Function at 0x402d80
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x208
mov eax, dword [0x408270]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x20c]
push esi
push edi
push eax
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcschr]
lea edx, [esp + 0x20]
push 0x5c
push edx
mov esi, eax
call dword [sym.imp.MSVCR80.dll_wcsrchr]
mov edi, eax
mov word [esi], 0
add esp, 0x1c
mov word [edi], 0
add esi, 2
add edi, 2
mov ecx, str.HKCR
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402e0e
test dx, dx
je 0x402e0a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402e0e
add eax, 4
add ecx, 4
test dx, dx
jne 0x402de8
xor eax, eax
jmp 0x402e13
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402e21
mov eax, 0x80000000
jmp 0x402f66
mov ecx, str.HKCU
lea eax, [esp + 0xc]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402e56
test dx, dx
je 0x402e52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402e56
add eax, 4
add ecx, 4
test dx, dx
jne 0x402e30
xor eax, eax
jmp 0x402e5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402e69
mov eax, 0x80000001
jmp 0x402f66
mov ecx, str.HKLM
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402e98
test dx, dx
je 0x402e94
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402e98
add eax, 4
add ecx, 4
test dx, dx
jne 0x402e72
xor eax, eax
jmp 0x402e9d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402eab
mov eax, 0x80000002
jmp 0x402f66
mov ecx, 0x4061a4
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402eda
test dx, dx
je 0x402ed6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402eda
add eax, 4
add ecx, 4
test dx, dx
jne 0x402eb4
xor eax, eax
jmp 0x402edf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402eea
mov eax, 0x80000003
jmp 0x402f66
mov ecx, str.HKCC
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402f19
test dx, dx
je 0x402f15
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402f19
add eax, 4
add ecx, 4
test dx, dx
jne 0x402ef3
xor eax, eax
jmp 0x402f1e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402f29
mov eax, 0x80000005
jmp 0x402f66
mov ecx, str.HKDD
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402f58
test dx, dx
je 0x402f54
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402f58
add eax, 4
add ecx, 4
test dx, dx
jne 0x402f32
xor eax, eax
jmp 0x402f5d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402f99
mov eax, 0x80000006
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402f99
mov edx, dword [esp + 8]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x402fb2
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.00404656
add esp, 0x208
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00404656
add esp, 0x208
ret