Function at 0x40bbfd
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2224
call fcn.00411c70
mov eax, dword [0x442084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x2218], 0
push ebx
push esi
mov dword [ebp - 0x2220], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2210], ecx
mov dword [ebp - 0x2224], eax
jmp 0x40c0f4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x401338
push edi
mov dword [ebp - 0x221c], 1
call esi
mov ebx, eax
neg ebx
push 0x40135c
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x40bc73
test ebx, ebx
je 0x40bd24
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c168
cmp dword [ebp + 0x10], 0
je 0x40bd24
and dword [ebp - 0x2214], 0
push 0x5c
push edi
call fcn.004089ca
test eax, eax
jne 0x40c10c
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408b60
test eax, eax
je 0x40bcd9
mov eax, dword [ebp - 0x2220]
push edi
lea ecx, [ebp - 0x2214]
mov dword [ebp - 0x2214], eax
call fcn.004095be
and dword [ebp - 0x2214], 0
test ebx, ebx
je 0x40bd19
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c11e
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408bd2
lea ecx, [ebp - 0x2214]
mov esi, eax
call fcn.00408645
test esi, esi
jl 0x40c168
jmp 0x40c0b9
lea ecx, [ebp - 0x2214]
call fcn.00408645
push 0x401348
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40bd50
mov ecx, dword [ebp - 0x2210]
and dword [ebp - 0x221c], eax
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c168
push 0x401374
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40be59
mov ecx, dword [ebp - 0x2210]
lea eax, [ebp - 0x220c]
push eax
call fcn.00408a56
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x40c168
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
cmp esi, ebx
jl 0x40c168
cmp word [edi], 0x3d
jne 0x40c117
cmp dword [ebp + 0x10], ebx
je 0x40bde7
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x2210]
mov dword [ebp - 0x221c], eax
push edi
lea eax, [ebp - 0x220c]
push eax
lea eax, [ebp - 0x221c]
push eax
call fcn.0040b90b
lea ecx, [ebp - 0x221c]
mov esi, eax
mov dword [ebp - 0x221c], ebx
call fcn.00408645
cmp esi, ebx
jmp 0x40bd0e
cmp dword [ebp + 0x14], ebx
jne 0x40be44
cmp dword [ebp - 0x221c], ebx
je 0x40be44
push 0x20006
push ebx
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2214]
mov dword [ebp - 0x2214], ebx
call fcn.004086b8
cmp eax, ebx
jne 0x40c126
lea eax, [ebp - 0x220c]
push eax
push dword [ebp - 0x2214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x40be39
cmp eax, 2
jne 0x40c126
lea ecx, [ebp - 0x2214]
call fcn.00408645
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408bd2
mov esi, eax
cmp esi, ebx
jmp 0x40c0fe
push 0x5c
push edi
call fcn.004089ca
test eax, eax
jne 0x40c117
cmp dword [ebp + 0x10], eax
je 0x40bf08
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2218]
call fcn.004086b8
test eax, eax
je 0x40becc
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2218]
call fcn.004086b8
test eax, eax
je 0x40becc
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2218]
call fcn.00408663
mov esi, eax
cmp esi, ebx
jne 0x40c134
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c168
cmp word [edi], 0x3d
jne 0x40c0b9
mov ecx, dword [ebp - 0x2210]
push edi
push 0
lea eax, [ebp - 0x2218]
push eax
call fcn.0040b90b
mov esi, eax
jmp 0x40bd0c
cmp dword [ebp + 0x14], 0
jne 0x40bf29
push 0x20019
push edi
push dword [ebp - 0x2220]
lea ecx, [ebp - 0x2218]
call fcn.004086b8
mov ebx, eax
jmp 0x40bf2c
push 2
pop ebx
test ebx, ebx
je 0x40bf37
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x10
push eax
call fcn.0040846f
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c168
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408bd2
mov esi, eax
test esi, esi
jl 0x40c168
cmp word [edi], 0x7b
jne 0x40bfcf
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x40bfcf
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x2210]
push 0
push dword [ebp - 0x2218]
push edi
call fcn.0040bbfd
mov esi, eax
test esi, esi
jge 0x40bfb9
cmp dword [ebp + 0x14], 0
je 0x40c168
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c168
cmp ebx, 2
mov eax, dword [ebp - 0x2224]
mov dword [ebp + 0x14], eax
je 0x40c100
test ebx, ebx
je 0x40bffa
test eax, eax
jne 0x40c100
push ebx
call fcn.00408596
mov esi, eax
jmp 0x40c168
test eax, eax
je 0x40c051
push dword [ebp - 0x2218]
mov ecx, dword [ebp - 0x2210]
call fcn.00408b96
test eax, eax
je 0x40c051
mov ecx, dword [ebp - 0x2210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00408b60
test eax, eax
je 0x40c100
cmp dword [ebp - 0x221c], 0
je 0x40c100
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x2218]
call fcn.004095be
jmp 0x40c100
push dword [ebp - 0x2218]
mov ecx, dword [ebp - 0x2210]
call fcn.00408b96
lea ecx, [ebp - 0x2218]
mov dword [ebp - 0x2214], eax
call fcn.00408645
mov ebx, eax
test ebx, ebx
jne 0x40c147
cmp dword [ebp - 0x221c], eax
je 0x40c100
cmp dword [ebp - 0x2214], eax
jne 0x40c100
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0x221c], ebx
test eax, eax
jne 0x40c155
lea ecx, [ebp - 0x221c]
call fcn.00408645
cmp dword [ebp + 0x10], 0
je 0x40c100
cmp word [edi], 0x7b
jne 0x40c100
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x40c100
mov ecx, dword [ebp - 0x2210]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2218]
push edi
call fcn.0040bbfd
mov esi, eax
test esi, esi
jl 0x40c168
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.00408a56
mov esi, eax
test esi, esi
jl 0x40c168
cmp word [edi], 0x7d
jne 0x40bc40
jmp 0x40c168
lea ecx, [ebp - 0x2214]
call fcn.00408645
mov esi, 0x80020009
jmp 0x40c168
lea ecx, [ebp - 0x2214]
jmp 0x40c163
push eax
call fcn.00408596
lea ecx, [ebp - 0x2214]
jmp 0x40c161
lea ecx, [ebp - 0x2218]
call fcn.00408645
push esi
call fcn.00408596
jmp 0x40c175
lea ecx, [ebp - 0x2218]
call fcn.00408645
push ebx
jmp 0x40c140
push eax
call fcn.00408596
lea ecx, [ebp - 0x221c]
mov esi, eax
call fcn.00408645
lea ecx, [ebp - 0x2218]
call fcn.00408645
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411b9d
leave
ret 0x10