Function at 0x40969a
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1154
call fcn.0040f170
mov eax, dword [0x4163c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x111c], 0
and dword [ebp - 0x1118], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1120], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x113c], eax
push edi
mov eax, ebx
mov dword [ebp - 0x1114], ecx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b4a
cmp byte [ebx], 0x7d
je 0x409b48
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x4027f0
push ebx
mov dword [ebp - 0x1124], 1
call edi
mov esi, eax
neg esi
push 0x402804
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x40972e
xor edi, edi
cmp esi, edi
je 0x4097e7
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x4097e5
push 0x5c
mov eax, ebx
mov dword [ebp - 0x1138], edi
mov dword [ebp - 0x1134], edi
call fcn.00408b75
test eax, eax
jne 0x409c99
push ebx
call fcn.00409324
test eax, eax
je 0x4097a1
mov eax, dword [ebp - 0x1120]
push ebx
lea ecx, [ebp - 0x1138]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], edi
call fcn.0040939f
mov dword [ebp - 0x1138], edi
mov dword [ebp - 0x1134], edi
cmp esi, edi
je 0x4097df
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
mov ecx, dword [ebp - 0x1114]
mov esi, ebx
call fcn.004092c1
mov edi, eax
test edi, edi
jl 0x409b33
and dword [ebp - 0x1134], 0
jmp 0x409c3c
mov dword [ebp - 0x1134], edi
xor edi, edi
push 0x4027f8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409816
and dword [ebp - 0x1124], eax
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
xor edi, edi
push 0x402810
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409942
mov ecx, dword [ebp - 0x1114]
lea eax, [ebp - 0x1110]
call fcn.0040959d
mov edi, eax
xor esi, esi
cmp edi, esi
jl 0x409b33
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
cmp edi, esi
jl 0x409b33
cmp byte [ebx], 0x3d
jne 0x409cb7
cmp dword [ebp + 0x10], esi
je 0x4098b8
mov eax, dword [ebp - 0x1120]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x114c], eax
push ebx
lea eax, [ebp - 0x1110]
push eax
lea edx, [ebp - 0x114c]
mov dword [ebp - 0x1148], esi
call fcn.00408df4
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x114c], esi
mov dword [ebp - 0x1148], esi
jl 0x409d0c
mov dword [ebp - 0x1148], esi
jmp 0x409c3c
cmp dword [ebp + 0x14], esi
jne 0x409930
cmp dword [ebp - 0x1124], esi
je 0x409930
push esi
push dword [ebp - 0x1120]
mov eax, 0x20006
lea ecx, [ebp - 0x1130]
mov dword [ebp - 0x1130], esi
mov dword [ebp - 0x112c], esi
call fcn.0040935a
cmp eax, esi
jne 0x409cbf
lea eax, [ebp - 0x1110]
push eax
push dword [ebp - 0x1130]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
je 0x409910
cmp eax, 2
jne 0x409cbf
cmp dword [ebp - 0x1130], esi
je 0x40992a
push dword [ebp - 0x1130]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1130], esi
mov dword [ebp - 0x112c], esi
mov ecx, dword [ebp - 0x1114]
mov esi, ebx
call fcn.004092c1
jmp 0x409c81
push 0x5c
mov eax, ebx
call fcn.00408b75
test eax, eax
jne 0x409c99
cmp dword [ebp + 0x10], edi
je 0x409a33
push ebx
push dword [ebp - 0x1120]
mov esi, 0x2001f
mov eax, esi
lea ecx, [ebp - 0x111c]
call fcn.0040935a
test eax, eax
je 0x4099f0
push ebx
push dword [ebp - 0x1120]
lea eax, [esi - 6]
lea ecx, [ebp - 0x111c]
call fcn.0040935a
test eax, eax
je 0x4099f0
lea eax, [ebp - 0x1150]
push eax
lea eax, [ebp - 0x1124]
push eax
push edi
push esi
push edi
push edi
push edi
push ebx
push dword [ebp - 0x1120]
mov dword [ebp - 0x1124], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x409ce3
