Function at 0x40a863
Capabilities:
Delete registry value

Disassembly:
push 0x330
mov eax, 0x4ad09c
call fcn.0048f48f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x33c]
mov dword [ebp - 0x320], eax
call fcn.0042f326
mov dword [ebp - 4], ebx
call fcn.004113cf
mov ecx, dword [0x507340]
test al, al
jne 0x40a8a5
dec ecx
mov dword [0x507340], ecx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x324], ebx
lea eax, [ecx + 1]
imul eax, ecx
push 0xb
cdq
pop edi
idiv edi
mov byte [ebp - 4], 1
cmp edx, 7
jne 0x40a8e9
mov edx, ebx
mov eax, dword [ebp + edx*4 - 0x2c4]
imul eax, eax, 0x3f
add ecx, eax
inc edx
cmp edx, 0x2a0
jb 0x40a8ce
mov dword [0x507340], ecx
push str.success
lea ecx, [ebp - 0x24]
call fcn.0042f2f7
lea eax, [ebp - 0x24]
push eax
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 2
call fcn.0042f5f2
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.0042f451
mov edi, 0x505ab0
push edi
lea ecx, [ebp - 0x31c]
call fcn.00408fd9
push edi
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 3
call fcn.00408fd9
push edi
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], 4
call fcn.00408fd9
push str.success
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.0042f2f7
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 7
call fcn.0042f5f2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.0042f451
push str.hive
mov ecx, esi
call fcn.0042f676
sub esp, 0x18
mov ecx, eax
push esp
call fcn.0042fc5e
lea eax, [ebp - 0x300]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 8
call fcn.00402394
mov ecx, dword [ebp - 0x300]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.00407864
mov eax, dword [ebp - 0x31c]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
mov dword [ebp - 0x318], eax
call fcn.00403b5b
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.0040fb03
mov edi, eax
pop ecx
mov dword [ebp - 0x30c], edi
test edi, edi
jne 0x40aac7
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x308]
push str.deleteRegElement_hive_error_
push eax
call fcn.00409288
add esp, 0xc
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x2dc]
push eax
mov byte [ebp - 4], 9
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call fcn.0042f275
push 0xb
pop eax
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], al
call fcn.0042f5f2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call fcn.0042f451
lea ecx, [ebp - 0x2dc]
call fcn.00401056
mov ecx, dword [ebp - 0x308]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x314]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x304]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x318]
call fcn.00407864
push 0x12
pop esi
push 8
mov byte [ebp - 4], 1
pop edi
jmp 0x40b139
push 0x4c1028
mov ecx, esi
call fcn.0042f676
sub esp, 0x18
mov ecx, eax
push esp
call fcn.0042fc5e
lea eax, [ebp - 0x300]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0xc
call fcn.00402394
mov eax, dword [ebp - 0x300]
mov byte [ebp - 4], 6
lea ecx, [eax - 0x10]
call fcn.00407864
push 0x4c10e0
mov ecx, esi
call fcn.00430238
test al, al
je 0x40ab67
push 0x4c10e0
mov ecx, esi
call fcn.0042f676
sub esp, 0x18
mov ecx, eax
push esp
call fcn.0042fc5e
lea eax, [ebp - 0x300]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], 0xd
call fcn.00402394
mov ecx, dword [ebp - 0x300]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00407864
push 0xf023f
mov byte [ebp - 0x30d], bl
mov ebx, dword [ebp - 0x304]
push ebx
push edi
lea ecx, [ebp - 0x32c]
call fcn.004097e1
test eax, eax
je 0x40ac7e
push 0xf013f
push ebx
push edi
lea ecx, [ebp - 0x32c]
mov byte [ebp - 0x30d], 1
call fcn.004097e1
test eax, eax
je 0x40ac7e
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.0042c341
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x308]
push str.deleteRegElement_Open_
push eax
mov byte [ebp - 4], 0xe
call fcn.00409288
add esp, 0xc
mov ecx, dword [ebp - 0x300]
mov byte [ebp - 4], 0x10
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x11
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x12
call fcn.0042f5f2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x11
call fcn.0042f451
lea ecx, [ebp - 0x2dc]
call fcn.00401056
mov ecx, dword [ebp - 0x308]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x314]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x318]
call fcn.00407864
mov byte [ebp - 4], 1
push 0x12
pop esi
push 8
pop edi
jmp 0x40b137
mov esi, dword [ebp - 0x314]
cmp dword [esi - 0xc], 0
jne 0x40af4e
mov eax, dword [0x507340]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x40aca6
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 7
jne 0x40ace4
mov esi, str.JcS1kCmcjN
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x20]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0048ec80
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048dbeb
pop ecx
pop ecx
push eax
call fcn.0048fbd7
mov esi, dword [ebp - 0x314]
pop ecx
lea ecx, [ebp - 0x32c]
call fcn.004093e4
mov eax, dword [ebx - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x304]
call fcn.00409650
movzx eax, ax
push 0x5c
pop ecx
cmp ax, cx
jne 0x40ad2f
mov edi, dword [ebx - 0xc]
dec edi
push edi
lea ecx, [ebp - 0x304]
call fcn.00406eed
push edi
lea ecx, [ebp - 0x304]
call fcn.00407b9a
mov ebx, dword [ebp - 0x304]
push 0x5c
pop ecx
mov edi, dword [ebx - 0xc]
push ecx
push ebx
call fcn.004919b3
pop ecx
pop ecx
test eax, eax
jne 0x40ad44
or eax, 0xffffffff
jmp 0x40ad48
sub eax, ebx
sar eax, 1
sub edi, eax
dec edi
push edi
