Function at 0x40f8b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call fcn.004144bf
push eax
push dword [ebp + 0x14]
call fcn.004144bf
push eax
push dword [ebp + 0x10]
call fcn.00414bb2
push eax
push dword [edi + 0x50]
push 0x20000173
push 2
call fcn.00405721
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00448549
cmp dword [ebp - 0x10], 5
jge 0x40f918
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40f960
push dword [ebp + 0x10]
push str.Resume
push ebx
call fcn.00445b3f
mov esi, eax
test esi, esi
jns 0x40f93d
push str.Failed_to_write_Resume_value.
jmp 0x40fac1
cmp dword [ebp + 0x10], 3
jne 0x40f960
push 1
push str.Installed
push ebx
call fcn.00445b3f
mov esi, eax
test esi, esi
jns 0x40f966
push str.Failed_to_write_Installed_value.
jmp 0x40fac1
cmp dword [ebp + 0x10], 1
je 0x40f970
cmp dword [ebp + 0x14], 0
je 0x40fa07
cmp dword [edi + 8], 0
jne 0x40fa07
push str.burn.runonce
push dword [edi + 0x54]
lea eax, [ebp - 8]
push str.__ls____ls
push eax
call fcn.00402099
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x40f9a3
push str.Failed_to_format_resume_command_line_for_RunOnce.
jmp 0x40fac1
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0xc]
push dword [edi + 0x4c]
call fcn.004450ac
mov esi, eax
test esi, esi
jns 0x40f9c7
push str.Failed_to_create_run_key.
jmp 0x40fac1
push dword [ebp - 8]
push dword [edi + 0x10]
push dword [ebp - 4]
call fcn.00445b99
mov esi, eax
test esi, esi
jns 0x40f9e5
push str.Failed_to_write_run_key_value.
jmp 0x40fac1
push dword [edi + 0x58]
push str.BundleResumeCommandLine
push ebx
call fcn.00445b99
mov esi, eax
test esi, esi
jns 0x40fac9
push str.Failed_to_write_resume_command_line_value.
jmp 0x40fac1
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0xc]
push dword [edi + 0x4c]
call fcn.00445581
mov esi, eax
cmp esi, 0x80070002
je 0x40fa75
cmp esi, 0x80070003
je 0x40fa75
push dword [edi + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [eax - 2]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x40fa77
test ecx, ecx
jg 0x40fa4c
mov esi, ecx
jmp 0x40fa55
movzx esi, cx
or esi, 0x80070000
test esi, esi
js 0x40fa5e
mov esi, 0x80004005
push esi
push 0x4e8
push str.c:_agent_work18_swix_src_burnengine_registration.cpp
call fcn.00403953
push str.Failed_to_delete_run_key_value.
jmp 0x40fac1
xor esi, esi
test ebx, ebx
je 0x40fac9
push str.BundleResumeCommandLine
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [eax - 2]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x40fac9
test ecx, ecx
jg 0x40fa9a
mov esi, ecx
jmp 0x40faa3
movzx esi, cx
or esi, 0x80070000
test esi, esi
js 0x40faac
mov esi, 0x80004005
push esi
push 0x4f2
push str.c:_agent_work18_swix_src_burnengine_registration.cpp
call fcn.00403953
push str.Failed_to_delete_resume_command_line_value.
push esi
call fcn.0044466b
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x40fad7
push dword [ebp - 8]
call fcn.004027da
cmp dword [ebp - 4], 0
je 0x40fae6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10