Function at 0x40f320
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4282f6
mov eax, dword fs:[0]
push eax
mov eax, 0x114c
call fcn.0041d300
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x1148], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4322d0]
xor eax, esp
push eax
lea eax, [esp + 0x1160]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1170]
mov eax, dword [esp + 0x1174]
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x117c]
mov eax, esi
mov dword [esp + 0x1168], ebx
mov dword [esp + 0x40], edx
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f9ae
cmp byte [esi], 0x7d
je 0x40f9ac
nop
mov edi, dword [esp + 0x30]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push edi
mov dword [esp + 0x3c], 1
call ebp
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push edi
inc esi
call ebp
test eax, eax
je 0x40f3e5
cmp esi, ebx
je 0x40f50d
mov ecx, dword [esp + 0x20]
mov eax, edi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
cmp dword [esp + 0x1178], ebx
je 0x40f50d
mov cl, byte [edi]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov eax, edi
cmp cl, bl
je 0x40f438
mov ebp, dword [sym.imp.USER32.dll_CharNextA]
lea ecx, [ecx]
cmp cl, 0x5c
je 0x40f430
push eax
call ebp
mov cl, byte [eax]
cmp cl, bl
jne 0x40f420
jmp 0x40f438
cmp eax, ebx
jne 0x40f92b
mov ebp, 0x42c99c
lea ecx, [ecx]
mov eax, dword [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40f478
add ebp, 4
cmp ebp, 0x42c9cc
jl 0x40f440
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ebx
call fcn.0040d5e0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp esi, ebx
je 0x40f509
mov esi, dword [esp + 0x20]
mov eax, edi
mov ecx, esi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f944
mov ecx, esi
call fcn.0040ee60
mov ebp, eax
cmp ebp, ebx
jl 0x40f944
mov dword [esp + 0x2c], ebx
cmp byte [edi], 0x7b
jne 0x40f8b7
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x40f8b7
mov eax, dword [esp + 0x1178]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
push ebx
push eax
push ecx
push edi
mov ecx, esi
call fcn.0040f320
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
mov eax, edi
mov ecx, esi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
jmp 0x40f8b7
mov dword [esp + 0x2c], ebx
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40f536
mov ecx, dword [esp + 0x20]
mov eax, edi
mov dword [esp + 0x34], ebx
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
mov esi, dword [esp + 0x20]
push 0x42c978
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40f662
lea eax, [esp + 0x15c]
mov ecx, esi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
mov eax, edi
mov ecx, esi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
cmp byte [edi], 0x3d
jne 0x40f934
cmp dword [esp + 0x1178], ebx
je 0x40f5d7
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x15c]
mov byte [esp + 0x1168], 1
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], edx
push ecx
mov ecx, edi
mov edx, esi
mov dword [esp + 0x58], ebx
call fcn.0040e930
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
jl 0x40f94a
mov byte [esp + 0x1168], bl
mov dword [esp + 0x50], ebx
jmp 0x40f4ac
cmp dword [esp + 0x117c], ebx
jne 0x40f64c
cmp dword [esp + 0x34], ebx
je 0x40f64c
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x14]
push edx
push 0x20006
push ebx
push ebx
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40f95e
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x15c]
push ecx
push ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x40f639
cmp eax, 2
jne 0x40f95e
cmp ebp, ebx
je 0x40f648
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov ecx, esi
call fcn.0040ee60
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
jmp 0x40f8b7
mov cl, byte [edi]
mov eax, edi
cmp cl, bl
je 0x40f688
mov ebp, dword [sym.imp.USER32.dll_CharNextA]
cmp cl, 0x5c
je 0x40f680
push eax
call ebp
mov cl, byte [eax]
cmp cl, bl
jne 0x40f670
jmp 0x40f688
cmp eax, ebx
jne 0x40f934
cmp dword [esp + 0x1178], ebx
je 0x40f765
mov esi, dword [esp + 0x24]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebx
push edi
push esi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, ebx
jne 0x40f6d7
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x40f6c7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x40f727
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push edi
push esi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, ebx
jne 0x40f70f
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x40f6ff
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x40f727
mov edx, esi
push edx
mov edx, edi
lea esi, [esp + 0x1c]
call fcn.0040d530
mov ebp, eax
cmp ebp, ebx
jne 0x40f969
mov ecx, dword [esp + 0x20]
mov eax, edi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
cmp byte [edi], 0x3d
jne 0x40f4ac
mov edx, dword [esp + 0x20]
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0040e930
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
jmp 0x40f4ac
cmp dword [esp + 0x117c], ebx
jne 0x40f875
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push edi
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40f7ae
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebx
je 0x40f7a2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x40f7c1
mov dword [esp + 0x117c], 1
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x5c]
push 0x104
push edx
call fcn.00414a65
push eax
call fcn.0040d150
add esp, 0x14
mov eax, edi
mov ecx, esi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
mov ecx, esi
call fcn.0040ee60
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
cmp byte [edi], 0x7b
jne 0x40f84d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x40f84d
mov eax, dword [esp + 0x117c]
mov ecx, dword [esp + 0x18]
push eax
push ebx
push ecx
push edi
mov ecx, esi
call fcn.0040f320
mov ebp, eax
cmp ebp, ebx
jge 0x40f83a
cmp dword [esp + 0x117c], ebx
je 0x40f99d
mov eax, edi
mov ecx, esi
call fcn.0040e810
mov ebp, eax
cmp ebp, ebx
jl 0x40f99d
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x117c], edx
cmp eax, 2
je 0x40f8b7
cmp eax, ebx
je 0x40f882
cmp edx, ebx
jne 0x40f8b7
call fcn.0040d2b0
mov ebp, eax
jmp 0x40f99d
mov dword [esp + 0x14], 2
jmp 0x40f7b6
mov esi, dword [esp + 0x18]
cmp edx, ebx
je 0x40f8c9
mov ecx, esi
call fcn.0040ee20
test eax, eax
je 0x40f8c9
lea ebx, [esp + 0x54]
call fcn.0040ede0
test eax, eax
je 0x40f8b5
cmp dword [esp + 0x34], 0
je 0x40f8b5
mov eax, ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.0040d5e0
xor ebx, ebx
mov edx, dword [esp + 0x30]
cmp byte [edx], 0x7d
jne 0x40f3b0
jmp 0x40f99d
mov ecx, esi
call fcn.0040ee20
xor edi, edi
mov dword [esp + 0x14], eax
cmp esi, ebx
je 0x40f8e7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
cmp edi, ebx
jne 0x40f97b
cmp dword [esp + 0x34], ebx
je 0x40f8b7
cmp dword [esp + 0x14], ebx
jne 0x40f8b7
mov ecx, dword [esp + 0x24]
lea edi, [esp + 0x54]
lea esi, [esp + 0x44]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ebx
call fcn.0040d4d0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
cmp eax, ebx
jne 0x40f98d
call fcn.0040d4b0
jmp 0x40f8b7
lea esi, [esp + 0x28]
call fcn.0040d4b0
lea esi, [esp + 0x18]
call fcn.0040d4b0
mov eax, 0x80020009
jmp 0x40f9ae
lea esi, [esp + 0x28]
jmp 0x40f998
lea esi, [esp + 0x4c]
call fcn.0040d4b0
lea esi, [esp + 0x18]
call fcn.0040d4b0
jmp 0x40f9ac
call fcn.0040d2b0
lea esi, [esp + 0x38]
jmp 0x40f996
lea esi, [esp + 0x18]
call fcn.0040d4b0
mov eax, ebp
call fcn.0040d2b0
jmp 0x40f9ae
lea esi, [esp + 0x18]
call fcn.0040d4b0
mov eax, edi
call fcn.0040d2b0
jmp 0x40f9ae
call fcn.0040d2b0
lea esi, [esp + 0x44]
mov ebp, eax
call fcn.0040d4b0
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40f9ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x1160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1148]
xor ecx, esp
call fcn.00412dd0
add esp, 0x1158
ret 0x10