cmp byte [edi], 0x7b
jne 0x40a419
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x40a419
mov ecx, dword [ebp - 0x220]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x21c]
push edi
call fcn.0040a278
mov esi, eax
cmp esi, ebx
jl 0x40a90e
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
cmp byte [edi], 0x7d
jne 0x40a2d4
jmp 0x40a90e
mov byte [ebp - 4], bl
cmp dword [ebp + 8], ebx
je 0x40a43b
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
push 0x401554
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40a467
mov ecx, dword [ebp - 0x220]
push edi
mov dword [ebp - 0x230], ebx
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
push 0x40156c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40a59f
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
cmp byte [edi], 0x3d
jne 0x40a875
cmp dword [ebp + 0x10], ebx
je 0x40a51e
mov dword [ebp - 0x22c], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x22c], eax
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0040ab0c
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x22c], ebx
jl 0x40a8b3
mov byte [ebp - 4], bl
cmp dword [ebp - 0x22c], ebx
je 0x40a3d2
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x22c], ebx
jmp 0x40a3d2
cmp dword [ebp + 0x14], ebx
jne 0x40a58e
cmp dword [ebp - 0x230], ebx
je 0x40a58e
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 3
push 0x20006
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x228]
call fcn.0040a973
cmp eax, ebx
jne 0x40a8d2
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x40a571
cmp eax, 2
jne 0x40a8d2
mov byte [ebp - 4], bl
cmp dword [ebp - 0x228], ebx
je 0x40a58e
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], ebx
mov ecx, dword [ebp - 0x220]
push edi
call fcn.0040a9dd
jmp 0x40a40f
mov cl, byte [edi]
mov eax, edi
jmp 0x40a5b3
cmp cl, 0x5c
je 0x40a5b9
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
cmp cl, bl
jne 0x40a5a5
jmp 0x40a5c1
cmp eax, ebx
jne 0x40a875
cmp dword [ebp + 0x10], ebx
je 0x40a698
mov esi, 0x2001f
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x21c]
call fcn.0040a973
cmp eax, ebx
je 0x40a656
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x21c]
call fcn.0040a973
cmp eax, ebx
je 0x40a656
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x230], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40a8f9
xor eax, eax
cmp dword [ebp - 0x21c], ebx
je 0x40a642
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], ebx
cmp eax, ebx
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x21c], ecx
jne 0x40a8f9
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
cmp byte [edi], 0x3d
jne 0x40a3d2
mov ecx, dword [ebp - 0x220]
push edi
push ebx
lea eax, [ebp - 0x21c]
push eax
call fcn.0040ab0c
mov esi, eax
cmp esi, ebx
jl 0x40a90e
jmp 0x40a3d2
cmp dword [ebp + 0x14], ebx
jne 0x40a6b9
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x21c]
call fcn.0040a973
mov dword [ebp - 0x224], eax
jmp 0x40a6c3
mov dword [ebp - 0x224], 2
cmp dword [ebp - 0x224], ebx
je 0x40a6d2
mov dword [ebp + 0x14], 1
push 0x104
push edi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
mov ecx, dword [ebp - 0x220]
push edi
call fcn.0040a9dd
mov esi, eax
cmp esi, ebx
jl 0x40a90e
cmp byte [edi], 0x7b
jne 0x40a751
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x220]
push ebx
push dword [ebp - 0x21c]
push edi
call fcn.0040a278
mov esi, eax
cmp esi, ebx
jge 0x40a73b
cmp dword [ebp + 0x14], ebx
je 0x40a90e
mov ecx, dword [ebp - 0x220]
push edi
call fcn.00409e1d
mov esi, eax
cmp esi, ebx
jl 0x40a90e
cmp dword [ebp - 0x224], 2
mov eax, dword [ebp - 0x234]
mov dword [ebp + 0x14], eax
je 0x40a419
cmp dword [ebp - 0x224], ebx
je 0x40a782
cmp eax, ebx
jne 0x40a419
push dword [ebp - 0x224]
jmp 0x40a8fa
cmp dword [ebp - 0x234], ebx
je 0x40a7fc
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
call fcn.0040a9a8
test eax, eax
je 0x40a7fc
mov dword [ebp - 0x224], 0x40147c
mov eax, dword [ebp - 0x224]
push dword [eax]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40a419
add dword [ebp - 0x224], 4
cmp dword [ebp - 0x224], 0x4014ac
jl 0x40a7a9
cmp dword [ebp - 0x230], ebx
je 0x40a419
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040aa42
jmp 0x40a419
cmp dword [ebp - 0x21c], ebx
je 0x40a81e
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov dword [ebp - 0x21c], ebx
jne 0x40a8f9
cmp dword [ebp - 0x230], ebx
je 0x40a419
mov dword [ebp - 0x238], ebx
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x114]
push ecx
push eax
mov dword [ebp - 0x238], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
mov dword [ebp - 0x238], ebx
jne 0x40a903
mov byte [ebp - 4], bl
jmp 0x40a419
mov byte [ebp - 4], bl
cmp dword [ebp + 8], ebx
je 0x40a875
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], ebx
je 0x40a893
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], ebx
mov eax, 0x80020009
jmp 0x40a92e
mov byte [ebp - 4], bl
cmp dword [ebp + 8], ebx
je 0x40a90e
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
jmp 0x40a90e
mov byte [ebp - 4], bl
cmp dword [ebp - 0x22c], ebx
je 0x40a90e
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x22c], ebx
jmp 0x40a90e
push eax
call fcn.0040a947
mov esi, eax
mov byte [ebp - 4], bl
cmp dword [ebp - 0x228], ebx
je 0x40a90e
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], ebx
jmp 0x40a90e
push eax
call fcn.0040a947
mov esi, eax
jmp 0x40a90e
push eax
call fcn.0040a947
mov esi, eax
mov byte [ebp - 4], bl
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], ebx
je 0x40a92c
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041b4ee
leave
ret 0x10