Function at 0x426910
Capabilities:
Delete directory
Delete file
Delete registry key
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bfa2
mov eax, dword fs:[0]
push eax
sub esp, 0x72c
mov eax, dword [0x43ba24]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x434c60
lea eax, [ebp - 0x124]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov edx, dword [ecx]
mov dword [ebp - 0x188], edx
mov dword [ebp - 0x18c], 0
lea eax, [ebp - 0x18c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x188]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x4269c1
lea ecx, [ebp - 0x10]
call fcn.004021b0
mov dword [ebp - 0x190], eax
mov edx, dword [ebp - 0x18c]
mov dword [ebp - 0x10], edx
xor eax, eax
cmp dword [ebp - 0x190], 0
sete al
mov byte [ebp - 0x11d], al
mov ecx, dword [ebp - 0x124]
sub ecx, 0x10
mov dword [ebp - 0x194], ecx
mov ecx, dword [ebp - 0x194]
call fcn.004017e0
movzx edx, byte [ebp - 0x11d]
test edx, edx
je 0x426a49
push 0x434cc0
lea eax, [ebp - 0x128]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ecx]
mov dword [ebp - 0x19c], edx
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004021f0
mov ecx, dword [ebp - 0x128]
sub ecx, 0x10
mov dword [ebp - 0x2c4], ecx
mov ecx, dword [ebp - 0x2c4]
call fcn.004017e0
mov dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x10], 0
je 0x426a70
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x10], 0
push 0x434cd8
lea eax, [ebp - 0x130]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x2cc], eax
mov ecx, dword [ebp - 0x2cc]
mov edx, dword [ecx]
mov dword [ebp - 0x2d0], edx
mov dword [ebp - 0x2d4], 0
lea eax, [ebp - 0x2d4]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x2d0]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jne 0x426ae8
lea ecx, [ebp - 0x10]
call fcn.004021b0
mov dword [ebp - 0x2d8], eax
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0x10], edx
xor eax, eax
cmp dword [ebp - 0x2d8], 0
sete al
mov byte [ebp - 0x129], al
mov ecx, dword [ebp - 0x130]
sub ecx, 0x10
mov dword [ebp - 0x2dc], ecx
mov ecx, dword [ebp - 0x2dc]
call fcn.004017e0
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x426b70
push 0x434d38
lea eax, [ebp - 0x134]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x2e0], eax
mov ecx, dword [ebp - 0x2e0]
mov edx, dword [ecx]
mov dword [ebp - 0x2e4], edx
mov eax, dword [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x10]
call fcn.004021f0
mov ecx, dword [ebp - 0x134]
sub ecx, 0x10
mov dword [ebp - 0x40c], ecx
mov ecx, dword [ebp - 0x40c]
call fcn.004017e0
mov dword [ebp - 0x410], 0
cmp dword [ebp - 0x10], 0
je 0x426b97
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x10], 0
push 0x434d50
lea eax, [ebp - 0x13c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
mov edx, dword [ecx]
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x418]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x426c0f
lea ecx, [ebp - 0x10]
call fcn.004021b0
mov dword [ebp - 0x420], eax
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x10], edx
xor eax, eax
cmp dword [ebp - 0x420], 0
sete al
mov byte [ebp - 0x135], al
mov ecx, dword [ebp - 0x13c]
sub ecx, 0x10
mov dword [ebp - 0x424], ecx
mov ecx, dword [ebp - 0x424]
call fcn.004017e0
movzx edx, byte [ebp - 0x135]
test edx, edx
je 0x426c97
push 0x434db0
lea eax, [ebp - 0x140]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004021f0
mov ecx, dword [ebp - 0x140]
sub ecx, 0x10
mov dword [ebp - 0x554], ecx
mov ecx, dword [ebp - 0x554]
call fcn.004017e0
mov dword [ebp - 0x558], 0
cmp dword [ebp - 0x10], 0
je 0x426cbe
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x10], 0
push 0x434dc8
lea eax, [ebp - 0x148]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x55c], eax
mov ecx, dword [ebp - 0x55c]
mov edx, dword [ecx]
mov dword [ebp - 0x560], edx
mov dword [ebp - 0x564], 0
lea eax, [ebp - 0x564]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x560]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0
jne 0x426d36
lea ecx, [ebp - 0x10]
call fcn.004021b0
mov dword [ebp - 0x568], eax
mov edx, dword [ebp - 0x564]
mov dword [ebp - 0x10], edx
xor eax, eax
cmp dword [ebp - 0x568], 0
sete al
mov byte [ebp - 0x141], al
mov ecx, dword [ebp - 0x148]
sub ecx, 0x10
mov dword [ebp - 0x56c], ecx
mov ecx, dword [ebp - 0x56c]
call fcn.004017e0
movzx edx, byte [ebp - 0x141]
test edx, edx
je 0x426dbe
push 0x434e28
lea eax, [ebp - 0x14c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x570]
mov edx, dword [ecx]
mov dword [ebp - 0x574], edx
mov eax, dword [ebp - 0x574]
push eax
lea ecx, [ebp - 0x10]
call fcn.004021f0
mov ecx, dword [ebp - 0x14c]
sub ecx, 0x10
mov dword [ebp - 0x69c], ecx
mov ecx, dword [ebp - 0x69c]
call fcn.004017e0
mov dword [ebp - 0x6a0], 0
cmp dword [ebp - 0x10], 0
je 0x426de5
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x10], 0
push 0x434e40
lea eax, [ebp - 0x150]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x6a4], eax
mov ecx, dword [ebp - 0x6a4]
mov edx, dword [ecx]
mov dword [ebp - 0x6a8], edx
mov eax, dword [ebp - 0x6a8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x150]
sub ecx, 0x10
mov dword [ebp - 0x6ac], ecx
mov ecx, dword [ebp - 0x6ac]
call fcn.004017e0
push 0x434ebc
lea edx, [ebp - 0x154]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
mov ecx, dword [eax]
mov dword [ebp - 0x6b4], ecx
mov edx, dword [ebp - 0x6b4]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x154]
sub eax, 0x10
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x6b8]
call fcn.004017e0
push 0x434ee0
lea ecx, [ebp - 0x158]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x6bc], eax
mov edx, dword [ebp - 0x6bc]
mov eax, dword [edx]
mov dword [ebp - 0x6c0], eax
mov ecx, dword [ebp - 0x6c0]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x158]
sub edx, 0x10
mov dword [ebp - 0x6c4], edx
mov ecx, dword [ebp - 0x6c4]
call fcn.004017e0
push 0x434f5c
lea eax, [ebp - 0x15c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x6c8], eax
mov ecx, dword [ebp - 0x6c8]
mov edx, dword [ecx]
mov dword [ebp - 0x6cc], edx
mov eax, dword [ebp - 0x6cc]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x15c]
sub ecx, 0x10
mov dword [ebp - 0x6d0], ecx
mov ecx, dword [ebp - 0x6d0]
call fcn.004017e0
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea edx, [ebp - 0x11b]
push edx
call fcn.0040e9c0
add esp, 0xc
push 0x434f80
lea eax, [ebp - 0x160]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x72c], eax
mov ecx, dword [ebp - 0x72c]
mov edx, dword [ecx]
push edx
push 0x43faa0
push 0x434fa4
lea eax, [ebp - 0x11c]
push eax
call fcn.0040fa55
add esp, 0x10
mov ecx, dword [ebp - 0x160]
sub ecx, 0x10
mov dword [ebp - 0x6d4], ecx
mov ecx, dword [ebp - 0x6d4]
call fcn.004017e0
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x434fac
lea eax, [ebp - 0x164]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x730], eax
mov ecx, dword [ebp - 0x730]
mov edx, dword [ecx]
push edx
push 0x43faa0
push 0x434fc4
lea eax, [ebp - 0x11c]
push eax
call fcn.0040fa55
add esp, 0x10
mov ecx, dword [ebp - 0x164]
sub ecx, 0x10
mov dword [ebp - 0x6d8], ecx
mov ecx, dword [ebp - 0x6d8]
call fcn.004017e0
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x434fcc
lea eax, [ebp - 0x168]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x734], eax
mov ecx, dword [ebp - 0x734]
mov edx, dword [ecx]
push edx
push 0x43faa0
push 0x434fe8
lea eax, [ebp - 0x11c]
push eax
call fcn.0040fa55
add esp, 0x10
lea ecx, [ebp - 0x168]
call fcn.004019a0
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x434ff0
lea edx, [ebp - 0x16c]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x738]
mov ecx, dword [eax]
push ecx
push 0x43faa0
push str._s_s
lea edx, [ebp - 0x11c]
push edx
call fcn.0040fa55
add esp, 0x10
lea ecx, [ebp - 0x16c]
call fcn.004019a0
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x43faa0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x435018
lea ecx, [ebp - 0x174]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x6e4], eax
mov edx, dword [ebp - 0x6e4]
mov eax, dword [edx]
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x6ec], 0
lea ecx, [ebp - 0x6ec]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp - 0x6e8]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0
jne 0x427168
mov dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x10], 0
je 0x427153
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6f4], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x6f4]
mov dword [ebp - 0x6f0], ecx
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0x10], edx
xor eax, eax
cmp dword [ebp - 0x6f0], 0
sete al
mov byte [ebp - 0x16d], al
lea ecx, [ebp - 0x174]
call fcn.004019a0
movzx ecx, byte [ebp - 0x16d]
test ecx, ecx
je 0x4271a3
xor edx, edx
jne 0x427190
push 0x43f974
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x10], 0
je 0x4271ca
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6fc], eax
mov dword [ebp - 0x10], 0
push 0x435078
lea edx, [ebp - 0x17c]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
mov ecx, dword [eax]
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x708], 0
lea edx, [ebp - 0x708]
push edx
push 0x2001f
push 0
mov eax, dword [ebp - 0x704]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
jne 0x427267
mov dword [ebp - 0x710], 0
cmp dword [ebp - 0x10], 0
je 0x427252
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x710]
mov dword [ebp - 0x70c], edx
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x70c], 0
sete cl
mov byte [ebp - 0x175], cl
lea ecx, [ebp - 0x17c]
call fcn.004019a0
movzx edx, byte [ebp - 0x175]
test edx, edx
je 0x4272d7
push 0x43509c
lea eax, [ebp - 0x180]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x718]
mov edx, dword [ecx]
mov dword [ebp - 0x71c], edx
xor eax, eax
jne 0x4272b7
mov ecx, dword [ebp - 0x71c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x180]
call fcn.004019a0
mov dword [ebp - 0x724], 0
cmp dword [ebp - 0x10], 0
je 0x4272fe
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [0x43fcbc]
push ecx
call fcn.0040f988
add esp, 4
mov edx, dword [0x43fdc4]
push edx
call fcn.0040f988
add esp, 4
call fcn.00425eb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]