xor eax, eax
cmp dword [ebp - 0x111c], edi
je 0x4099d6
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1124]
mov dword [ebp - 0x111c], ecx
mov dword [ebp - 0x1118], edi
cmp eax, edi
jne 0x409ce3
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
cmp byte [ebx], 0x3d
jne 0x409c3c
mov ecx, dword [ebp - 0x1114]
push ebx
push 0
lea edx, [ebp - 0x111c]
call fcn.00408df4
mov edi, eax
test edi, edi
jl 0x409b33
jmp 0x409c3c
cmp dword [ebp + 0x14], edi
jne 0x409a57
push ebx
push dword [ebp - 0x1120]
mov eax, 0x20019
lea ecx, [ebp - 0x111c]
call fcn.0040935a
mov dword [ebp - 0x1128], eax
jmp 0x409a61
mov dword [ebp - 0x1128], 2
cmp dword [ebp - 0x1128], edi
je 0x409a70
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040bbeb
add esp, 0x10
push eax
call fcn.00409280
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
mov ecx, dword [ebp - 0x1114]
mov esi, ebx
call fcn.004092c1
mov edi, eax
test edi, edi
jl 0x409b33
cmp byte [ebx], 0x7b
jne 0x409afe
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x409afe
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1114]
push 0
push dword [ebp - 0x111c]
push ebx
call fcn.0040969a
mov edi, eax
test edi, edi
jge 0x409aeb
cmp dword [ebp + 0x14], 0
je 0x409b33
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
cmp dword [ebp - 0x1128], 2
mov eax, dword [ebp - 0x113c]
mov dword [ebp + 0x14], eax
je 0x409c8b
mov eax, dword [ebp - 0x1128]
xor esi, esi
cmp eax, esi
je 0x409b5b
cmp dword [ebp - 0x113c], esi
jne 0x409c8b
call fcn.00409589
mov edi, eax
cmp dword [ebp - 0x111c], 0
je 0x409b48
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bb7c
leave
ret 0x10
cmp dword [ebp - 0x113c], esi
je 0x409ba9
push dword [ebp - 0x111c]
call fcn.004094d1
test eax, eax
je 0x409ba9
lea eax, [ebp - 0x110]
push eax
call fcn.00409324
test eax, eax
je 0x409c8b
cmp dword [ebp - 0x1124], esi
je 0x409c8b
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x111c]
call fcn.0040939f
jmp 0x409c8b
push dword [ebp - 0x111c]
call fcn.004094d1
mov dword [ebp - 0x1128], eax
xor eax, eax
cmp dword [ebp - 0x111c], esi
je 0x409bd6
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x111c], esi
mov dword [ebp - 0x1118], esi
cmp eax, esi
jne 0x409d05
cmp dword [ebp - 0x1124], esi
je 0x409c8b
cmp dword [ebp - 0x1128], esi
jne 0x409c8b
mov eax, dword [ebp - 0x1120]
and dword [ebp - 0x1140], esi
mov dword [ebp - 0x1144], eax
lea eax, [ebp - 0x110]
push eax
lea esi, [ebp - 0x1144]
call fcn.00409529
and dword [ebp - 0x1144], 0
and dword [ebp - 0x1140], 0
test eax, eax
jne 0x409b2c
and dword [ebp - 0x1140], eax
cmp dword [ebp + 0x10], 0
je 0x409c8b
cmp byte [ebx], 0x7b
jne 0x409c8b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x409c8b
mov ecx, dword [ebp - 0x1114]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x111c]
push ebx
call fcn.0040969a
mov edi, eax
test edi, edi
jl 0x409b33
mov ecx, dword [ebp - 0x1114]
mov eax, ebx
call fcn.0040959d
mov edi, eax
test edi, edi
jl 0x409b33
cmp byte [ebx], 0x7d
jne 0x4096f9
jmp 0x409b33
cmp dword [ebp - 0x111c], edi
je 0x409cad
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x409b4a
cmp dword [ebp - 0x111c], esi
jmp 0x409c9f
call fcn.00409589
mov edi, eax
cmp dword [ebp - 0x1130], esi
je 0x409b33
push dword [ebp - 0x1130]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409b33
call fcn.00409589
mov esi, eax
cmp dword [ebp - 0x111c], edi
je 0x409cfe
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x409b4a
call fcn.00409589
mov edi, eax
cmp dword [ebp - 0x111c], esi
jmp 0x409b3a