Function at 0x40d729
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x52aa31
call fcn.004c9d2c
mov eax, 0x2254
call fcn.004c9d90
push ebx
xor eax, eax
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc29
jmp 0x40dbde
push 0x54162c
push edi
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x5415f8
mov esi, eax
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40d79b
test esi, esi
jne 0x40d827
push edi
mov ecx, ebx
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
cmp dword [ebp + 0x10], 0
je 0x40d827
and dword [ebp - 0x38], 0
and dword [ebp - 0x30], 0
push 0x5c
push edi
call fcn.0040feaf
pop ecx
pop ecx
test eax, eax
jne 0x40dc16
push edi
mov ecx, ebx
call fcn.004078a4
test eax, eax
je 0x40d7f0
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x38]
and dword [ebp - 0x34], 0
push edi
mov dword [ebp - 0x38], eax
call fcn.0040d0f9
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x10], 0
jne 0x40d823
push edi
mov ecx, ebx
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
push edi
mov ecx, ebx
call fcn.0040fbcc
mov esi, eax
test esi, esi
js 0x40dc1b
and dword [ebp - 0x34], 0
jmp 0x40da24
and dword [ebp - 0x34], 0
push 0x541614
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d84c
and dword [ebp + 8], eax
mov ecx, ebx
push edi
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
push 0x5415ec
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d95a
lea eax, [ebp - 0x2260]
mov ecx, ebx
push eax
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
push edi
mov ecx, ebx
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40dc16
cmp dword [ebp + 0x10], 0
je 0x40d8e1
mov eax, dword [ebp + 0xc]
mov ecx, ebx
and dword [ebp - 0x40], 0
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x2260]
push edi
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
call fcn.00406db6
mov esi, eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
test esi, esi
js 0x40dc1b
mov byte [ebp - 4], al
mov dword [ebp - 0x40], eax
jmp 0x40da24
cmp dword [ebp + 0x14], 0
jne 0x40d943
cmp dword [ebp + 8], 0
je 0x40d943
xor esi, esi
lea ecx, [ebp - 0x2c]
push 0x20006
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call fcn.0040c0bd
test eax, eax
jne 0x40dbfc
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x2260]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40d92f
cmp eax, 2
jne 0x40dbec
test ebx, ebx
je 0x40d93d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c], esi
mov ebx, dword [ebp - 0x48]
mov dword [ebp - 0x28], esi
push edi
mov ecx, ebx
call fcn.0040fbcc
mov esi, eax
test esi, esi
js 0x40dc1b
jmp 0x40dbde
push 0x5c
push edi
call fcn.0040feaf
pop ecx
pop ecx
test eax, eax
jne 0x40dc16
cmp dword [ebp + 0x10], eax
je 0x40da67
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push 0x2001f
push edi
push esi
call fcn.0040c0bd
test eax, eax
je 0x40d9f2
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040c0bd
test eax, eax
je 0x40d9f2
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x4c]
push eax
xor edx, edx
lea eax, [ebp + 8]
mov dword [ebp + 8], edx
push eax
push edx
push 0x2001f
push edx
push edx
push edx
push edi
push esi
test ecx, ecx
je 0x40d9c4
call fcn.0040d1e7
jmp 0x40d9ca
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40db33
cmp dword [ebp - 0x1c], eax
je 0x40d9e0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test eax, eax
jne 0x40db33
push edi
mov ecx, ebx
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
push 0x3d
pop eax
cmp word [edi], ax
jne 0x40da24
push edi
push 0
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.00406db6
mov esi, eax
test esi, esi
js 0x40dc1b
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40dbde
push edi
call fcn.004dc7c2
pop ecx
cmp eax, 1
jne 0x40dbde
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x1c]
push edi
call fcn.0040d729
mov esi, eax
test esi, esi
js 0x40dc1b
push edi
mov ecx, ebx
call fcn.0040a2db
jmp 0x40d94b
cmp dword [ebp + 0x14], 0
jne 0x40da80
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.0040c0bd
jmp 0x40da83
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push edi
cmove ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x260]
push 0x104
push eax
mov dword [ebp - 0x20], ecx
call fcn.004dbe2c
push eax
call fcn.0040756b
add esp, 0x14
mov ecx, ebx
push edi
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
push edi
mov ecx, ebx
call fcn.0040fbcc
mov esi, eax
test esi, esi
js 0x40dc1b
push 0x7b
pop eax
cmp word [edi], ax
jne 0x40db19
push edi
call fcn.004dc7c2
pop ecx
cmp eax, 1
jne 0x40db19
push dword [ebp - 0x20]
mov ecx, ebx
push 0
push dword [ebp - 0x1c]
push edi
call fcn.0040d729
mov esi, eax
test esi, esi
jns 0x40db07
cmp dword [ebp - 0x20], 0
je 0x40dc1b
push edi
mov ecx, ebx
call fcn.0040a2db
mov esi, eax
test esi, esi
js 0x40dc1b
mov eax, dword [ebp - 0x10]
cmp eax, 2
je 0x40dbde
test eax, eax
je 0x40db41
cmp dword [ebp + 0x14], 0
jne 0x40dbde
push eax
call fcn.00407682
pop ecx
mov esi, eax
jmp 0x40dc1b
cmp dword [ebp + 0x14], 0
je 0x40db7e
push dword [ebp - 0x1c]
mov ecx, ebx
call fcn.00409a3a
test eax, eax
je 0x40db7e
lea eax, [ebp - 0x260]
mov ecx, ebx
push eax
call fcn.004078a4
test eax, eax
je 0x40dbde
cmp dword [ebp + 8], 0
je 0x40dbde
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040d0f9
jmp 0x40dbde
push dword [ebp - 0x1c]
mov ecx, ebx
call fcn.00409a3a
mov ecx, dword [ebp - 0x1c]
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x40dba5
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x40db33
cmp dword [ebp + 8], ecx
je 0x40dbde
test edx, edx
jne 0x40dbde
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x58]
push eax
call fcn.00408830
and dword [ebp - 0x58], 0
test eax, eax
jne 0x40db33
push 0x7d
pop eax
cmp word [edi], ax
jne 0x40d76b
jmp 0x40dc1b
push eax
call fcn.00407682
mov esi, eax
pop ecx
test ebx, ebx
je 0x40dc1b
push ebx
jmp 0x40dc0e
push eax
call fcn.00407682
cmp dword [ebp - 0x2c], 0
mov esi, eax
pop ecx
je 0x40dc1b
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dc1b
mov esi, 0x80020009
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dc29
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10