Function at 0x40da30
Capabilities:
Delete registry value

Disassembly:
sub esp, 0xc
mov eax, 0x41f2bd
mov dword [esp + 8], 0x80004005
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40da43
push ebx
push esi
sub eax, edx
mov esi, eax
push edi
push esi
call fcn.00401db0
mov edi, dword [eax + 0x10]
mov ebx, dword [esp + 0x20]
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x41f2bd
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebx]
add esp, 4
cmp cl, 0x2f
mov dword [esp + 0xc], eax
je 0x40dab8
cmp cl, 0x5c
je 0x40dab8
mov ecx, dword [0x42b61c]
test ecx, ecx
je 0x40dab8
mov edx, dword [ecx + 0x10]
test edx, edx
je 0x40dab8
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40daa0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00404730
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40db1a
mov esi, dword [eax + 8]
test esi, esi
je 0x40db1a
mov ecx, 0x421fa4
lea edi, [ecx + 1]
jmp 0x40dad0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40dad0
sub ecx, edi
cmp esi, ecx
jl 0x40dafd
mov eax, dword [eax + 0x10]
push ecx
sub eax, ecx
add eax, esi
push 0x421fa4
push eax
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
jne 0x40db1a
push 0x422aec
lea ecx, [esp + 0x10]
call fcn.0040d010
test al, al
jne 0x40db1a
push 0x2f
lea ecx, [esp + 0x10]
call fcn.00405be0
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40db20
sub eax, edx
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00404730
push 0x422aec
push 0x421fa4
lea ecx, [esp + 0x14]
call fcn.00401f10
mov eax, 0x422aec
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40db50
mov esi, dword [esp + 0xc]
sub eax, edx
test esi, esi
je 0x40dba5
cmp dword [esi + 8], eax
jl 0x40db9d
mov ecx, dword [esi + 0x10]
push eax
push 0x422aec
push ecx
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
je 0x40db9d
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 8]
push edx
lea ecx, [eax + 1]
push ecx
push eax
call fcn.00412880
mov eax, dword [esi + 8]
add esp, 0xc
dec eax
mov dword [esi + 8], eax
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x10]
jmp 0x40dba9
xor ebx, ebx
xor eax, eax
push ebp
push 0
push 0
inc ebx
push ebx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
lea edx, [ebp + ebp]
push edx
call fcn.004121c0
add esp, 4
test esi, esi
mov edi, eax
je 0x40dbd8
mov eax, dword [esi + 0x10]
jmp 0x40dbda
xor eax, eax
push ebp
push edi
push ebx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x5c
push edi
call fcn.0041322b
add esp, 8
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x20006
push 0
push edi
push 0x80000001
mov word [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop ebp
jne 0x40dc4d
mov ecx, dword [esp + 0x10]
add ebx, 2
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40dc3c
mov edx, dword [esp + 0x10]
push edx
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dc51
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dc51
mov ebx, dword [esp + 0x14]
push edi
call fcn.0041249e
add esp, 4
test esi, esi
je 0x40dc75
mov eax, dword [esi + 4]
test eax, eax
js 0x40dc75
dec eax
test eax, eax
mov dword [esi + 4], eax
jne 0x40dc75
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret