Function at 0x413a20
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
push edi
lea edi, [eax + esi]
mov dword [esp + 0x14], edi
cmp esi, edi
jne 0x413a3a
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
ja 0x413a32
cmp byte [edi - 1], 0
jne 0x413a32
push ebx
push 0x2000
call fcn.00416def
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x413a61
pop ebx
pop edi
pop esi
add esp, 0x18
ret
mov dword [esp + 0xc], 0
cmp esi, edi
jae 0x413e2d
push ebp
mov al, byte [esi]
test al, al
je 0x413e2c
lea esp, [esp]
cmp al, 0xd
je 0x413a90
cmp al, 0xa
je 0x413a90
cmp al, 0x20
je 0x413a90
cmp al, 9
jne 0x413aad
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x413a80
pop ebp
push ebx
call fcn.00416ce5
mov eax, dword [esp + 0x10]
add esp, 4
pop ebx
pop edi
pop esi
add esp, 0x18
ret
mov al, byte [esi]
test al, al
je 0x413e2c
cmp al, 0x5b
jne 0x413e2c
inc esi
cmp dword [esi], 0x4d4c4b48
je 0x413b4d
push 0x12
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
je 0x413b4d
cmp dword [esi], 0x52434b48
je 0x413b46
push 0x11
push str.HKEY_CLASSES_ROOT
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
je 0x413b46
cmp dword [esi], 0x55434b48
je 0x413b3f
push 0x11
push str.HKEY_CURRENT_USER
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
je 0x413b3f
cmp dword [esi], 0x52535548
je 0x413b38
push 0xa
push str.HKEY_USERS
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
jne 0x413e2c
mov ebp, 0x80000003
jmp 0x413b52
mov ebp, 0x80000001
jmp 0x413b52
mov ebp, 0x80000000
jmp 0x413b52
mov ebp, 0x80000002
push 0x5c
push esi
call fcn.00418dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x413e2c
inc edi
push 0x5d
push edi
call fcn.00418dd0
mov esi, eax
add esp, 8
test esi, esi
je 0x413e2c
inc esi
mov ecx, esi
sub ecx, edi
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movzx eax, word [esi]
mov edx, 0xd0a
cmp ax, dx
je 0x413bb3
mov ecx, 0xa0d
cmp ax, cx
je 0x413bb3
mov al, byte [esi]
cmp al, 0xd
je 0x413bb0
cmp al, 0xa
jne 0x413e2c
inc esi
jmp 0x413bb6
add esi, 2
push ebx
push ebp
call fcn.004149d0
mov ebp, eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebp, ebp
je 0x413e2c
mov dword [esp + 0x10], 1
lea esp, [esp]
cmp esi, dword [esp + 0x1c]
jae 0x413e1b
movzx eax, word [esi]
mov edx, 0xa0d
cmp ax, dx
je 0x413e1b
mov ecx, 0x3d40
cmp ax, cx
jne 0x413c13
push 0x428166
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x413c45
cmp byte [esi], 0x22
jne 0x413e13
inc esi
push 0x42cc60
push esi
mov edi, esi
call fcn.00418380
mov esi, eax
add esp, 8
test esi, esi
je 0x413e1b
mov edx, esi
sub edx, edi
inc edx
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, 2
cmp byte [esi], 0x22
jne 0x413c8e
inc esi
push 0x22
push esi
mov edi, esi
call fcn.00418dd0
mov esi, eax
add esp, 8
test esi, esi
je 0x413e13
sub eax, edi
inc eax
push eax
push edi
lea edi, [ebx + 0x1000]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
push ebx
push ebp
call fcn.00414b10
cmp eax, 1
jne 0x413e13
inc esi
jmp 0x413dd0
push 6
push str.dword:
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
jne 0x413cd2
lea ecx, [esp + 0x20]
push ecx
add esi, 6
push 0x42cc6c
push esi
call fcn.00418d7d
mov edx, dword [esp + 0x2c]
add esp, 0xc
push edx
push ebx
push ebp
call fcn.00414b40
cmp eax, 1
jne 0x413e13
jmp 0x413dd0
push 8
push str.MultString
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
je 0x413dd0
push 4
push str.hex_
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
je 0x413dd0
push 4
push str.hex:
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
jne 0x413db4
push 0xd
push esi
lea edi, [esi + 4]
call fcn.00418dd0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x413e0f
mov ecx, ebp
sub ecx, esi
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
cmp ecx, 0xfa0
jg 0x413e0f
xor ebx, ebx
cmp edi, ebp
jae 0x413d8b
jmp 0x413d60
lea edx, [esp + 0x24]
push edx
push str._02X
push edi
call fcn.00418d7d
mov eax, dword [esp + 0x20]
mov cl, byte [esp + 0x30]
add eax, 0x1000
mov byte [ebx + eax], cl
add edi, 3
add esp, 0xc
inc ebx
cmp edi, ebp
jb 0x413d60
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
push ebx
add eax, 0x1000
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00414bc0
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp eax, 1
jne 0x413e13
jmp 0x413dd0
push 4
push str.dele
push esi
call fcn.0041a0d9
add esp, 0xc
test eax, eax
jne 0x413e13
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0xd
push esi
call fcn.00418dd0
add esp, 8
test eax, eax
jne 0x413dee
push 0xa
push esi
call fcn.00418dd0
add esp, 8
test eax, eax
je 0x413e13
mov cl, byte [eax + 1]
inc eax
cmp cl, 0xd
je 0x413dfc
cmp cl, 0xa
jne 0x413dfd
inc eax
mov ecx, 0xa0d
mov esi, eax
cmp word [eax], cx
jne 0x413be0
jmp 0x413e1b
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, dword [esp + 0x1c]
jb 0x413a72
pop ebp
push ebx
call fcn.00416ce5
mov eax, dword [esp + 0x10]
add esp, 4
pop ebx
pop edi
pop esi
add esp, 0x18
ret