Function at 0x40bef0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4789f6
mov eax, dword fs:[0]
push eax
mov eax, 0x2294
call fcn.0043e400
mov eax, dword [0x4ad3bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x221c], ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
mov dword [ebp - 0x2224], 0
mov eax, dword [ebp + 0x14]
push 0xc
push str.Num_Els___d_n
push 2
mov dword [ebp - 0x2250], eax
lea eax, [ebp - 0x2240]
push 8
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2240], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x223c], 0x58b
call fcn.004043d0
add esp, 0x14
mov ecx, ebx
push edi
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c7a2
cmp word [edi], 0x7d
je 0x40c78f
nop
push str.Delete
push edi
mov dword [ebp - 0x223c], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40bfe3
test ebx, ebx
je 0x40c0ff
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
cmp dword [ebp + 0x10], 0
je 0x40c0ff
movzx eax, word [edi]
mov ecx, edi
mov dword [ebp - 0x2238], 0
mov dword [ebp - 0x2234], 0
mov dword [ebp - 0x2230], 0
test ax, ax
je 0x40c051
nop dword [eax + eax]
cmp ax, 0x5c
je 0x40c049
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
jne 0x40c030
jmp 0x40c051
test ecx, ecx
jne 0x40c728
mov esi, 0x481344
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40c0b8
add esi, 4
cmp esi, 0x481374
jl 0x40c056
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2238]
push edi
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], 0
mov dword [ebp - 0x2230], 0
call fcn.0040b750
mov dword [ebp - 0x2238], 0
mov dword [ebp - 0x2234], 0
mov dword [ebp - 0x2230], 0
test ebx, ebx
je 0x40c0f5
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c73a
push edi
mov ecx, ebx
call fcn.0040ca70
mov esi, eax
test esi, esi
js 0x40c73a
mov dword [ebp - 0x2234], 0
jmp 0x40c3e1
mov dword [ebp - 0x2234], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x221c]
test eax, eax
jne 0x40c12d
push edi
mov ecx, ebx
mov dword [ebp - 0x223c], eax
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
push 0x47eb84
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40c2f8
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
push edi
mov ecx, ebx
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
cmp word [edi], 0x3d
jne 0x40c733
cmp dword [ebp + 0x10], 0
je 0x40c1f0
mov eax, dword [ebp - 0x2220]
mov ecx, ebx
mov dword [ebp - 0x225c], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x225c]
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
call fcn.0040a2e0
mov esi, eax
mov dword [ebp - 0x225c], 0
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
test esi, esi
js 0x40c747
mov byte [ebp - 4], 0
mov dword [ebp - 0x2258], 0
jmp 0x40c3e1
cmp dword [ebp + 0x14], 0
jne 0x40c2e1
cmp dword [ebp - 0x223c], 0
je 0x40c2e1
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2270], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
push eax
push str.Deleting__Ts_n
push 1
lea eax, [ebp - 0x2270]
mov dword [ebp - 0x226c], 0x5d6
push 8
push eax
call fcn.004043d0
add esp, 0x14
mov dword [ebp - 0x2268], 0
lea ecx, [ebp - 0x2268]
mov dword [ebp - 0x2264], 0
mov dword [ebp - 0x2260], 0
push 0x20006
push 0
push dword [ebp - 0x2220]
call fcn.0040b340
test eax, eax
jne 0x40c754
mov esi, dword [ebp - 0x2268]
test esi, esi
jne 0x40c2a7
push str.m_hKey___0
push 0x47f6ac
push esi
push 0x16a2
push 0x47f790
push 2
call fcn.00448410
add esp, 0x18
cmp eax, 1
jne 0x40c2a7
int3
lea eax, [ebp - 0x2218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40c2c2
cmp eax, 2
jne 0x40c754
test esi, esi
je 0x40c2d7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2268], 0
mov dword [ebp - 0x2264], 0
push edi
mov ecx, ebx
call fcn.0040ca70
mov esi, eax
test esi, esi
js 0x40c78f
jmp 0x40c71c
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x40c323
cmp ax, 0x5c
je 0x40c31b
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
jne 0x40c302
jmp 0x40c323
test ecx, ecx
jne 0x40c733
cmp dword [ebp + 0x10], 0
je 0x40c43c
mov esi, dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
push 0x2001f
push edi
push esi
call fcn.0040b340
test eax, eax
je 0x40c3ae
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.0040b340
test eax, eax
je 0x40c3ae
push edi
push str.Creating_key__Ts_n
push 2
lea eax, [ebp - 0x2278]
mov dword [ebp - 0x2278], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
push 8
push eax
mov dword [ebp - 0x2274], 0x5fd
call fcn.004043d0
add esp, 0x14
lea ecx, [ebp - 0x222c]
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push esi
call fcn.0040ae30
test eax, eax
jne 0x40c784
push edi
mov ecx, ebx
