Function at 0x4032f0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
push edi
lea edi, [eax + esi]
mov dword [esp + 0x14], edi
cmp esi, edi
jne 0x40330a
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
ja 0x403302
cmp byte [edi - 1], 0
jne 0x403302
push ebx
push 0x2000
call fcn.0046e254
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x403331
pop ebx
pop edi
pop esi
add esp, 0x18
ret
mov dword [esp + 0xc], 0
cmp esi, edi
jae 0x4036fd
push ebp
mov al, byte [esi]
test al, al
je 0x4036fc
lea esp, [esp]
cmp al, 0xd
je 0x403360
cmp al, 0xa
je 0x403360
cmp al, 0x20
je 0x403360
cmp al, 9
jne 0x40337d
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403350
pop ebp
push ebx
call fcn.0046e0df
mov eax, dword [esp + 0x10]
add esp, 4
pop ebx
pop edi
pop esi
add esp, 0x18
ret
mov al, byte [esi]
test al, al
je 0x4036fc
cmp al, 0x5b
jne 0x4036fc
inc esi
cmp dword [esi], 0x4d4c4b48
je 0x40341d
push 0x12
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
je 0x40341d
cmp dword [esi], 0x52434b48
je 0x403416
push 0x11
push str.HKEY_CLASSES_ROOT
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
je 0x403416
cmp dword [esi], 0x55434b48
je 0x40340f
push 0x11
push str.HKEY_CURRENT_USER
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
je 0x40340f
cmp dword [esi], 0x52535548
je 0x403408
push 0xa
push str.HKEY_USERS
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
jne 0x4036fc
mov ebp, VariantInit
jmp 0x403422
mov ebp, SysReAllocString
jmp 0x403422
mov ebp, SysReAllocString
jmp 0x403422
mov ebp, reloc.OLEAUT32.dll_SysReAllocString
push 0x5c
push esi
call fcn.0046fa00
mov edi, eax
add esp, 8
test edi, edi
je 0x4036fc
inc edi
push 0x5d
push edi
call fcn.0046fa00
mov esi, eax
add esp, 8
test esi, esi
je 0x4036fc
inc esi
mov ecx, esi
sub ecx, edi
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movzx eax, word [esi]
mov edx, 0xd0a
cmp ax, dx
je 0x403483
mov ecx, 0xa0d
cmp ax, cx
je 0x403483
mov al, byte [esi]
cmp al, 0xd
je 0x403480
cmp al, 0xa
jne 0x4036fc
inc esi
jmp 0x403486
add esi, 2
push ebx
push ebp
call fcn.0046a6b0
mov ebp, eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebp, ebp
je 0x4036fc
mov dword [esp + 0x10], 1
lea esp, [esp]
cmp esi, dword [esp + 0x1c]
jae 0x4036eb
movzx eax, word [esi]
mov edx, 0xa0d
cmp ax, dx
je 0x4036eb
mov ecx, 0x3d40
cmp ax, cx
jne 0x4034e3
push 0x4946fa
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x403515
cmp byte [esi], 0x22
jne 0x4036e3
inc esi
push 0x494d4c
push esi
mov edi, esi
call fcn.0046e7b0
mov esi, eax
add esp, 8
test esi, esi
je 0x4036eb
mov edx, esi
sub edx, edi
inc edx
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, 2
cmp byte [esi], 0x22
jne 0x40355e
inc esi
push 0x22
push esi
mov edi, esi
call fcn.0046fa00
mov esi, eax
add esp, 8
test esi, esi
je 0x4036e3
sub eax, edi
inc eax
push eax
push edi
lea edi, [ebx + 0x1000]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
push ebx
push ebp
call fcn.0046a840
cmp eax, 1
jne 0x4036e3
inc esi
jmp 0x4036a0
push 6
push str.dword:
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
jne 0x4035a2
lea ecx, [esp + 0x20]
push ecx
add esi, 6
push 0x4948fc
push esi
call fcn.0046e065
mov edx, dword [esp + 0x2c]
add esp, 0xc
push edx
push ebx
push ebp
call fcn.0046a870
cmp eax, 1
jne 0x4036e3
jmp 0x4036a0
push 8
push str.MultString
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
je 0x4036a0
push 4
push str.hex_
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
je 0x4036a0
push 4
push str.hex:
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
jne 0x403684
push 0xd
push esi
lea edi, [esi + 4]
call fcn.0046fa00
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4036df
mov ecx, ebp
sub ecx, esi
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
cmp ecx, 0xfa0
jg 0x4036df
xor ebx, ebx
cmp edi, ebp
jae 0x40365b
jmp 0x403630
lea edx, [esp + 0x24]
push edx
push str._02X
push edi
call fcn.0046e065
mov eax, dword [esp + 0x20]
mov cl, byte [esp + 0x30]
add eax, 0x1000
mov byte [ebx + eax], cl
add edi, 3
add esp, 0xc
inc ebx
cmp edi, ebp
jb 0x403630
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
push ebx
add eax, 0x1000
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.0046a8f0
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp eax, 1
jne 0x4036e3
jmp 0x4036a0
push 4
push str.dele
push esi
call fcn.0047220e
add esp, 0xc
test eax, eax
jne 0x4036e3
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0xd
push esi
call fcn.0046fa00
add esp, 8
test eax, eax
jne 0x4036be
push 0xa
push esi
call fcn.0046fa00
add esp, 8
test eax, eax
je 0x4036e3
mov cl, byte [eax + 1]
inc eax
cmp cl, 0xd
je 0x4036cc
cmp cl, 0xa
jne 0x4036cd
inc eax
mov ecx, 0xa0d
mov esi, eax
cmp word [eax], cx
jne 0x4034b0
jmp 0x4036eb
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, dword [esp + 0x1c]
jb 0x403342
pop ebp
push ebx
call fcn.0046e0df
mov eax, dword [esp + 0x10]
add esp, 4
pop ebx
pop edi
pop esi
add esp, 0x18
ret