Function at 0x40f2d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edx
push edi
lea eax, [ecx + esi]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x40f731
ja 0x40f731
cmp byte [eax - 1], 0
jne 0x40f731
push 0x2000
call fcn.0041957c
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
je 0x40f731
xor ebx, ebx
lea eax, [edi + 0x1000]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x40f71f
nop word [eax + eax]
mov cl, byte [esi]
test cl, cl
je 0x40f71f
mov al, cl
nop dword [eax]
cmp al, 0xd
je 0x40f352
cmp al, 0xa
je 0x40f352
cmp al, 0x20
je 0x40f352
mov cl, al
cmp al, 9
jne 0x40f35c
mov cl, byte [esi + 1]
inc esi
mov al, cl
test cl, cl
jne 0x40f340
test cl, cl
je 0x40f71f
cmp cl, 0x5b
jne 0x40f71f
inc esi
cmp dword [esi], 0x4d4c4b48
je 0x40f3fb
push 0x12
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.0041c1e2
add esp, 0xc
test eax, eax
je 0x40f3fb
cmp dword [esi], 0x52434b48
je 0x40f3f4
push 0x11
push str.HKEY_CLASSES_ROOT
push esi
call fcn.0041c1e2
add esp, 0xc
test eax, eax
je 0x40f3f4
cmp dword [esi], 0x55434b48
je 0x40f3ed
push 0x11
push str.HKEY_CURRENT_USER
push esi
call fcn.0041c1e2
add esp, 0xc
test eax, eax
je 0x40f3ed
cmp dword [esi], 0x52535548
je 0x40f3e6
push 0xa
push str.HKEY_USERS
push esi
call fcn.0041c1e2
add esp, 0xc
test eax, eax
jne 0x40f71f
mov ebx, 0x80000003
jmp 0x40f400
mov ebx, reloc.K7UI.dll_Ordinal_1
jmp 0x40f400
mov ebx, Ordinal_1
jmp 0x40f400
mov ebx, 0x80000002
push 0x5c
push esi
call fcn.00416a00
mov esi, eax
add esp, 8
test esi, esi
je 0x40f71c
inc esi
push 0x5d
push esi
call fcn.00416a00
mov edi, eax
add esp, 8
test edi, edi
je 0x40f719
inc edi
mov eax, edi
sub eax, esi
cmp eax, 0x1000
jg 0x40f719
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movzx eax, word [edi]
mov ecx, 0xd0a
cmp ax, cx
je 0x40f470
mov ecx, 0xa0d
cmp ax, cx
je 0x40f470
cmp al, 0xd
je 0x40f469
cmp al, 0xa
jne 0x40f719
mov eax, 1
jmp 0x40f475
mov eax, 2
push 0
lea esi, [eax + edi]
mov edi, dword [ebp - 8]
push edi
push ebx
call fcn.00413e80
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xc], 0
je 0x40f71c
mov ebx, 1
mov ecx, 0xa0d
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x40f5a4
movzx eax, word [esi]
cmp ax, cx
je 0x40f5a4
mov ecx, 0x3d40
cmp ax, cx
jne 0x40f4d1
push 0x437dab
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40f513
cmp al, 0x22
jne 0x40f59f
inc esi
push 0x438128
push esi
mov edi, esi
call fcn.00416370
mov esi, eax
add esp, 8
test esi, esi
je 0x40f5a4
mov ecx, esi
sub ecx, edi
lea edx, [ecx + 1]
cmp ecx, 0x1000
jge 0x40f59f
push edx
push edi
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, 2
mov ebx, esi
cmp byte [esi], 0x22
jne 0x40f561
lea edi, [esi + 1]
push 0x22
push edi
call fcn.00416a00
mov esi, eax
add esp, 8
test esi, esi
je 0x40f59f
sub eax, edi
lea ecx, [eax + 1]
cmp eax, 0x1000
jge 0x40f59f
mov ebx, dword [ebp - 0x10]
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call fcn.00414270
cmp eax, 1
jne 0x40f59f
inc esi
jmp 0x40f6ba
push 6
push str.dword:
push esi
call fcn.0041c1e2
add esp, 0xc
test eax, eax
jne 0x40f5cb
lea eax, [ebp - 0x18]
add esi, 6
push eax
push 0x437ec0
push esi
call fcn.00402280
add esp, 0xc
push dword [ebp - 0x18]
push edi
push dword [ebp - 0xc]
call fcn.00414240
cmp eax, 1
je 0x40f6ba
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
cmp esi, dword [ebp - 0x14]
jb 0x40f330
push edi
call fcn.004194d4
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 8
push str.MultString
push esi
call fcn.0041c1e2
add esp, 0xc
test eax, eax
je 0x40f6ba
push 4
push str.hex_
push ebx
mov esi, ebx
call fcn.0041c1e2
add esp, 0xc
test eax, eax
je 0x40f6ba
push 4
push str.hex:
push ebx
call fcn.0041c1e2
add esp, 0xc
test eax, eax
jne 0x40f69a
push 0xd
push ebx
lea edi, [ebx + 4]
call fcn.00416a00
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40f70b
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x2ee0
jge 0x40f70b
xor esi, esi
cmp edi, eax
jae 0x40f677
cmp esi, 0x1000
ja 0x40f672
lea eax, [ebp - 0x1c]
push eax
push str._02X
push edi
call fcn.00402280
mov ecx, dword [ebp - 0x10]
add edi, 3
mov al, byte [ebp - 0x1c]
add esp, 0xc
mov byte [esi + ecx], al
inc esi
cmp edi, dword [ebp - 0x20]
jb 0x40f644
jmp 0x40f677
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [ebp - 8]
push esi
push dword [ebp - 0x10]
push edi
push dword [ebp - 0xc]
call fcn.00414210
mov esi, ebx
cmp eax, 1
je 0x40f6ba
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], eax
jmp 0x40f5a4
push 4
push str.dele
push ebx
call fcn.0041c1e2
add esp, 0xc
test eax, eax
jne 0x40f70b
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ebx
push 0xd
push esi
call fcn.00416a00
add esp, 8
test eax, eax
jne 0x40f6dc
push 0xa
push esi
call fcn.00416a00
add esp, 8
test eax, eax
je 0x40f59f
mov cl, byte [eax + 1]
inc eax
cmp cl, 0xd
je 0x40f6ea
cmp cl, 0xa
jne 0x40f6eb
inc eax
mov ebx, dword [ebp - 4]
mov ecx, 0xa0d
mov esi, eax
cmp word [eax], cx
je 0x40f5a4
test ebx, ebx
jne 0x40f4a4
jmp 0x40f5a4
xor eax, eax
mov esi, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
jmp 0x40f5a4
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
push edi
call fcn.004194d4
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret