Function at 0x40b2d0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
sub esp, 0x208
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
mov ebp, dword [esp + 0x214]
push edi
lea ebx, [ebp + 2]
push 0x20006
push ebx
call fcn.0040ad60
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b320
lea eax, [edi + 1]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.00414adc
add esp, 0x208
ret
push esi
push 1
mov eax, 0xff
lea ecx, [esp + 0x18]
xor esi, esi
mov edx, ebx
call fcn.00409b00
mov esi, eax
lea eax, [ebp + 0x18416]
push eax
push 0x422a90
push edi
call fcn.0040a2e0
add esp, 0x10
test eax, eax
je 0x40b375
test esi, esi
jle 0x40b364
lea ecx, [esp + 0x14]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
jmp 0x40bc4e
lea edx, [ebp + 0x28414]
push edx
push str.AppParameters
push edi
call fcn.0040a2e0
add esp, 0xc
test eax, eax
je 0x40b3b3
test esi, esi
jle 0x40b3a2
lea eax, [esp + 0x14]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x40bc4e
lea ecx, [ebp + 0x30412]
push ecx
push str.AppDirectory
push edi
call fcn.0040a2e0
add esp, 0xc
test eax, eax
je 0x40b3f1
test esi, esi
jle 0x40b3e0
lea edx, [esp + 0x14]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x40bc4e
mov eax, dword [ebp + 0x4041c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 0x20
je 0x40b413
push eax
push str.AppPriority
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b425
cmp byte [esp + 0x220], 0
je 0x40b425
push str.AppPriority
push edi
call esi
mov eax, dword [ebp + 0x40400]
mov ecx, dword [ebp + 0x40404]
mov edx, eax
or edx, ecx
je 0x40b4e4
lea edx, [esp + 0x10]
push edx
push ecx
push eax
call fcn.0040c560
add esp, 0xc
test eax, eax
jne 0x40b4ca
mov edx, dword [esp + 0x10]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b457
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push str.AppAffinity
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b4c4
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppAffinity
push 0xc00003fb
push 1
call fcn.00402230
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 5
jmp 0x40bc4e
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40b4f6
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40b4f6
cmp byte [esp + 0x220], 0
je 0x40b4f6
push str.AppAffinity
push edi
call esi
mov eax, dword [ebp + 0x7049c]
not eax
test eax, eax
je 0x40b513
push eax
push str.AppStopMethodSkip
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b525
cmp byte [esp + 0x220], 0
je 0x40b525
push str.AppStopMethodSkip
push edi
call esi
mov eax, dword [ebp + 0x70490]
cmp eax, 4
jae 0x40b549
mov edx, dword [esp + 0x220]
mov eax, dword [eax*4 + 0x42802c]
push edx
push eax
push ebx
call fcn.00409d80
add esp, 0xc
mov eax, dword [ebp + 0x70494]
test eax, eax
je 0x40b564
push eax
push str.AppRestartDelay
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b576
cmp byte [esp + 0x220], 0
je 0x40b576
push str.AppRestartDelay
push edi
call esi
mov eax, dword [ebp + 0x70498]
cmp eax, 0x5dc
je 0x40b594
push eax
push str.AppThrottle
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b5a6
cmp byte [esp + 0x220], 0
je 0x40b5a6
push str.AppThrottle
push edi
call esi
mov eax, dword [ebp + 0x704a0]
cmp eax, 0x5dc
je 0x40b5c4
push eax
push str.AppStopMethodConsole
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b5d6
cmp byte [esp + 0x220], 0
je 0x40b5d6
push str.AppStopMethodConsole
push edi
call esi
mov eax, dword [ebp + 0x704a4]
cmp eax, 0x5dc
je 0x40b5f4
push eax
push str.AppStopMethodWindow
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b606
cmp byte [esp + 0x220], 0
je 0x40b606
push str.AppStopMethodWindow
push edi
call esi
mov eax, dword [ebp + 0x704a8]
cmp eax, 0x5dc
je 0x40b624
push eax
push str.AppStopMethodThreads
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b636
cmp byte [esp + 0x220], 0
je 0x40b636
push str.AppStopMethodThreads
push edi
call esi
cmp byte [ebp + 0x704ac], 0
jne 0x40b651
push 0
push str.AppKillProcessTree
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40b663
cmp byte [esp + 0x220], 0
je 0x40b663
push str.AppKillProcessTree
push edi
call esi
movzx eax, word [ebp + 0x40424]
lea ecx, [ebp + 0x40424]
test ax, ax
jne 0x40b687
cmp byte [esp + 0x220], al
je 0x40b766
test ax, ax
je 0x40b698
push ecx
push str.AppStdin
push edi
call fcn.0040a2e0
add esp, 0xc
jmp 0x40b6aa
cmp byte [esp + 0x220], 0
je 0x40b6aa
push str.AppStdin
push edi
call esi
mov eax, dword [ebp + 0x50424]
cmp eax, 2
je 0x40b6cb
push eax
push str.ShareMode
push str.AppStdin
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b6e8
cmp byte [esp + 0x220], 0
je 0x40b6e8
push str.ShareMode
push str.AppStdin
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x50428]
cmp eax, 3
je 0x40b709
push eax
push str.CreationDisposition
push str.AppStdin
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b726
cmp byte [esp + 0x220], 0
je 0x40b726
push str.CreationDisposition
push str.AppStdin
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x5042c]
cmp eax, 0x80
je 0x40b749
push eax
push str.FlagsAndAttributes
push str.AppStdin
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b766
cmp byte [esp + 0x220], 0
je 0x40b766
push str.FlagsAndAttributes
push str.AppStdin
push edi
call fcn.00406ea0
add esp, 0xc
movzx eax, word [ebp + 0x50430]
lea ecx, [ebp + 0x50430]
test ax, ax
jne 0x40b78a
cmp byte [esp + 0x220], al
je 0x40b8a6
test ax, ax
je 0x40b79b
push ecx
push str.AppStdout
push edi
call fcn.0040a2e0
add esp, 0xc
jmp 0x40b7ad
cmp byte [esp + 0x220], 0
je 0x40b7ad
push str.AppStdout
push edi
call esi
mov eax, dword [ebp + 0x60430]
cmp eax, 3
je 0x40b7ce
push eax
push str.ShareMode
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b7eb
cmp byte [esp + 0x220], 0
je 0x40b7eb
push str.ShareMode
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x60434]
cmp eax, 4
je 0x40b80c
push eax
push str.CreationDisposition
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b829
cmp byte [esp + 0x220], 0
je 0x40b829
push str.CreationDisposition
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x60438]
cmp eax, 0x80
je 0x40b84c
push eax
push str.FlagsAndAttributes
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b869
cmp byte [esp + 0x220], 0
je 0x40b869
push str.FlagsAndAttributes
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
cmp byte [ebp + 0x70473], 0
je 0x40b889
push 1
push str.CopyAndTruncate
push str.AppStdout
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b8a6
cmp byte [esp + 0x220], 0
je 0x40b8a6
push str.CopyAndTruncate
push str.AppStdout
push edi
call fcn.00406ea0
add esp, 0xc
movzx eax, word [ebp + 0x60450]
lea ecx, [ebp + 0x60450]
test ax, ax
jne 0x40b8ca
cmp byte [esp + 0x220], al
je 0x40b9e6
test ax, ax
je 0x40b8db
push ecx
push str.AppStderr
push edi
call fcn.0040a2e0
add esp, 0xc
jmp 0x40b8ed
cmp byte [esp + 0x220], 0
je 0x40b8ed
push str.AppStderr
push edi
call esi
mov eax, dword [ebp + 0x70450]
cmp eax, 3
je 0x40b90e
push eax
push str.ShareMode
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b92b
cmp byte [esp + 0x220], 0
je 0x40b92b
push str.ShareMode
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x70454]
cmp eax, 4
je 0x40b94c
push eax
push str.CreationDisposition
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b969
cmp byte [esp + 0x220], 0
je 0x40b969
push str.CreationDisposition
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
mov eax, dword [ebp + 0x70458]
cmp eax, 0x80
je 0x40b98c
push eax
push str.FlagsAndAttributes
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b9a9
cmp byte [esp + 0x220], 0
je 0x40b9a9
push str.FlagsAndAttributes
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
cmp byte [ebp + 0x70474], 0
je 0x40b9c9
push 1
push str.CopyAndTruncate
push str.AppStderr
push edi
call fcn.00406e10
add esp, 0x10
jmp 0x40b9e6
cmp byte [esp + 0x220], 0
je 0x40b9e6
push str.CopyAndTruncate
push str.AppStderr
push edi
call fcn.00406ea0
add esp, 0xc
cmp byte [ebp + 0x70472], 0
je 0x40ba01
push 1
push str.AppTimestampLog
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40ba13
cmp byte [esp + 0x220], 0
je 0x40ba13
push str.AppTimestampLog
push edi
call esi
cmp byte [ebp + 0x70470], 0
je 0x40ba2e
push 1
push str.AppRedirectHook
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40ba40
cmp byte [esp + 0x220], 0
je 0x40ba40
push str.AppRedirectHook
push edi
call esi
cmp byte [ebp + 0x70471], 0
je 0x40ba5b
push 1
push str.AppRotateFiles
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40ba6d
cmp byte [esp + 0x220], 0
je 0x40ba6d
push str.AppRotateFiles
push edi
call esi
cmp dword [ebp + 0x70478], 0
je 0x40ba88
push 1
push str.AppRotateOnline
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40ba9a
cmp byte [esp + 0x220], 0
je 0x40ba9a
push str.AppRotateOnline
push edi
call esi
mov eax, dword [ebp + 0x70480]
test eax, eax
je 0x40bab5
push eax
push str.AppRotateSeconds
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40bac7
cmp byte [esp + 0x220], 0
je 0x40bac7
push str.AppRotateSeconds
push edi
call esi
mov eax, dword [ebp + 0x70484]
test eax, eax
je 0x40bae2
push eax
push str.AppRotateBytes
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40baf4
cmp byte [esp + 0x220], 0
je 0x40baf4
push str.AppRotateBytes
push edi
call esi
mov eax, dword [ebp + 0x70488]
test eax, eax
je 0x40bb0f
push eax
push str.AppRotateBytesHigh
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40bb21
cmp byte [esp + 0x220], 0
je 0x40bb21
push str.AppRotateBytesHigh
push edi
call esi
mov eax, dword [ebp + 0x7048c]
test eax, eax
je 0x40bb3c
push eax
push str.AppRotateDelay
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40bb4e
cmp byte [esp + 0x220], 0
je 0x40bb4e
push str.AppRotateDelay
push edi
call esi
cmp dword [ebp + 0x40420], 0
je 0x40bb69
push 1
push str.AppNoConsole
push edi
call fcn.0040a300
add esp, 0xc
jmp 0x40bb7b
cmp byte [esp + 0x220], 0
je 0x40bb7b
push str.AppNoConsole
push edi
call esi
mov eax, dword [ebp + 0x403f8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40bbcd
mov ecx, dword [ebp + 0x40410]
add ecx, ecx
push ecx
push eax
push 7
push 0
push str.AppEnvironment
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bbe3
push 0
call esi
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppEnvironment
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
jmp 0x40bbe3
cmp byte [esp + 0x220], 0
je 0x40bbe3
push str.AppEnvironment
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp + 0x40414]
test eax, eax
je 0x40bc2f
mov edx, dword [ebp + 0x40418]
add edx, edx
push edx
push eax
push 7
push 0
push str.AppEnvironmentExtra
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bc45
push 0
call esi
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppEnvironmentExtra
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
jmp 0x40bc45
cmp byte [esp + 0x220], 0
je 0x40bc45
push str.AppEnvironmentExtra
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x214]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414adc
add esp, 0x208
ret