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
cmp word [edi], 0x3d
jne 0x40c3e1
push edi
push 0
lea eax, [ebp - 0x222c]
mov ecx, ebx
push eax
call fcn.0040a2e0
mov esi, eax
test esi, esi
js 0x40c78f
cmp word [edi], 0x7b
jne 0x40c71c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c3f0
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40c71c
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x222c]
push edi
call fcn.0040bef0
mov esi, eax
test esi, esi
js 0x40c78f
push edi
mov ecx, ebx
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
jmp 0x40c71c
cmp dword [ebp + 0x14], 0
jne 0x40c483
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x222c]
call fcn.0040b340
mov ebx, eax
test ebx, ebx
jne 0x40c488
push edi
push str.Opened_Key__Ts_n
mov dword [ebp - 0x2280], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
lea eax, [ebp - 0x2280]
mov dword [ebp - 0x227c], 0x620
push 1
jmp 0x40c4b1
mov ebx, 2
push edi
push str.Ignoring_Open_key_on__Ts_:_In_Recovery_mode_n
mov dword [ebp + 0x14], 1
lea eax, [ebp - 0x2288]
mov dword [ebp - 0x2288], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
mov dword [ebp - 0x2284], 0x622
push 0
push 8
push eax
call fcn.004043d0
add esp, 0x14
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push edi
push 0x104
push eax
call fcn.00453520
push eax
call fcn.0040aa70
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
push edi
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040ca70
mov esi, eax
test esi, esi
js 0x40c78f
cmp word [edi], 0x7b
jne 0x40c561
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c510
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40c561
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp - 0x222c]
push edi
call fcn.0040bef0
mov esi, eax
test esi, esi
jns 0x40c54b
cmp dword [ebp + 0x14], 0
je 0x40c78f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040b1a0
mov esi, eax
test esi, esi
js 0x40c78f
mov eax, dword [ebp - 0x2250]
cmp dword [ebp + 0x14], eax
je 0x40c59e
push str.Ending_Recovery_Mode_n
push 0
lea eax, [ebp - 0x2290]
mov dword [ebp - 0x2290], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
push 8
push eax
mov dword [ebp - 0x228c], 0x63a
call fcn.004043d0
mov eax, dword [ebp - 0x2250]
add esp, 0x10
mov dword [ebp + 0x14], eax
cmp ebx, 2
je 0x40c71c
test ebx, ebx
je 0x40c5bc
test eax, eax
jne 0x40c71c
push ebx
jmp 0x40c785
mov ebx, dword [ebp - 0x221c]
test eax, eax
je 0x40c644
push dword [ebp - 0x222c]
mov ecx, ebx
call fcn.0040b060
test eax, eax
je 0x40c644
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.0040abd0
test eax, eax
je 0x40c71c
cmp dword [ebp - 0x223c], 0
je 0x40c71c
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2298], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
push eax
push str.Deleting_non_empty_subkey__Ts_by_force_n
push 0
lea eax, [ebp - 0x2298]
mov dword [ebp - 0x2294], 0x654
push 8
push eax
call fcn.004043d0
add esp, 0x14
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x222c]
push eax
call fcn.0040b750
jmp 0x40c71c
push dword [ebp - 0x222c]
mov ecx, ebx
call fcn.0040b060
mov ecx, dword [ebp - 0x222c]
mov ebx, eax
xor eax, eax
test ecx, ecx
je 0x40c66e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 0x2228], 0
test eax, eax
jne 0x40c784
cmp dword [ebp - 0x223c], eax
je 0x40c71c
test ebx, ebx
jne 0x40c71c
lea eax, [ebp - 0x218]
mov dword [ebp - 0x22a0], str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_statreg.h
push eax
push str.Deleting_Key__Ts_n
push ebx
lea eax, [ebp - 0x22a0]
mov dword [ebp - 0x229c], 0x662
push 8
push eax
call fcn.004043d0
add esp, 0x14
mov dword [ebp - 0x224c], ebx
lea ecx, [ebp - 0x224c]
mov dword [ebp - 0x2248], ebx
mov dword [ebp - 0x2244], ebx
push dword [ebp - 0x2220]
call fcn.0040ab80
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224c]
call fcn.0040aee0
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
mov dword [ebp - 0x2244], ebx
test eax, eax
jne 0x40c76c
lea ecx, [ebp - 0x224c]
call fcn.00409dd0
cmp word [edi], 0x7d
jne 0x40bfb0
jmp 0x40c78f
lea ecx, [ebp - 0x2238]
call fcn.00409dd0
mov esi, 0x80020009
jmp 0x40c78f
lea ecx, [ebp - 0x2238]
call fcn.00409dd0
jmp 0x40c78f
lea ecx, [ebp - 0x225c]
call fcn.00409dd0
jmp 0x40c78f
push eax
call fcn.0043b190
add esp, 4
lea ecx, [ebp - 0x2268]
mov esi, eax
call fcn.00409dd0
jmp 0x40c78f
push eax
call fcn.0043b190
add esp, 4
lea ecx, [ebp - 0x224c]
mov esi, eax
call fcn.00409dd0
jmp 0x40c78f
push eax
call fcn.0043b190
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x222c]
test eax, eax
je 0x40c7a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e140
mov esp, ebp
pop ebp
ret 0x10