Function at 0x405e9f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b3e3
mov eax, dword fs:[0]
push eax
mov eax, 0x1158
call fcn.0040b0f2
mov eax, dword [0x4110e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1118], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x111c], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x1128], ecx
mov dword [ebp - 0x112c], ebx
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x1164], ecx
mov ecx, eax
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064c0
cmp byte [edi], 0x7d
je 0x4064b5
xor eax, eax
inc eax
push str.Delete
push edi
mov dword [ebp - 0x1130], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x1120], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405f5a
test esi, esi
je 0x406026
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x406028
mov dl, 0x5c
mov dword [ebp - 0x113c], esi
mov ecx, edi
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1134], esi
call fcn.004052e6
test eax, eax
jne 0x4064b0
push edi
call fcn.00405a90
test eax, eax
je 0x405fde
mov eax, dword [ebp - 0x111c]
lea ecx, [ebp - 0x113c]
push edi
mov dword [ebp - 0x113c], eax
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1134], esi
call fcn.00405b80
mov dword [ebp - 0x113c], esi
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1134], esi
cmp dword [ebp - 0x1120], esi
je 0x40601e
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405a2a
mov esi, eax
test esi, esi
js 0x4064b5
and dword [ebp - 0x1138], 0
jmp 0x406427
mov dword [ebp - 0x1138], esi
jmp 0x406028
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406054
mov ecx, dword [ebp - 0x1118]
push edi
mov dword [ebp - 0x1130], esi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
push 0x40c548
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406193
mov ecx, dword [ebp - 0x1118]
lea eax, [ebp - 0x1114]
push eax
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
cmp byte [edi], 0x3d
jne 0x4064b0
cmp dword [ebp + 0x10], 0
je 0x406106
mov eax, dword [ebp - 0x111c]
mov ecx, dword [ebp - 0x1118]
and dword [ebp - 0x1150], 0
and dword [ebp - 0x114c], 0
mov dword [ebp - 0x1154], eax
lea eax, [ebp - 0x1114]
push edi
push eax
lea eax, [ebp - 0x1154]
push eax
call fcn.00405581
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x1154], ecx
mov dword [ebp - 0x1150], ecx
mov dword [ebp - 0x114c], ecx
test esi, esi
js 0x4064b5
mov dword [ebp - 0x1150], ecx
jmp 0x406427
cmp dword [ebp + 0x14], 0
jne 0x406182
cmp dword [ebp - 0x1130], 0
je 0x406182
xor eax, eax
lea ecx, [ebp - 0x1148]
push 0x20006
push eax
push dword [ebp - 0x111c]
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], eax
mov dword [ebp - 0x1140], eax
call fcn.00405b22
test eax, eax
jne 0x40647f
mov esi, dword [ebp - 0x1148]
lea eax, [ebp - 0x1114]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x406169
cmp eax, 2
jne 0x40647f
test esi, esi
je 0x40617b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x1148], 0
and dword [ebp - 0x1144], 0
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405a2a
jmp 0x40646b
mov dl, 0x5c
mov ecx, edi
call fcn.004052e6
test eax, eax
jne 0x4064b0
cmp dword [ebp + 0x10], eax
je 0x40623a
mov ebx, dword [ebp - 0x111c]
lea ecx, [ebp - 0x112c]
push 0x2001f
push edi
push ebx
call fcn.00405b22
test eax, eax
je 0x4061f7
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x112c]
call fcn.00405b22
test eax, eax
je 0x4061f7
sub esp, 0x14
lea ecx, [ebp - 0x112c]
push edi
push ebx
call fcn.00405381
test eax, eax
jne 0x40649f
mov ebx, dword [ebp - 0x1118]
mov ecx, ebx
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064a8
cmp byte [edi], 0x3d
jne 0x40622f
push edi
push 0
lea eax, [ebp - 0x112c]
mov ecx, ebx
push eax
call fcn.00405581
mov esi, eax
test esi, esi
js 0x4064a8
mov ebx, dword [ebp - 0x112c]
jmp 0x406427
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x406260
push 0x20019
push edi
push dword [ebp - 0x111c]
lea ecx, [ebp - 0x112c]
call fcn.00405b22
mov ebx, dword [ebp - 0x112c]
jmp 0x406263
push 2
pop eax
push 1
test eax, eax
mov dword [ebp - 0x1120], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
lea eax, [ebp - 0x114]
push edi
push 0x104
push eax
mov dword [ebp + 0x14], esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
mov ecx, eax
call fcn.004059f4
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405a2a
mov esi, eax
test esi, esi
js 0x4064b5
cmp byte [edi], 0x7b
jne 0x406311
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4062c9
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x406311
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1118]
push 0
push ebx
push edi
call fcn.00405e9f
mov esi, eax
test esi, esi
jns 0x4062fb
cmp dword [ebp + 0x14], 0
je 0x4064b5
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
mov eax, dword [ebp - 0x1120]
mov ecx, dword [ebp - 0x1164]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x406471
test eax, eax
je 0x406343
test ecx, ecx
jne 0x406471
mov ecx, eax
call fcn.00405d71
mov esi, eax
jmp 0x4064b5
test ecx, ecx
je 0x40638f
push ebx
call fcn.00405c55
test eax, eax
je 0x40638f
lea eax, [ebp - 0x114]
push eax
call fcn.00405a90
test eax, eax
je 0x406471
cmp dword [ebp - 0x1130], 0
je 0x406471
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x112c]
call fcn.00405b80
mov ebx, dword [ebp - 0x112c]
jmp 0x406471
push ebx
call fcn.00405c55
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1120], ecx
test ebx, ebx
je 0x4063b8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1120]
xor ebx, ebx
mov dword [ebp - 0x112c], ebx
and dword [ebp - 0x1128], 0
test eax, eax
jne 0x406335
cmp dword [ebp - 0x1130], eax
je 0x406471
test ecx, ecx
jne 0x406471
mov eax, dword [ebp - 0x111c]
and dword [ebp - 0x115c], ecx
and dword [ebp - 0x1158], ecx
lea ecx, [ebp - 0x1160]
mov dword [ebp - 0x1160], eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405cf8
xor ecx, ecx
mov dword [ebp - 0x1160], ecx
mov dword [ebp - 0x115c], ecx
mov dword [ebp - 0x1158], ecx
test eax, eax
jne 0x406335
mov dword [ebp - 0x115c], ecx
cmp dword [ebp + 0x10], 0
je 0x406471
cmp byte [edi], 0x7b
jne 0x406471
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406437
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x406474
mov ecx, dword [ebp - 0x1118]
push 0
push dword [ebp + 0x10]
push ebx
push edi
call fcn.00405e9f
mov esi, eax
test esi, esi
js 0x4064b5
mov ecx, dword [ebp - 0x1118]
push edi
call fcn.00405d7f
mov esi, eax
test esi, esi
js 0x4064b5
xor eax, eax
inc eax
cmp byte [edi], 0x7d
jne 0x405f25
jmp 0x4064b5
mov ecx, eax
call fcn.00405d71
cmp dword [ebp - 0x1148], 0
mov esi, eax
je 0x4064b5
push dword [ebp - 0x1148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4064b5
mov ecx, eax
call fcn.00405d71
mov esi, eax
mov ebx, dword [ebp - 0x112c]
jmp 0x4064b5
mov esi, 0x80020009
test ebx, ebx
je 0x4064c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409ef7
mov esp, ebp
pop ebp
ret 0x10