Function at 0x404930
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63c5c6
mov eax, dword fs:[0]
push eax
mov eax, 0x119c
call fcn.00607930
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x111c], edi
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x1128], ebx
mov dword [ebp - 0x1124], ebx
mov dword [ebp - 0x1120], ebx
mov ecx, dword [ebp + 0x14]
push 0xc
mov dword [ebp - 4], ebx
mov edx, dword [0x6c2424]
push str.Num_Els___d_n
push 2
push edx
lea eax, [ebp - 0x1144]
push eax
mov dword [ebp - 0x116c], ecx
mov dword [ebp - 0x1144], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1140], 0x577
call fcn.004017b0
add esp, 0x14
mov eax, esi
call fcn.00403bc0
mov edi, eax
cmp edi, ebx
jl 0x405174
cmp byte [esi], 0x7d
je 0x405172
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push esi
mov dword [ebp - 0x113c], 1
call edi
neg eax
push str.ForceRemove
sbb ebx, ebx
push esi
inc ebx
call edi
test eax, eax
je 0x404a14
test ebx, ebx
je 0x404b5f
mov edi, dword [ebp - 0x111c]
mov eax, esi
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
xor eax, eax
cmp dword [ebp + 0x10], eax
je 0x404b5f
mov cl, byte [esi]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1130], eax
mov eax, esi
test cl, cl
je 0x404a6c
cmp cl, 0x5c
je 0x404a64
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x404a50
jmp 0x404a6c
test eax, eax
jne 0x405139
mov edi, 0x66cf28
mov ecx, dword [edi]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404ac4
add edi, 4
cmp edi, 0x66cf58
jl 0x404a71
mov edx, dword [ebp - 0x112c]
xor edi, edi
push esi
lea ecx, [ebp - 0x1138]
mov dword [ebp - 0x1138], edx
mov dword [ebp - 0x1134], edi
mov dword [ebp - 0x1130], edi
call fcn.004026d0
mov dword [ebp - 0x1138], edi
mov dword [ebp - 0x1134], edi
mov dword [ebp - 0x1130], edi
jmp 0x404ac6
xor edi, edi
cmp ebx, edi
je 0x404b59
mov ebx, dword [ebp - 0x111c]
mov eax, esi
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405156
mov ecx, ebx
call fcn.00404340
mov edi, eax
test edi, edi
js 0x405156
mov dword [ebp - 0x1134], 0
cmp byte [esi], 0x7b
jne 0x404b4b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x404b4b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1128]
mov ebx, dword [ebp - 0x111c]
push 0
push eax
push ecx
push esi
mov ecx, ebx
call fcn.00404930
mov edi, eax
test edi, edi
js 0x405161
mov eax, esi
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
cmp byte [esi], 0x7d
jne 0x4049e3
jmp 0x405161
mov dword [ebp - 0x1134], edi
push str.NoRemove
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404b8c
mov edi, dword [ebp - 0x111c]
mov dword [ebp - 0x113c], eax
mov eax, esi
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
mov ebx, dword [ebp - 0x111c]
push 0x66cf04
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404d30
lea eax, [ebp - 0x1118]
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
mov eax, esi
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
cmp byte [esi], 0x3d
jne 0x405144
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x404c41
mov eax, dword [ebp - 0x112c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1118]
push ecx
lea edx, [ebp - 0x1168]
mov dword [ebp - 0x1168], eax
xor eax, eax
push edx
mov ecx, esi
mov edx, ebx
mov dword [ebp - 0x1164], eax
mov dword [ebp - 0x1160], eax
call fcn.00403d20
mov edi, eax
xor eax, eax
mov dword [ebp - 0x1168], eax
mov dword [ebp - 0x1164], eax
mov dword [ebp - 0x1160], eax
