Function at 0x40621b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x114c
call fcn.0040db80
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1148]
mov dword [ebp - 0x114c], esi
rep stosd dword es:[edi], eax
mov al, byte [0x414c70]
push 0x40
mov byte [ebp - 0x14c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push eax
push 0x2001f
push esi
mov edi, 0x80000002
push ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], 0x104
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40643d
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x18], esi
je 0x406341
mov dword [ebp - 0xc], esi
jbe 0x406341
lea eax, [ebp - 0x114c]
mov ebx, 0xff
mov dword [ebp - 4], eax
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x24], ebx
push eax
push esi
push esi
lea eax, [ebp - 0x24]
push esi
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40632c
mov eax, dword [ebp - 4]
inc dword [ebp - 0x10]
add dword [ebp - 4], 4
cmp dword [ebp - 0xc], esi
mov dword [eax], edi
jne 0x40632c
push dword [ebp + 8]
push dword [ebp - 0x114c]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x4063ac
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jb 0x4062db
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov edi, 0x80000002
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x40636b
lea ecx, [ebp - 0x114c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add dword [ebp - 4], 4
dec dword [ebp - 0x14]
jne 0x406354
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
jbe 0x4063ce
lea eax, [ebp - 0x114c]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push dword [eax]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x4063b8
inc dword [ebp - 0xc]
add dword [ebp - 0x14], 4
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jb 0x406388
jmp 0x4063ce
push edi
call fcn.0040dad4
pop ecx
jmp 0x40648d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x114c]
lea eax, [ebp + eax*4 - 0x114c]
mov dword [ebp - 4], ecx
mov dword [eax], esi
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], esi
push eax
push 0x2001f
push esi
push ebx
push edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40643d
cmp dword [ebp - 4], esi
je 0x40641e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406415
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call fcn.0040dad4
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0x2001f
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406442
or eax, 0xffffffff
jmp 0x406498
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x40648d
lea edi, [ebp - 0x114c]
mov dword [ebp + 8], eax
mov ebx, dword [edi]
cmp ebx, esi
je 0x406485
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push esi
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40647c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0040dad4
pop ecx
mov dword [edi], esi
add edi, 4
dec dword [ebp + 8]
jne 0x406452
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret