Function at 0x402540
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x428
mov eax, dword [esp + 0x438]
push ebp
push esi
push edi
mov edi, dword [esp + 0x438]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], eax
call fcn.00402050
mov esi, eax
cmp esi, ebp
jge 0x402588
lea ecx, [esp + 0x10]
call fcn.00402bb0
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x428
ret 0x10
cmp word [edi], 0x7d
push ebx
je 0x402b78
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x406284
push edi
mov dword [esp + 0x18], 1
call esi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x4025c4
cmp ebx, ebp
je 0x4026f5
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
cmp dword [esp + 0x444], ebp
je 0x4026f5
xor ecx, ecx
mov dword [esp + 0x18], ebp
mov cx, word [edi]
cmp cx, bp
mov eax, edi
je 0x40261b
mov esi, dword [sym.imp.USER32.dll_CharNextW]
jmp 0x402600
cmp cx, 0x5c
je 0x402613
push eax
call esi
mov cx, word [eax]
cmp cx, bp
jne 0x402600
jmp 0x40261b
cmp eax, ebp
jne 0x402af0
mov esi, 0x406158
mov ecx, dword [esi]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402656
add esi, 4
cmp esi, 0x406188
jl 0x402620
mov edx, dword [esp + 0x440]
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edx
call fcn.00402cb0
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x40265a
mov eax, dword [esp + 0x18]
cmp ebx, ebp
je 0x4026ea
mov ebx, dword [esp + 0x1c]
push edi
mov ecx, ebx
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b14
push edi
mov ecx, ebx
call fcn.00402c20
mov esi, eax
lea ecx, [esp + 0x18]
call fcn.00402bb0
cmp esi, ebp
jl 0x402b78
cmp word [edi], 0x7b
jne 0x4026db
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4026db
mov eax, dword [esp + 0x444]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push ebp
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00402540
mov esi, eax
cmp esi, ebp
jl 0x402b78
push edi
mov ecx, ebx
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
cmp word [edi], 0x7d
jne 0x402593
jmp 0x402b78
cmp eax, ebp
je 0x4026f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40271d
mov ecx, dword [esp + 0x1c]
push edi
mov dword [esp + 0x14], ebp
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
push 0x4062c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40282c
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x230]
push eax
mov ecx, ebx
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
push edi
mov ecx, ebx
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
cmp word [edi], 0x3d
jne 0x402b1a
cmp dword [esp + 0x444], ebp
je 0x4027a2
mov ecx, dword [esp + 0x440]
push edi
lea edx, [esp + 0x234]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push eax
mov ecx, ebx
call fcn.00402dd0
mov esi, eax
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x10]
jmp 0x402686
cmp dword [esp + 0x448], ebp
jne 0x40281f
cmp dword [esp + 0x10], ebp
je 0x40281f
mov edx, dword [esp + 0x440]
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebp
push ebp
push edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x402b3b
lea ecx, [esp + 0x18]
call fcn.00402bb0
cmp eax, ebp
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
jne 0x402b3b
lea eax, [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebp
je 0x402810
cmp eax, 2
jne 0x402b3b
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x40281f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov ecx, ebx
call fcn.00402c20
jmp 0x4026d1
xor ecx, ecx
mov cx, word [edi]
cmp cx, bp
mov eax, edi
je 0x40285b
mov esi, dword [sym.imp.USER32.dll_CharNextW]
mov edi, edi
cmp cx, 0x5c
je 0x402853
push eax
call esi
mov cx, word [eax]
cmp cx, bp
jne 0x402840
jmp 0x40285b
cmp eax, ebp
jne 0x402af9
cmp dword [esp + 0x444], ebp
je 0x402942
mov esi, dword [esp + 0x440]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push ebp
push edi
push esi
mov dword [esp + 0x24], ebp
call ebx
cmp eax, ebp
jne 0x4028a1
lea ecx, [esp + 0x14]
call fcn.00402bb0
cmp eax, ebp
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
je 0x40290d
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebp
push edi
push esi
mov dword [esp + 0x24], ebp
call ebx
cmp eax, ebp
jne 0x4028cd
lea ecx, [esp + 0x14]
call fcn.00402bb0
cmp eax, ebp
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x40290d
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push edi
push esi
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x402b57
lea ecx, [esp + 0x14]
call fcn.00402bb0
cmp eax, ebp
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
jne 0x402b57
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
cmp word [edi], 0x3d
jne 0x402693
mov ecx, dword [esp + 0x1c]
push edi
push ebp
lea edx, [esp + 0x1c]
push edx
call fcn.00402dd0
mov esi, eax
jmp 0x40268b
cmp dword [esp + 0x448], ebp
jne 0x402a41
mov ecx, dword [esp + 0x440]
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebp
push edi
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x402982
lea ecx, [esp + 0x14]
call fcn.00402bb0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], edx
cmp eax, ebp
mov ebx, eax
je 0x402993
mov dword [esp + 0x448], 1
push 0x104
push edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00402c20
mov esi, eax
cmp esi, ebp
jl 0x402b78
cmp word [edi], 0x7b
jne 0x402a11
mov ecx, dword [esp + 0x448]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.00402540
mov esi, eax
cmp esi, ebp
jge 0x4029fd
cmp dword [esp + 0x448], ebp
je 0x402b78
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00402050
mov esi, eax
cmp esi, ebp
jl 0x402b78
cmp ebx, 2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x448], eax
je 0x4026db
cmp ebx, ebp
je 0x402a4b
cmp eax, ebp
jne 0x4026db
push ebx
call fcn.00402b90
add esp, 4
mov esi, eax
jmp 0x402b78
mov ebx, 2
jmp 0x402988
cmp eax, ebp
je 0x402aa4
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00402bd0
test eax, eax
je 0x402aa4
mov ebx, 0x406158
mov edx, dword [ebx]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4026db
add ebx, 4
cmp ebx, 0x406188
jl 0x402a66
cmp dword [esp + 0x10], ebp
je 0x4026db
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
call fcn.00402cb0
jmp 0x4026db
lea ecx, [esp + 0x14]
call fcn.00402bb0
cmp eax, ebp
jne 0x402b57
cmp dword [esp + 0x10], ebp
je 0x4026db
mov eax, dword [esp + 0x440]
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebp
mov dword [esp + 0x10], ebp
jne 0x402b64
lea ecx, [esp + 0x10]
call fcn.00402bb0
jmp 0x4026db
lea ecx, [esp + 0x18]
call fcn.00402bb0
lea ecx, [esp + 0x14]
call fcn.00402bb0
pop ebx
pop edi
pop esi
mov eax, 0x80020009
pop ebp
add esp, 0x428
ret 0x10
lea ecx, [esp + 0x18]
jmp 0x402b73
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x402b29
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
mov eax, 0x80020009
pop ebp
add esp, 0x428
ret 0x10
push eax
call fcn.00402b90
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, ebp
je 0x402b78
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402b78
push eax
call fcn.00402b90
add esp, 4
mov esi, eax
jmp 0x402b78
push eax
call fcn.00402b90
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.00402bb0
lea ecx, [esp + 0x14]
call fcn.00402bb0
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x428
ret 0x10