Function at 0x4035ac
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x220c]
mov eax, 0x220c
call fcn.00407360
push 0xffffffffffffffff
push 0x40896b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x412014]
xor eax, ebp
mov dword [ebp + 0x2208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x2218]
mov edi, dword [ebp + 0x2214]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b28
jmp 0x403add
push 0x40aecc
push edi
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x40ae78
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403657
test ebx, ebx
je 0x4036eb
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
xor esi, esi
cmp dword [ebp + 0x221c], esi
je 0x4036ed
push 0x5c
push edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
call fcn.00403ddb
pop ecx
pop ecx
test eax, eax
jne 0x403b15
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00402907
test eax, eax
je 0x4036b1
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
call fcn.004030ca
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
test ebx, ebx
je 0x4036e6
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edi
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
push edi
mov ecx, ebx
call fcn.00403d46
mov esi, eax
test esi, esi
js 0x403b1a
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x4038f1
mov dword [ebp - 0x34], esi
jmp 0x4036ed
xor esi, esi
push 0x40aea4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x10]
test eax, eax
jne 0x403715
push edi
mov ecx, ebx
mov dword [ebp - 0x14], esi
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
push 0x40ae5c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403820
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
push edi
mov ecx, ebx
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x403b15
cmp dword [ebp + 0x221c], 0
je 0x4037a7
mov eax, dword [ebp - 0x18]
mov ecx, ebx
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp]
push edi
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
call fcn.00402441
mov esi, eax
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
test esi, esi
js 0x403b1a
mov byte [ebp - 4], al
mov dword [ebp - 0x4c], eax
jmp 0x4038f1
cmp dword [ebp + 0x2220], 0
jne 0x403809
cmp dword [ebp - 0x14], 0
je 0x403809
xor esi, esi
lea ecx, [ebp - 0x44]
push 0x20006
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
call fcn.00402e16
test eax, eax
jne 0x403afb
mov ebx, dword [ebp - 0x44]
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4037f5
cmp eax, 2
jne 0x403aeb
test ebx, ebx
je 0x403803
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], esi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x40], esi
push edi
mov ecx, ebx
call fcn.00403d46
mov esi, eax
test esi, esi
js 0x403b1a
jmp 0x403add
push 0x5c
push edi
call fcn.00403ddb
pop ecx
pop ecx
test eax, eax
jne 0x403b15
cmp dword [ebp + 0x221c], eax
je 0x403946
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
push 0x2001f
push edi
push esi
call fcn.00402e16
test eax, eax
je 0x4038be
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x24]
call fcn.00402e16
test eax, eax
je 0x4038be
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x54]
push eax
xor edx, edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edx
push eax
push edx
push 0x2001f
push edx
push edx
push edx
push edi
push esi
test ecx, ecx
je 0x40388d
call fcn.004031d6
jmp 0x403893
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403a32
xor esi, esi
mov eax, esi
cmp dword [ebp - 0x24], eax
je 0x4038ad
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], esi
test eax, eax
jne 0x403a32
push edi
mov ecx, ebx
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
push 0x3d
pop eax
cmp word [edi], ax
jne 0x4038f1
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402441
mov esi, eax
test esi, esi
js 0x403b1a
push 0x7b
pop eax
cmp word [edi], ax
jne 0x403add
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x58]
jne 0x403902
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x403add
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x221c]
push dword [ebp - 0x24]
push edi
call fcn.004035ac
mov esi, eax
test esi, esi
js 0x403b1a
push edi
mov ecx, ebx
call fcn.00402cf7
jmp 0x403811
cmp dword [ebp + 0x2220], 0
jne 0x403962
push 0x20019
push edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00402e16
jmp 0x403965
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x28], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push edi
cmove ecx, dword [ebp + 0x2220]
lea eax, [ebp + 0x2000]
push 0x104
push eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push eax
call fcn.00402889
add esp, 0x14
mov ecx, ebx
push edi
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
push edi
mov ecx, ebx
call fcn.00403d46
mov esi, eax
test esi, esi
js 0x403b1a
push 0x7b
pop eax
cmp word [edi], ax
jne 0x403a12
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4039c8
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x403a12
push dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x24]
push ebx
push edi
call fcn.004035ac
mov esi, eax
test esi, esi
jns 0x4039fd
cmp dword [ebp - 0x2c], 0
je 0x403b1a
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00402cf7
mov esi, eax
test esi, esi
js 0x403b1a
jmp 0x403a15
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp eax, 2
je 0x403add
test eax, eax
je 0x403a40
cmp dword [ebp + 0x2220], 0
jne 0x403add
push eax
call fcn.004028d8
pop ecx
mov esi, eax
jmp 0x403b1a
cmp dword [ebp + 0x2220], 0
je 0x403a80
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.00402c17
test eax, eax
je 0x403a80
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x2000]
push eax
call fcn.00402907
test eax, eax
je 0x403add
cmp dword [ebp - 0x14], 0
je 0x403add
lea eax, [ebp + 0x2000]
push eax
lea ecx, [ebp - 0x24]
call fcn.004030ca
jmp 0x403add
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.00402c17
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x28], ecx
test ebx, ebx
je 0x403aa5
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x403aa7
xor ebx, ebx
mov dword [ebp - 0x20], ebx
test eax, eax
jne 0x403a32
cmp dword [ebp - 0x14], eax
je 0x403add
test ecx, ecx
jne 0x403add
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x2000]
push eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.00402a36
mov dword [ebp - 0x64], ebx
test eax, eax
jne 0x403a32
push 0x7d
pop eax
cmp word [edi], ax
jne 0x403627
jmp 0x403b1a
push eax
call fcn.004028d8
mov esi, eax
pop ecx
test ebx, ebx
je 0x403b1a
push ebx
jmp 0x403b0d
push eax
call fcn.004028d8
cmp dword [ebp - 0x44], 0
mov esi, eax
pop ecx
je 0x403b1a
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403b1a
mov esi, 0x80020009
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x403b28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2208]
xor ecx, ebp
call fcn.0040728f
add ebp, 0x220c
leave
ret 0x10