Function at 0x40bc83
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x57ac
call fcn.004115a0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x4151a0], eax
call fcn.00403ce5
test eax, eax
jne 0x40bcad
inc eax
jmp 0x40c123
call fcn.00410ebd
lea eax, [esp + 0x24]
call fcn.00405bc8
xor ebx, ebx
lea eax, [esp + 0x2d0]
mov dword [esp + 0x4c], 0x20
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ebx
call fcn.0040b71e
push dword [ebp + 0x10]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x57b4], eax
call fcn.00405f80
mov esi, dword [esp + 0x57ac]
push str._RunAsSystemAdmin
call fcn.004060f2
test eax, eax
jl 0x40bd8f
push 0x40
lea eax, [esp + 0x80]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x1c], ebx
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0x208
stosd dword es:[edi], eax
lea eax, [esp + 0xc6]
push ebx
push eax
mov dword [esp + 0x84], 0x44
mov word [esp + 0xcc], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0xc4]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x2dc]
push eax
call fcn.0040b968
jmp 0x40c0fa
mov esi, dword [esp + 0x57ac]
push str._savelangfile
call fcn.004060f2
test eax, eax
jl 0x40bdb8
mov dword [0x415a90], 0x415160
call fcn.00406d2b
jmp 0x40c0fa
call fcn.00406bfa
mov esi, dword [esp + 0x57ac]
push str._deleteregkey
call fcn.004060f2
test eax, eax
jl 0x40bde7
push str.SoftwareNirSoftRegScanner
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40c0fa
mov esi, dword [esp + 0x57ac]
push str._clipregedit
call fcn.004060f2
test eax, eax
jl 0x40be1f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.0041046d
jmp 0x40c0fa
mov esi, dword [esp + 0x57ac]
push str._regedit
call fcn.004060f2
mov esi, eax
cmp esi, ebx
jl 0x40beed
lea eax, [esi + 1]
cmp eax, dword [esp + 0x54]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov edi, 0x412535
jge 0x40be6b
lea ecx, [esp + 0x24]
call fcn.00405cb3
mov dword [esp + 0xc], eax
jmp 0x40be6f
mov dword [esp + 0xc], edi
lea eax, [esi + 2]
cmp eax, dword [esp + 0x54]
jge 0x40be87
lea ecx, [esp + 0x24]
call fcn.00405cb3
mov dword [esp + 0x58], eax
jmp 0x40be8b
mov dword [esp + 0x58], edi
lea eax, [esi + 3]
cmp eax, dword [esp + 0x54]
jge 0x40be9f
lea ecx, [esp + 0x24]
call fcn.00405cb3
jmp 0x40bea1
mov eax, edi
push 0x413010
push eax
call sub.msvcrt.dll__mbsicmp
test eax, eax
pop ecx
pop ecx
jne 0x40beba
mov dword [esp + 0x1c], 0x40
push 4
push str.reg:
push dword [esp + 0x14]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x40bed6
add dword [esp + 0xc], 4
push ebx
push dword [esp + 0x5c]
lea edi, [esp + 0x18]
push dword [esp + 0x14]
call fcn.004104bb
jmp 0x40c0fa
mov eax, dword [esp + 0x57ac]
cmp dword [eax + 0x30], 1
jle 0x40bf0e
lea eax, [esp + 0x2d0]
call fcn.0040bb11
test eax, eax
jne 0x40c0fa
call fcn.004059ef
test eax, eax
je 0x40bff9
mov esi, dword [esp + 0x57ac]
push str._RunAsAdmin
call fcn.004060f2
test eax, eax
jl 0x40bfda
push dword [ebp + 0x10]
lea edi, [esp + 0x14]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x1c], ebx
call fcn.00405d62
push ebx
push str._RunAsAdmin
mov eax, edi
or ecx, 0xffffffff
push eax
mov eax, ecx
call fcn.00405e0a
cmp eax, ebx
jl 0x40bfd1
mov ecx, edi
push ecx
mov ebx, eax
call fcn.00405f1c
push 0x104
lea eax, [esp + 0xc5]
push 0
push eax
mov byte [esp + 0xcc], 0
call sub.msvcrt.dll_memset
lea eax, [esp + 0xcc]
add esp, 0xc
push eax
call fcn.00404e63
mov eax, dword [esp + 0x14]
test eax, eax
pop ecx
jne 0x40bfb3
mov eax, 0x412535
push eax
lea eax, [esp + 0xc4]
push eax
call fcn.004059ac
pop ecx
pop ecx
lea esi, [esp + 0x10]
call fcn.00405d3d
jmp 0x40c0fa
lea esi, [esp + 0x10]
call fcn.00405d3d
mov esi, dword [esp + 0x57ac]
push str._RunAsSystem
call fcn.004060f2
test eax, eax
jl 0x40bff9
call fcn.0040a3cc
jmp 0x40c0fa
mov esi, dword [esp + 0x57ac]
push str._usereg
call fcn.004060f2
test eax, eax
jl 0x40c019
mov dword [esp + 0x57b4], 1
lea esi, [esp + 0x2d0]
call fcn.0040b6a1
cmp dword [esp + 0x41c], 3
jne 0x40c033
push 3
jmp 0x40c035
push 5
push dword [esp + 0x3dc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x3d8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x67
push dword [0x4151a0]
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ebx
push ebx
push 0x417
push dword [esp + 0x3e4]
mov dword [esp + 0x400], eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x68]
push eax
call edi
test eax, eax
je 0x40c0fa
mov esi, dword [sym.imp.USER32.dll_IsDialogMessageA]
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x3f4]
push dword [esp + 0x3e0]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x40c0ec
mov eax, dword [0x4157b4]
cmp eax, ebx
je 0x40c0c4
lea ecx, [esp + 0x5c]
push ecx
push eax
call esi
test eax, eax
jne 0x40c0ec
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x3dc]
call esi
test eax, eax
jne 0x40c0ec
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x68]
push eax
call edi
test eax, eax
jne 0x40c092
lea ebx, [esp + 0x2d0]
call fcn.0040b85a
lea esi, [esp + 0x24]
call fcn.00405bea
lea esi, [esp + 0x44]
call fcn.00406221
lea esi, [esp + 0x24]
call fcn.00405bea
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10