Function at 0x40a387
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ea31
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.0043a500
mov eax, dword [0x463060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2228], esi
mov dword [ebp - 0x2224], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2250], eax
mov eax, ebx
mov dword [ebp - 4], esi
call fcn.0040a271
mov edi, eax
cmp edi, esi
jmp 0x40a8dd
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
push 0x45a30c
push ebx
mov dword [ebp - 0x2234], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x40a428
test esi, esi
je 0x40a4ea
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a94b
cmp dword [ebp + 0x10], 0
je 0x40a4ea
xor edi, edi
push 0x5c
mov eax, ebx
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], edi
call fcn.00409b2a
pop ecx
test eax, eax
jne 0x40a8eb
push ebx
call fcn.0040a0ad
test eax, eax
je 0x40a49d
mov eax, dword [ebp - 0x2220]
push ebx
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], edi
call fcn.0040a10c
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], edi
cmp esi, edi
je 0x40a4df
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a8fd
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.0040a048
lea esi, [ebp - 0x2230]
mov edi, eax
call fcn.0040a226
test edi, edi
jl 0x40a94b
jmp 0x40a897
lea esi, [ebp - 0x2230]
call fcn.0040a226
push 0x45a2f4
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40a517
and dword [ebp - 0x2234], eax
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a94b
push 0x45a2cc
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40a639
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
call fcn.0040a271
mov edi, eax
xor esi, esi
cmp edi, esi
jl 0x40a94b
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
cmp edi, esi
jl 0x40a94b
cmp word [ebx], 0x3d
jne 0x40a8f6
cmp dword [ebp + 0x10], esi
je 0x40a5c2
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x221c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x223c], eax
push ebx
lea eax, [ebp - 0x2218]
push eax
lea edx, [ebp - 0x223c]
mov dword [ebp - 0x2238], esi
call fcn.00409d21
mov edi, eax
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
cmp edi, esi
lea esi, [ebp - 0x223c]
jl 0x40a946
mov byte [ebp - 4], 0
jmp 0x40a892
cmp dword [ebp + 0x14], esi
jne 0x40a627
cmp dword [ebp - 0x2234], esi
je 0x40a627
push 0x20006
push esi
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2244]
mov dword [ebp - 0x2244], esi
mov dword [ebp - 0x2240], esi
call fcn.0040a0d9
cmp eax, esi
jne 0x40a905
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2244]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x40a61a
cmp eax, 2
jne 0x40a905
lea esi, [ebp - 0x2244]
call fcn.0040a226
xor esi, esi
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.0040a048
jmp 0x40a3ec
push 0x5c
mov eax, ebx
call fcn.00409b2a
pop ecx
test eax, eax
jne 0x40a8f6
cmp dword [ebp + 0x10], eax
je 0x40a6e4
mov esi, 0x2001f
push esi
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.0040a0d9
test eax, eax
je 0x40a6a8
push 0x20019
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.0040a0d9
test eax, eax
je 0x40a6a8
push esi
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.00409b51
mov edi, eax
test edi, edi
jne 0x40a912
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a94b
cmp word [ebx], 0x3d
jne 0x40a897
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
lea edx, [ebp - 0x2228]
call fcn.00409d21
mov edi, eax
jmp 0x40a4d2
cmp dword [ebp + 0x14], 0
jne 0x40a705
push 0x20019
push ebx
push dword [ebp - 0x2220]
lea eax, [ebp - 0x2228]
call fcn.0040a0d9
mov esi, eax
jmp 0x40a708
push 2
pop esi
test esi, esi
je 0x40a713
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0042d0f4
push eax
call fcn.00401502
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a94b
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.0040a048
mov edi, eax
test edi, edi
jl 0x40a94b
cmp word [ebx], 0x7b
jne 0x40a7ae
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x40a7ae
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp - 0x2228]
push ebx
call fcn.0040a387
mov edi, eax
test edi, edi
jge 0x40a797
cmp dword [ebp + 0x14], 0
je 0x40a94b
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a94b
mov eax, dword [ebp - 0x2250]
mov dword [ebp + 0x14], eax
cmp esi, 2
je 0x40a8df
test esi, esi
je 0x40a7da
test eax, eax
jne 0x40a8df
mov eax, esi
call fcn.0040a242
mov edi, eax
jmp 0x40a94b
test eax, eax
je 0x40a825
push dword [ebp - 0x2228]
call fcn.0040a1f1
test eax, eax
je 0x40a825
lea eax, [ebp - 0x218]
push eax
call fcn.0040a0ad
test eax, eax
je 0x40a8df
cmp dword [ebp - 0x2234], 0
je 0x40a8df
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2228]
call fcn.0040a10c
jmp 0x40a8df
push dword [ebp - 0x2228]
call fcn.0040a1f1
lea esi, [ebp - 0x2228]
mov dword [ebp - 0x2258], eax
call fcn.0040a226
xor esi, esi
mov dword [ebp - 0x2254], eax
cmp eax, esi
jne 0x40a926
cmp dword [ebp - 0x2234], esi
je 0x40a8df
cmp dword [ebp - 0x2258], esi
jne 0x40a8df
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x224c], esi
mov dword [ebp - 0x2248], esi
cmp eax, esi
jne 0x40a939
lea esi, [ebp - 0x224c]
call fcn.0040a226
cmp dword [ebp + 0x10], 0
je 0x40a8df
cmp word [ebx], 0x7b
jne 0x40a8df
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x40a8df
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2228]
push ebx
call fcn.0040a387
mov edi, eax
test edi, edi
jl 0x40a94b
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.0040a271
mov edi, eax
test edi, edi
jl 0x40a94b
cmp word [ebx], 0x7d
jne 0x40a3f5
jmp 0x40a94b
lea esi, [ebp - 0x2230]
call fcn.0040a226
mov edi, 0x80020009
jmp 0x40a94b
lea esi, [ebp - 0x2230]
jmp 0x40a946
call fcn.0040a242
lea esi, [ebp - 0x2244]
jmp 0x40a944
lea esi, [ebp - 0x2228]
call fcn.0040a226
mov eax, edi
call fcn.0040a242
jmp 0x40a958
lea esi, [ebp - 0x2228]
call fcn.0040a226
mov eax, dword [ebp - 0x2254]
jmp 0x40a91f
call fcn.0040a242
lea esi, [ebp - 0x224c]
mov edi, eax
call fcn.0040a226
lea esi, [ebp - 0x2228]
call fcn.0040a226
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd77
leave
ret 0x10