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x304]
call fcn.00409a87
push 0x5c
push ebx
mov byte [ebp - 4], 0x13
call fcn.004919b3
pop ecx
pop ecx
test eax, eax
jne 0x40ad75
or eax, 0xffffffff
jmp 0x40ad79
sub eax, ebx
sar eax, 1
push eax
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x304]
call fcn.004096ca
push eax
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0x14
call fcn.00402394
mov ecx, dword [ebp - 0x300]
mov byte [ebp - 4], 0x13
lea ecx, [ecx - 0x10]
call fcn.00407864
cmp byte [ebp - 0x30d], 0
mov ebx, dword [ebp - 0x304]
mov ecx, 0x100
mov eax, 0x200
cmovne eax, ecx
or eax, 0xf003f
push eax
push ebx
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x32c]
call fcn.004097e1
test eax, eax
je 0x40ae9e
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0042c341
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x300]
push str.deleteRegElement_Open_sub_
push eax
mov byte [ebp - 4], 0x15
call fcn.00409288
add esp, 0xc
mov ecx, dword [ebp - 0x30c]
mov byte [ebp - 4], 0x17
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x18
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x19
call fcn.0042f5f2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.0042f4ab
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x24]
call fcn.0042f451
lea ecx, [ebp - 0x2dc]
call fcn.00401056
mov ecx, dword [ebp - 0x300]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x308]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [esi - 0x10]
jmp 0x40ac57
push dword [ebp - 0x308]
lea ecx, [ebp - 0x32c]
call fcn.004098f0
test eax, eax
je 0x40af3b
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0042c341
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x300]
push str.deleteRegElement_RecurseDeleteKey_
push eax
mov byte [ebp - 4], 0x1a
call fcn.00409288
add esp, 0xc
mov ecx, dword [ebp - 0x30c]
mov byte [ebp - 4], 0x1c
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1d
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x1e
call fcn.0042f5f2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.0042f4ab
mov byte [ebp - 4], 0x1d
jmp 0x40ae67
mov ecx, dword [ebp - 0x308]
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x40b051
call fcn.004111af
test al, al
jne 0x40af77
push 5
pop eax
mov edi, 0x96
test edi, edi
je 0x40af70
cdq
idiv edi
mov ecx, edi
mov eax, ecx
mov edi, edx
test ecx, ecx
jne 0x40af5f
add eax, edi
mov dword [0x507340], eax
push esi
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40b029
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0042c341
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x300]
push str.deleteRegElement_DeleteValue_
push eax
mov byte [ebp - 4], 0x1f
call fcn.00409288
add esp, 0xc
mov ecx, dword [ebp - 0x30c]
mov byte [ebp - 4], 0x21
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x22
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x23
call fcn.0042f5f2
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x22
call fcn.0042f451
lea ecx, [ebp - 0x2dc]
call fcn.00401056
mov ecx, dword [ebp - 0x300]
jmp 0x40ae8e
call fcn.0041138b
test al, al
jne 0x40b051
mov eax, dword [0x507340]
xor edi, edi
test eax, eax
je 0x40b04b
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add edi, ecx
sar eax, 1
jne 0x40b03d
mov dword [0x507340], edi
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 5
call fcn.00407864
lea ecx, [ebx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x318]
mov byte [ebp - 4], 1
call fcn.00407864
jmp 0x40ac73
xor ebx, ebx
call fcn.004111f5
test al, al
jne 0x40b157
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ebp - 0x32c]
call fcn.004093e4
mov ecx, dword [0x507340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
cmp edx, edi
jne 0x40b1a9
mov esi, str.aqMF63aqKoO
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0048ec80
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048dbeb
push eax
call fcn.0048fbd7
add esp, 0xc
push 8
pop edi
lea ecx, [ebp - 0x2fc]
call fcn.00430a82
push 0x505ab0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x28
call fcn.00408fd9
mov byte [ebp - 4], 0x29
call fcn.004114af
test al, al
jne 0x40b1e6
push 0x25
push 0x24
push str._d__d_n
call fcn.0049172d
add esp, 0xc
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.00432bf9
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x2a
jb 0x40b20b
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401027
lea eax, [ebp - 0x30c]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x2b
call fcn.00402394
mov ecx, dword [ebp - 0x30c]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x29
call fcn.00401056
mov eax, dword [ebp - 0x320]
mov esi, dword [ebp - 0x300]
mov word [eax], di
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x40b274
call fcn.00409bd9
mov ecx, dword [ebp - 0x320]
push 0xd
mov dword [ecx + 8], eax
mov edi, dword [0x507340]
lea ecx, [edi + 1]
lea eax, [edi + 2]
imul eax, ecx
imul eax, edi
cdq
pop ecx
idiv ecx
cmp edx, 0xc
jne 0x40b2d1
mov eax, edi
push 0x50
pop ecx
cdq
mov dword [ebp - 0x300], ecx
idiv ecx
add ecx, 0x41
jmp 0x40b2c7
mov eax, edi
or eax, 0xffffffa6
add edi, eax
mov eax, edi
imul eax, edi
inc ebx
cmp ebx, eax
jg 0x40b2cb
mov eax, edi
cdq
idiv dword [ebp - 0x300]
cmp edx, ecx
jne 0x40b2ad
mov dword [0x507340], ebx
lea ecx, [esi - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 1
call fcn.004090f2
lea ecx, [ebp - 0x32c]
call fcn.004093e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.0042f451
call fcn.0048f3e1
ret