Function at 0x403b99
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407c3b
mov eax, dword fs:[0]
push eax
mov eax, 0x2224
call fcn.004073e0
mov eax, dword [0x409060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and dword [ebp - 0x2224], 0
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x222c], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [ebp - 0x2230], eax
jmp 0x4040b4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x4012c8
push edi
mov dword [ebp - 0x2228], 1
call esi
mov ebx, eax
neg ebx
push 0x4012ec
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x403c2b
test ebx, ebx
je 0x403cdc
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x404128
cmp dword [ebp + 0x10], 0
je 0x403cdc
and dword [ebp - 0x2220], 0
push 0x5c
push edi
call fcn.00402423
test eax, eax
jne 0x4040cc
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004025b9
test eax, eax
je 0x403c91
mov eax, dword [ebp - 0x222c]
push edi
lea ecx, [ebp - 0x2220]
mov dword [ebp - 0x2220], eax
call fcn.004028f7
and dword [ebp - 0x2220], 0
test ebx, ebx
je 0x403cd1
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x4040de
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040262b
lea ecx, [ebp - 0x2220]
mov esi, eax
call fcn.0040208f
test esi, esi
jl 0x404128
jmp 0x404079
lea ecx, [ebp - 0x2220]
call fcn.0040208f
push 0x4012d8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403d08
mov ecx, dword [ebp - 0x221c]
and dword [ebp - 0x2228], eax
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x404128
push 0x401304
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403e19
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
push eax
call fcn.004024af
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x404128
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
cmp esi, ebx
jl 0x404128
cmp word [edi], 0x3d
jne 0x4040d7
cmp dword [ebp + 0x10], ebx
je 0x403da7
mov eax, dword [ebp - 0x222c]
mov ecx, dword [ebp - 0x221c]
mov dword [ebp - 0x2228], eax
push edi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2228]
push eax
mov byte [ebp - 4], 1
call fcn.0040384a
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x2228], ebx
lea ecx, [ebp - 0x2228]
jl 0x404123
mov byte [ebp - 4], bl
jmp 0x404074
cmp dword [ebp + 0x14], ebx
jne 0x403e04
cmp dword [ebp - 0x2228], ebx
je 0x403e04
push 0x20006
push ebx
push dword [ebp - 0x222c]
lea ecx, [ebp - 0x2220]
mov dword [ebp - 0x2220], ebx
call fcn.00402102
cmp eax, ebx
jne 0x4040e6
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x403df9
cmp eax, 2
jne 0x4040e6
lea ecx, [ebp - 0x2220]
call fcn.0040208f
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040262b
mov esi, eax
cmp esi, ebx
jmp 0x4040be
push 0x5c
push edi
call fcn.00402423
test eax, eax
jne 0x4040d7
cmp dword [ebp + 0x10], eax
je 0x403ec8
mov esi, 0x2001f
push esi
push edi
push dword [ebp - 0x222c]
lea ecx, [ebp - 0x2224]
call fcn.00402102
test eax, eax
je 0x403e8c
push 0x20019
push edi
push dword [ebp - 0x222c]
lea ecx, [ebp - 0x2224]
call fcn.00402102
test eax, eax
je 0x403e8c
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x222c]
lea ecx, [ebp - 0x2224]
call fcn.004020ad
mov esi, eax
cmp esi, ebx
jne 0x4040f4
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x404128
cmp word [edi], 0x3d
jne 0x404079
mov ecx, dword [ebp - 0x221c]
push edi
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.0040384a
mov esi, eax
jmp 0x403cc4
cmp dword [ebp + 0x14], 0
jne 0x403ee9
push 0x20019
push edi
push dword [ebp - 0x222c]
lea ecx, [ebp - 0x2224]
call fcn.00402102
mov ebx, eax
jmp 0x403eec
push 2
pop ebx
test ebx, ebx
je 0x403ef7
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x10
push eax
call fcn.00401e99
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x404128
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0040262b
mov esi, eax
test esi, esi
jl 0x404128
cmp word [edi], 0x7b
jne 0x403f8f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x403f8f
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp - 0x2224]
push edi
call fcn.00403b99
mov esi, eax
test esi, esi
jge 0x403f79
cmp dword [ebp + 0x14], 0
je 0x404128
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x404128
cmp ebx, 2
mov eax, dword [ebp - 0x2230]
mov dword [ebp + 0x14], eax
je 0x4040c0
test ebx, ebx
je 0x403fba
test eax, eax
jne 0x4040c0
push ebx
call fcn.00401fed
mov esi, eax
jmp 0x404128
test eax, eax
je 0x404011
push dword [ebp - 0x2224]
mov ecx, dword [ebp - 0x221c]
call fcn.004025ef
test eax, eax
je 0x404011
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x218]
push eax
call fcn.004025b9
test eax, eax
je 0x4040c0
cmp dword [ebp - 0x2228], 0
je 0x4040c0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2224]
call fcn.004028f7
jmp 0x4040c0
push dword [ebp - 0x2224]
mov ecx, dword [ebp - 0x221c]
call fcn.004025ef
lea ecx, [ebp - 0x2224]
mov dword [ebp - 0x2220], eax
call fcn.0040208f
mov ebx, eax
test ebx, ebx
jne 0x404107
cmp dword [ebp - 0x2228], eax
je 0x4040c0
cmp dword [ebp - 0x2220], eax
jne 0x4040c0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x222c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0x2228], ebx
test eax, eax
jne 0x404115
lea ecx, [ebp - 0x2228]
call fcn.0040208f
cmp dword [ebp + 0x10], 0
je 0x4040c0
cmp word [edi], 0x7b
jne 0x4040c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4040c0
mov ecx, dword [ebp - 0x221c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push edi
call fcn.00403b99
mov esi, eax
test esi, esi
jl 0x404128
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.004024af
mov esi, eax
test esi, esi
jl 0x404128
cmp word [edi], 0x7d
jne 0x403bf8
jmp 0x404128
lea ecx, [ebp - 0x2220]
call fcn.0040208f
mov esi, 0x80020009
jmp 0x404128
lea ecx, [ebp - 0x2220]
jmp 0x404123
push eax
call fcn.00401fed
lea ecx, [ebp - 0x2220]
jmp 0x404121
lea ecx, [ebp - 0x2224]
call fcn.0040208f
push esi
call fcn.00401fed
jmp 0x404135
lea ecx, [ebp - 0x2224]
call fcn.0040208f
push ebx
jmp 0x404100
push eax
call fcn.00401fed
lea ecx, [ebp - 0x2228]
mov esi, eax
call fcn.0040208f
lea ecx, [ebp - 0x2224]
call fcn.0040208f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004073c4
leave
ret 0x10