Function at 0x4038a0
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x41eb6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00417770
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x144], ebx
call fcn.00417770
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
push str.SDD_ERR_LOG
mov dword [esp + 0x2c], eax
call fcn.00408345
add esp, 4
mov dword [esp + 0x144], 1
call fcn.00417770
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x34], ebp
mov edi, dword [esp + 0x14c]
cmp edi, 4
mov byte [esp + 0x144], 2
jge 0x403a1f
push str.unreg_Error:_Not_enough_parameters_on_Command_Line__unregister.exe_input_dll_exe_output_txt_type_from_ini
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0xc
cmp eax, ebx
je 0x403982
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x403982
mov eax, dword [0x42a82c]
push ebx
push str.Error
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4039a8
mov eax, dword [0x42a82c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00401420
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esi], eax
call fcn.00406400
lea eax, [ebp - 0x10]
mov byte [esp + 0x144], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4039ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x144], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4039f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403af0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
jmp 0x403e66
mov esi, dword [esp + 0x150]
mov ecx, dword [esi + 4]
mov edx, 0x42a1b8
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x403a30
mov ecx, dword [esi + 8]
mov edx, 0x42a2c0
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x403a42
mov ecx, dword [esi + 0xc]
mov edx, 0x42a3c8
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x403a54
push 0x42a810
push 0x1001
push 0x42a2c0
mov ecx, 0x42a7fc
call fcn.00417bd2
test eax, eax
jne 0x403afa
push ebx
push ebx
mov ecx, 0x42a810
call fcn.0041769c
lea eax, [ebp - 0x10]
mov byte [esp + 0x144], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403aa9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x144], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403ad2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403af0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
jmp 0x403e66
cmp edi, 5
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
jne 0x403b48
mov ecx, dword [esi + 0x10]
mov edx, 0x42a5d8
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x403b10
push str.DEBUG
push 0x42a5d8
call fcn.0041516e
add esp, 8
test eax, eax
jne 0x403b48
push ebx
push str.DEBUG_Info_Main__
push str.DEBUG_On.
push ebx
mov dword [0x42a7e4], 1
call ebp
push 0x104
push 0x42a0b0
push 0x42a1b8
call dword [sym.imp.comdlg32.dll_GetFileTitleA]
mov eax, 0x42a0b0
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403b64
mov edi, 0x4280b0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403b75
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4280b0
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403b91
mov eax, dword [str.HKCR]
mov cx, word [0x420a00]
mov dword [edi], eax
mov eax, 0x42a0b0
mov word [edi + 4], cx
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403bb2
mov edi, 0x4281b8
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403bc3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4281b8
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403be0
mov edx, dword [str.HKLM]
mov ax, word [0x4209f8]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x4280b0
mov dword [edi], edx
push 0x80000001
mov word [edi + 4], ax
call esi
push 0x4281b8
push 0x80000001
call esi
push str..exe
push 0x42a1b8
call fcn.00408470
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x403c7b
cmp dword [0x42a7e4], ebx
je 0x403c6c
push ebx
push str.DEBUG_Main__:comname
push 0x42a1b8
push ebx
call ebp
push ebx
push str.DEBUG_Main__:pdest
push esi
push ebx
call ebp
push ebx
push str.DEBUG_Main__:exeparm
push 0x42a3c8
push ebx
call ebp
push ebx
push str.DEBUG_Main__
push str.about_to_run_injectexe
push ebx
call ebp
push 0x42a3c8
call fcn.004023d0
add esp, 4
jmp 0x403c80
call fcn.00402b10
mov dword [esp + 0x10], eax
call fcn.00417770
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push str.REGEDIT4
push eax
mov byte [esp + 0x14c], 3
call fcn.00401f40
mov ecx, dword [esp + 0x1c]
add esp, 8
push ecx
mov ecx, 0x42a7fc
call fcn.00417d89
push 0x420888
mov ecx, 0x42a7fc
call fcn.00417d89
push str.Windows_Registry_Editor_Version_5.00_n_n
mov ecx, 0x42a7fc
call fcn.00417d89
mov eax, 0x4281b8
mov byte [esp + 0x38], bl
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403cf0
lea edi, [esp + 0x38]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403d00
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x4281b8
and ecx, 3
push 0x80000001
rep movsb byte es:[edi], byte [esi]
call ebp
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x38]
push ecx
push str.HKEY_LOCAL_MACHINE
push edx
mov dword [0x42a0a8], ebx
call fcn.00403240
mov eax, 0x4280b0
add esp, 0xc
mov byte [esp + 0x38], bl
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403d63
lea edi, [esp + 0x38]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403d73
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x1c]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x4280b0
push 0x80000001
call ebp
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x38]
push edx
push str.HKEY_CLASSES_ROOT
push eax
mov dword [0x42a0a8], ebx
call fcn.00403240
add esp, 0xc
mov ecx, 0x42a7fc
call fcn.00417f55
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x144], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403df5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x144], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x144], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e62
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x138
ret