cmp edi, eax
jl 0x405192
mov byte [ebp - 4], al
mov dword [ebp - 0x1164], eax
jmp 0x404b02
cmp dword [ebp + 0x14], edi
jne 0x404d24
cmp dword [ebp - 0x113c], edi
je 0x404d24
mov ecx, dword [0x6c2424]
lea eax, [ebp - 0x1118]
push eax
push str.Deleting__s_n
push 1
push ecx
lea edx, [ebp - 0x117c]
push edx
mov dword [ebp - 0x117c], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1178], 0x5c2
call fcn.004017b0
mov ecx, dword [ebp - 0x112c]
add esp, 0x14
push edi
lea eax, [ebp - 0x115c]
push eax
mov eax, 0x20006
mov dword [ebp - 0x115c], edi
mov dword [ebp - 0x1158], edi
mov dword [ebp - 0x1154], edi
call fcn.00402490
cmp eax, edi
jne 0x4051aa
mov edi, dword [ebp - 0x115c]
test edi, edi
jne 0x404cea
push str.m_hKey___0
push edi
push 0x164f
push 0x66d778
push 2
call fcn.005f3d20
add esp, 0x14
cmp eax, 1
jne 0x404cea
int3
lea ecx, [ebp - 0x1118]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x404d05
cmp eax, 2
jne 0x4051aa
test edi, edi
je 0x404d1a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x115c], 0
mov dword [ebp - 0x1158], 0
mov ecx, ebx
call fcn.00404340
jmp 0x404b41
mov cl, byte [esi]
mov eax, esi
test cl, cl
je 0x404d54
cmp cl, 0x5c
je 0x404d4c
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x404d38
jmp 0x404d54
test eax, eax
jne 0x405144
cmp dword [ebp + 0x10], 0
je 0x404e1c
mov edi, dword [ebp - 0x112c]
push esi
lea edx, [ebp - 0x1128]
push edx
mov eax, 0x2001f
mov ecx, edi
call fcn.00402490
test eax, eax
je 0x404ddf
push esi
lea eax, [ebp - 0x1128]
push eax
mov eax, 0x20019
mov ecx, edi
call fcn.00402490
test eax, eax
je 0x404ddf
mov ecx, dword [0x6c2424]
push esi
push str.Creating_key__s_n
push 2
push ecx
lea edx, [ebp - 0x11a4]
push edx
mov dword [ebp - 0x11a4], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x11a0], 0x5e9
call fcn.004017b0
add esp, 0x14
push esi
lea eax, [ebp - 0x1128]
push eax
mov eax, edi
call fcn.004023f0
mov edi, eax
test edi, edi
jne 0x4051bd
mov eax, esi
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
cmp byte [esi], 0x3d
jne 0x404b02
push 0
lea ecx, [ebp - 0x1128]
push ecx
mov ecx, esi
mov edx, ebx
call fcn.00403d20
mov edi, eax
test edi, edi
js 0x405161
jmp 0x404b02
cmp dword [ebp + 0x14], 0
jne 0x404eaf
mov ecx, dword [ebp - 0x112c]
push esi
lea edx, [ebp - 0x1128]
push edx
mov eax, 0x20019
call fcn.00402490
mov dword [ebp - 0x1140], eax
test eax, eax
je 0x404ebb
mov edx, dword [0x6c2424]
push esi
push str.Ignoring_Open_key_on__s_:_In_Recovery_mode_n
push 0
push edx
lea eax, [ebp - 0x118c]
mov dword [ebp + 0x14], 1
mov dword [ebp - 0x118c], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1188], 0x60e
push eax
call fcn.004017b0
add esp, 0x14
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x118]
push 0x104
push ecx
call fcn.005f17c0
add esp, 0x10
cmp eax, 0x50
ja case.0x404ea8.4493
movzx edx, byte [eax + 0x405230]
jmp dword [edx*4 + 0x405220]
mov dword [ebp - 0x1140], 2
jmp 0x404e48
mov eax, dword [0x6c2424]
push esi
push str.Opened_Key__s_n
push 1
push eax
lea ecx, [ebp - 0x119c]
mov dword [ebp - 0x119c], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1198], 0x60c
push ecx
jmp 0x404e79
mov eax, esi
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
mov ecx, ebx
call fcn.00404340
mov edi, eax
test edi, edi
js 0x405161
cmp byte [esi], 0x7b
jne 0x404f53
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x404f53
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1128]
