Function at 0x40c4ed
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
xor esi, esi
mov ebx, 0xf003f
push ebx
push esi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call edi
test eax, eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
jg 0x40c52c
call edi
mov edi, eax
jmp 0x40c53c
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push esi
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
mov edi, 0x403a50
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
test eax, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push edi
push dword [ebp - 8]
jg 0x40c579
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
jmp 0x40c58d
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push ebx
push esi
push esi
push esi
mov edi, 0x403a64
push edi
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
test eax, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push edi
push dword [ebp - 8]
jg 0x40c5da
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
jmp 0x40c5ee
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push ebx
push esi
push esi
push esi
mov edi, 0x403a78
push edi
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
test eax, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push edi
push dword [ebp - 8]
jg 0x40c63b
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
jmp 0x40c64f
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
lea edx, [ebp - 4]
push edx
push esi
push ebx
push esi
push esi
push esi
push ecx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call edi
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push ebx
push esi
push esi
test eax, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push esi
push eax
push dword [ebp - 8]
jg 0x40c6a1
call edi
mov edi, eax
jmp 0x40c6b1
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x34]
lea edx, [ebp - 4]
push edx
push ebx
push esi
push ecx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c733
cmp dword [ebp - 4], esi
je 0x40c733
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi + 0x34]
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
push dword [edi + 0x34]
push dword [ebp - 8]
jg 0x40c714
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, eax
jmp 0x40c728
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x34]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push ebx
push esi
push esi
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [edi + 0x34]
push esi
test eax, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push edi
push dword [ebp - 8]
jg 0x40c769
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
jmp 0x40c77d
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
push esi
push dword [ebp - 4]
mov ebx, 0x4048d8
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call edi
test eax, eax
push esi
push dword [ebp - 4]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
jg 0x40c7bc
call edi
mov edi, eax
jmp 0x40c7cc
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, esi
jl 0x40c809
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040c843
mov edi, eax
cmp edi, esi
jl 0x40c809
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
call edi
test eax, eax
push dword [ebp - 4]
jg 0x40c7f9
call edi
mov edi, eax
jmp 0x40c809
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp dword [ebp - 8], esi
je 0x40c817
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
je 0x40c825
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jge 0x40c83a
mov eax, dword [ebp + 8]
push dword [eax + 8]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4