Function at 0x40c174
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x445713
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1164
call fcn.0042a390
mov eax, dword [0x45a400]
xor eax, esp
mov dword [esp + 0x1160], eax
push ebx
push esi
push edi
mov eax, dword [0x45a400]
xor eax, esp
push eax
lea eax, [esp + 0x1178]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1180], edi
mov dword [esp + 0x3c], eax
mov eax, ebx
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
jmp 0x40c426
push str.Delete
push ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb esi, esi
push str.ForceRemove
inc esi
push ebx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40c22e
cmp esi, edi
je 0x40c2e1
mov ecx, dword [esp + 0x14]
mov eax, ebx
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
cmp dword [ebp + 0x10], edi
je 0x40c2e1
push 0x5c
mov eax, ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.0040b712
pop ecx
test eax, eax
jne 0x40c6bb
push ebx
call fcn.0040be6b
test eax, eax
je 0x40c29a
mov eax, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.0040be9a
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
cmp dword [esp + 0x1c], edi
je 0x40c2d8
mov ecx, dword [esp + 0x14]
mov eax, ebx
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c6cb
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.0040be0f
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00403d93
test esi, esi
js 0x40c70b
jmp 0x40c676
lea ecx, [esp + 0x30]
call fcn.00403d93
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40c30a
mov ecx, dword [esp + 0x14]
mov eax, ebx
mov dword [esp + 0x2c], edi
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
push 0x44b728
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40c434
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x16c]
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
mov ecx, dword [esp + 0x14]
mov eax, ebx
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
cmp byte [ebx], 0x3d
jne 0x40c6c4
cmp dword [ebp + 0x10], edi
je 0x40c3b5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x1180], 1
mov dword [esp + 0x40], eax
push ebx
lea eax, [esp + 0x170]
push eax
lea edx, [esp + 0x48]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
call fcn.0040b919
mov esi, eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
lea ecx, [esp + 0x40]
cmp esi, edi
jl 0x40c706
mov byte [esp + 0x1180], 0
call fcn.00403d93
jmp 0x40c678
cmp dword [ebp + 0x14], edi
jne 0x40c40f
cmp dword [esp + 0x2c], edi
je 0x40c40f
push 0x20006
push edi
push dword [esp + 0x20]
lea ecx, [esp + 0x64]
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
call fcn.00403d44
cmp eax, edi
jne 0x40c6d1
lea eax, [esp + 0x16c]
push eax
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, edi
je 0x40c406
cmp eax, 2
jne 0x40c6d1
lea ecx, [esp + 0x58]
call fcn.00403d93
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.0040be0f
mov esi, eax
test esi, esi
js 0x40c70b
xor edi, edi
cmp byte [ebx], 0x7d
jne 0x40c1f9
jmp 0x40c70b
push 0x5c
mov eax, ebx
call fcn.0040b712
pop ecx
test eax, eax
jne 0x40c6c4
cmp dword [ebp + 0x10], edi
je 0x40c4d1
push 0x2001f
push ebx
push dword [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.00403d44
test eax, eax
je 0x40c495
push 0x20019
push ebx
push dword [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.00403d44
test eax, eax
je 0x40c495
push ebx
push dword [esp + 0x1c]
lea esi, [esp + 0x28]
call fcn.0040989c
mov esi, eax
cmp esi, edi
jne 0x40c6dc
mov ecx, dword [esp + 0x14]
mov eax, ebx
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
cmp byte [ebx], 0x3d
jne 0x40c678
mov ecx, dword [esp + 0x14]
push ebx
push edi
lea edx, [esp + 0x28]
call fcn.0040b919
mov esi, eax
cmp esi, edi
jl 0x40c70b
jmp 0x40c678
cmp dword [ebp + 0x14], edi
jne 0x40c4ef
push 0x20019
push ebx
push dword [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.00403d44
mov dword [esp + 0x1c], eax
jmp 0x40c4f7
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], edi
je 0x40c504
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.00428ebd
push eax
call fcn.0040bdd7
mov ecx, dword [esp + 0x28]
add esp, 0x14
mov eax, ebx
call fcn.0040c081
mov esi, eax
cmp esi, edi
jl 0x40c70b
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.0040be0f
mov esi, eax
test esi, esi
js 0x40c70b
cmp byte [ebx], 0x7b
jne 0x40c592
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x40c592
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push dword [esp + 0x28]
push ebx
call fcn.0040c174
mov esi, eax
test esi, esi
jns 0x40c57d
cmp dword [ebp + 0x14], 0
je 0x40c70b
mov ecx, dword [esp + 0x14]
mov eax, ebx
call fcn.0040c081
mov esi, eax
test esi, esi
js 0x40c70b
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x1c]
cmp eax, 2
je 0x40c424
test eax, eax
je 0x40c5c1
cmp dword [esp + 0x3c], 0
jne 0x40c424
call fcn.0040c072
mov esi, eax
jmp 0x40c70b
cmp dword [esp + 0x3c], 0
je 0x40c605
push dword [esp + 0x20]
call fcn.0040bf82
test eax, eax
je 0x40c605
lea eax, [esp + 0x64]
push eax
call fcn.0040be6b
test eax, eax
je 0x40c424
cmp dword [esp + 0x2c], 0
je 0x40c424
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x24]
call fcn.0040be9a
jmp 0x40c424
push dword [esp + 0x20]
call fcn.0040bf82
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call fcn.00403d93
mov edi, eax
xor eax, eax
cmp edi, eax
jne 0x40c6ee
cmp dword [esp + 0x2c], eax
je 0x40c424
cmp dword [esp + 0x1c], eax
jne 0x40c424
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x64]
push eax
lea edi, [esp + 0x50]
mov dword [esp + 0x50], ecx
call fcn.0040c004
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
cmp eax, ecx
jne 0x40c6fb
mov ecx, edi
call fcn.00403d93
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x40c426
cmp byte [ebx], 0x7b
jne 0x40c426
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x40c426
mov ecx, dword [esp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [esp + 0x28]
push ebx
call fcn.0040c174
mov esi, eax
cmp esi, edi
jl 0x40c70b
mov ecx, dword [esp + 0x14]
jmp 0x40c1e3
lea ecx, [esp + 0x30]
call fcn.00403d93
mov esi, 0x80020009
jmp 0x40c70b
lea ecx, [esp + 0x30]
jmp 0x40c706
call fcn.0040c072
lea ecx, [esp + 0x58]
jmp 0x40c704
lea ecx, [esp + 0x20]
call fcn.00403d93
mov eax, esi
call fcn.0040c072
jmp 0x40c716
lea ecx, [esp + 0x20]
call fcn.00403d93
mov eax, edi
jmp 0x40c6e7
call fcn.0040c072
lea ecx, [esp + 0x4c]
mov esi, eax
call fcn.00403d93
lea ecx, [esp + 0x20]
call fcn.00403d93
mov eax, esi
mov ecx, dword [esp + 0x1178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1160]
xor ecx, esp
call fcn.00428263
mov esp, ebp
pop ebp
ret 0x10