push eax
push 0
push ecx
push esi
mov ecx, ebx
call fcn.00404930
mov edi, eax
test edi, edi
jns 0x404f40
cmp dword [ebp + 0x14], 0
je 0x405161
mov eax, esi
mov edi, ebx
call fcn.00403bc0
mov edi, eax
test edi, edi
js 0x405161
mov ebx, dword [ebp - 0x116c]
cmp dword [ebp + 0x14], ebx
je 0x404f8f
mov edx, dword [0x6c2424]
push str.Ending_Recovery_Mode_n
push 0
push edx
lea eax, [ebp - 0x1174]
push eax
mov dword [ebp - 0x1174], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1170], 0x626
call fcn.004017b0
add esp, 0x10
mov eax, dword [ebp - 0x1140]
mov dword [ebp + 0x14], ebx
cmp eax, 2
je 0x404b4b
test eax, eax
je 0x404fbf
test ebx, ebx
jne 0x404b4b
mov edx, eax
push edx
call fcn.00401480
add esp, 4
mov edi, eax
jmp 0x405161
test ebx, ebx
je 0x40503f
mov ecx, dword [ebp - 0x1128]
push ecx
mov ecx, dword [ebp - 0x111c]
call fcn.004042b0
test eax, eax
je 0x40503f
lea ebx, [ebp - 0x118]
call fcn.00404270
test eax, eax
je 0x404b4b
cmp dword [ebp - 0x113c], 0
je 0x404b4b
mov eax, dword [0x6c2424]
mov edx, ebx
push edx
push str.Deleting_non_empty_subkey__s_by_force_n
push 0
push eax
lea ecx, [ebp - 0x1184]
push ecx
mov dword [ebp - 0x1184], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1180], 0x640
call fcn.004017b0
add esp, 0x14
mov edx, ebx
push edx
lea ecx, [ebp - 0x1128]
call fcn.004026d0
jmp 0x404b4b
mov eax, dword [ebp - 0x1128]
mov ecx, dword [ebp - 0x111c]
push eax
call fcn.004042b0
xor ebx, ebx
mov dword [ebp - 0x1140], eax
cmp dword [ebp - 0x1128], ebx
je 0x40507a
mov ecx, dword [ebp - 0x1128]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [ebp - 0x1128], 0
mov dword [ebp - 0x1124], 0
test ebx, ebx
jne 0x4051e7
cmp dword [ebp - 0x113c], ebx
je 0x404b4b
cmp dword [ebp - 0x1140], ebx
jne 0x404b4b
mov eax, dword [0x6c2424]
lea edx, [ebp - 0x118]
push edx
push str.Deleting_Key__s_n
push ebx
push eax
lea ecx, [ebp - 0x1194]
push ecx
mov dword [ebp - 0x1194], str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x1190], 0x64e
call fcn.004017b0
mov edx, dword [ebp - 0x112c]
add esp, 0x14
push edx
lea ecx, [ebp - 0x1150]
mov dword [ebp - 0x1150], ebx
mov dword [ebp - 0x114c], ebx
mov dword [ebp - 0x1148], ebx
call fcn.00402300
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x1150]
call fcn.00402350
mov dword [ebp - 0x1150], ebx
mov dword [ebp - 0x114c], ebx
mov dword [ebp - 0x1148], ebx
cmp eax, ebx
jne 0x405200
lea ecx, [ebp - 0x1150]
call fcn.004022e0
jmp 0x404b4b
lea ecx, [ebp - 0x1138]
call fcn.004022e0
lea ecx, [ebp - 0x1128]
call fcn.004022e0
mov eax, 0x80020009
jmp 0x405174
lea ecx, [ebp - 0x1138]
call fcn.004022e0
mov eax, dword [ebp - 0x1128]
test eax, eax
je 0x405172
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x1168]
call fcn.004022e0
lea ecx, [ebp - 0x1128]
call fcn.004022e0
jmp 0x405172
push eax
call fcn.00401480
add esp, 4
mov edi, eax
lea ecx, [ebp - 0x115c]
jmp 0x40515c
lea ecx, [ebp - 0x1128]
call fcn.004022e0
push edi
call fcn.00401480
add esp, 4
jmp 0x405174
push 0x8007000e
call fcn.00401810
push 0x80070057
call fcn.00401810
lea ecx, [ebp - 0x1128]
call fcn.004022e0
push ebx
call fcn.00401480
add esp, 4
jmp 0x405174
push eax
call fcn.00401480
add esp, 4
mov edi, eax
lea ecx, [ebp - 0x1150]
jmp 0x40515c
push 0x80004005
call fcn.00401810
out 0x4e, al
inc eax
add bl, dl
push ecx
inc eax
add ch, bl
push ecx
inc eax
add byte [esi], dl
push edx
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3