Function at 0x40f6ec
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1bc]
sub esp, 0x23c
mov eax, dword [0x49a2a0]
xor eax, ebp
mov dword [ebp + 0x1b8], eax
mov eax, dword [ebp + 0x1c8]
push ebx
push esi
mov esi, dword [ebp + 0x1cc]
push edi
mov edi, dword [ebp + 0x1c4]
push str.RegDeleteKeyExA
push str.ADVAPI32.DLL
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x50], 0x2001f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
call fcn.0040f6b3
test eax, eax
je 0x40f756
mov dword [ebp - 0x50], 0x2011f
push 0x47c228
push 0x49bf70
call fcn.0045cde0
inc dword [esi]
pop ecx
pop ecx
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x50]
xor ebx, ebx
push ebx
push dword [ebp - 0x4c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f8ee
push dword [ebp - 0x4c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x54], ebx
je 0x40f79f
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push edi
call dword [ebp - 0x54]
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40f8d0
mov eax, dword [ebp - 0x68]
dec eax
cmp eax, ebx
mov dword [ebp - 0x5c], eax
jl 0x40f8c7
mov esi, 0xff
push esi
lea eax, [ebp - 0x47]
push ebx
push eax
mov byte [ebp - 0x48], bl
call fcn.0045cd40
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
lea eax, [ebp + 0xb9]
push ebx
push eax
mov byte [ebp + 0xb8], bl
call fcn.0045cd40
push dword [ebp - 0x4c]
lea eax, [ebp + 0xb8]
push eax
call fcn.0045cdd0
lea eax, [ebp + 0xb8]
push 0x478b28
push eax
call fcn.0045cde0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0xb8]
push eax
call fcn.0045cde0
add esp, 0x24
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x50]
lea eax, [ebp + 0xb8]
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f8ad
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40f8ad
cmp dword [ebp - 0x6c], ebx
je 0x40f8a4
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x70]
lea eax, [ebp + 0xb8]
push eax
push edi
call fcn.0040f6ec
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xb8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [ebp - 0x5c]
jns 0x40f7de
mov esi, dword [ebp - 0x60]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], ebx
jne 0x40f8ee
push dword [ebp - 0x4c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x54], ebx
je 0x40f8ee
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push edi
call dword [ebp - 0x54]
mov ecx, dword [ebp + 0x1b8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0045cdba
add ebp, 0x1bc
leave
ret 0xc