Function at 0x404ebc
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x4100a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x238], 1
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
xor ecx, ecx
push esi
mov esi, ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x240], ecx
mov ecx, eax
push ebx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x23c], esi
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405439
jmp 0x40552b
push 0x401fdc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x401fb0
sbb edi, edi
inc edi
push ebx
mov dword [ebp - 0x230], edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404f65
test edi, edi
je 0x404fde
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
cmp dword [ebp + 0x10], 0
je 0x404fde
xor eax, eax
mov ecx, ebx
push 0x5c
pop edx
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
call fcn.0040442a
test eax, eax
jne 0x405423
push ebx
call fcn.00404a96
test eax, eax
je 0x404fd1
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x250]
push ebx
mov dword [ebp - 0x250], eax
call fcn.00403f6c
xor eax, eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x230], 0
jne 0x40549c
push 0x401fc8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40500a
mov ecx, dword [ebp - 0x214]
push ebx
mov dword [ebp - 0x238], eax
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
push 0x401fa8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405123
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x405423
cmp dword [ebp + 0x10], 0
je 0x4050a6
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
push ecx
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x210]
push ebx
push eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov ecx, dword [ebp - 0x214]
push eax
call fcn.00404688
mov edi, eax
xor eax, eax
mov dword [ebp - 0x25c], eax
jmp 0x4054c0
cmp dword [ebp + 0x14], 0
jne 0x405112
lea eax, [ebp - 0x218]
xor ecx, ecx
push eax
push 0x20006
push ecx
push ecx
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x405563
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x230], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x405101
cmp edi, 2
jne 0x40553c
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x405112
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.00404b8b
jmp 0x405521
push 0x5c
pop edx
mov ecx, ebx
call fcn.0040442a
test eax, eax
jne 0x405423
cmp dword [ebp + 0x10], eax
je 0x405262
lea eax, [ebp - 0x218]
xor ecx, ecx
push eax
push 0xf003f
push ecx
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40518b
mov ecx, eax
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x405179
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov edi, dword [ebp - 0x218]
mov dword [ebp - 0x22c], edi
test ecx, ecx
je 0x4051f3
jmp 0x405191
mov edi, dword [ebp - 0x22c]
lea eax, [ebp - 0x218]
xor ecx, ecx
push eax
push 0x20019
push ecx
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4051d6
mov ecx, eax
test edi, edi
je 0x4051c6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x22c], eax
test ecx, ecx
je 0x4051f3
sub esp, 0x14
lea ecx, [ebp - 0x22c]
push ebx
push dword [ebp - 0x21c]
call fcn.00403f18
test eax, eax
jne 0x405423
xor eax, eax
mov byte [ebp - 0x234], al
movzx eax, word [ebx]
cmp eax, 0x4c
je 0x405208
cmp eax, 0x6c
jne 0x40521f
push 0x402158
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40521f
mov byte [ebp - 0x234], 1
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
push 0x3d
pop eax
cmp word [ebx], ax
jne 0x4054c8
push dword [ebp - 0x234]
mov ecx, dword [ebp - 0x214]
xor eax, eax
push ebx
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00404688
jmp 0x4054be
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x4052ba
lea eax, [ebp - 0x218]
xor ecx, ecx
push eax
push 0x20019
push ecx
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4052b4
mov ecx, eax
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x4052a4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x22c], eax
test ecx, ecx
je 0x4052ba
xor edi, edi
inc edi
mov dword [ebp + 0x14], edi
mov eax, dword [ebp - 0x220]
test eax, eax
jne 0x405311
mov ecx, 0x208
call fcn.00403da3
test al, al
je 0x4052e6
mov eax, 0x208
call fcn.0040f8f0
mov eax, esp
mov dword [ebp - 0x220], esp
jmp 0x405309
push 0x210
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
test eax, eax
je 0x405303
mov dword [eax], esi
mov esi, eax
mov dword [ebp - 0x23c], esi
add eax, 8
mov dword [ebp - 0x220], eax
test eax, eax
je 0x405577
push 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test edi, edi
jne 0x405340
mov edi, dword [ebp - 0x22c]
push edi
call fcn.00404ac7
test eax, eax
jne 0x405340
push edi
call fcn.00404b00
test eax, eax
je 0x40540a
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.00404b8b
mov edi, eax
test edi, edi
js 0x405428
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x4053bc
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x214]
xor eax, eax
push eax
push dword [ebp - 0x22c]
push ebx
call fcn.00404ebc
mov edi, eax
test edi, edi
js 0x405428
cmp dword [ebp + 0x14], 0
je 0x4053c6
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x214]
push ebx
mov dword [ebp + 0x14], eax
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
jmp 0x405112
cmp dword [ebp + 0x14], 0
jne 0x40552b
push dword [ebp - 0x22c]
call fcn.00404ac7
test eax, eax
je 0x4053fa
mov edi, dword [ebp - 0x220]
push edi
call fcn.00404a96
test eax, eax
je 0x405515
push edi
lea ecx, [ebp - 0x22c]
call fcn.00403f6c
jmp 0x405515
cmp dword [ebp + 0x14], 0
jne 0x40552b
mov edi, dword [ebp - 0x22c]
test edi, edi
je 0x40545f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0x22c], edi
test eax, eax
je 0x405461
mov edi, 0x80020009
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x405439
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x23c]
call fcn.00405e0f
mov eax, edi
lea esp, [ebp - 0x278]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f200
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
cmp dword [ebp - 0x238], 0
je 0x40549c
mov eax, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], ecx
lea ecx, [ebp - 0x268]
push edi
mov dword [ebp - 0x268], eax
call fcn.00403e6c
xor eax, eax
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.00404b8b
mov edi, eax
test edi, edi
js 0x405428
cmp dword [ebp + 0x10], 0
je 0x40552b
push 0x7b
pop eax
cmp word [ebx], ax
jne 0x40552b
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x244]
jne 0x4054db
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x40552b
mov ecx, dword [ebp - 0x214]
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x22c]
push ebx
call fcn.00404ebc
mov edi, eax
test edi, edi
js 0x405428
mov ecx, dword [ebp - 0x214]
push ebx
call fcn.0040453b
mov edi, eax
test edi, edi
js 0x405428
push 0x7d
pop eax
cmp word [ebx], ax
jne 0x404f3a
jmp 0x405428
test edi, edi
jle 0x405549
movzx edi, di
or edi, 0x80070000
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x405428
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405428
jle 0x405428
movzx edi, di
or edi, 0x80070000
jmp 0x405428
mov edi, 0x8007000e
jmp 0x405428