Function at 0x404d80
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x42af08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x436b90]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
mov ecx, dword [eax + 0x1c]
cmp dword [eax + 0xc], ecx
jle 0x404dcf
test ecx, ecx
jl 0x404dca
cmp ecx, dword [eax + 0xc]
jge 0x404dca
mov edx, dword [eax + 8]
mov ebp, dword [edx + ecx*4]
mov dword [esp + 0x20], ebp
jmp 0x404ddb
call fcn.00411116
mov dword [esp + 0x20], 0
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
push 0
push str.Registry.Values
mov ecx, ebp
call edx
test eax, eax
je 0x405211
call fcn.004111f0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404e0e
push 0x80004005
call fcn.00401160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], 0
call fcn.004111f0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404e40
push 0x80004005
call fcn.00401160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x44], edi
mov byte [esp + 0x3c], 1
call fcn.004111f0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404e6f
push 0x80004005
call fcn.00401160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x3c], 2
mov edx, dword [ebp]
mov edx, dword [edx + 0x60]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
mov dword [esp + 0x1c], 0
call edx
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jg 0x404eaf
mov dword [esp + 0x1c], 0xffffffff
jmp 0x404ed2
push 0x5c
push eax
call fcn.00417dd1
add esp, 8
test eax, eax
jne 0x404ec8
mov dword [esp + 0x1c], 0xffffffff
jmp 0x404ed2
sub eax, dword [esp + 0x14]
sar eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00405920
mov byte [esp + 0x3c], 3
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x404f45
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x404f33
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x404f33
push eax
call fcn.004021a0
mov ebp, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x404f26
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebp + 0x10]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x44], edi
jmp 0x404f45
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x4c]
call fcn.00402290
mov edi, dword [esp + 0x44]
mov byte [esp + 0x3c], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404f6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
mov esi, 0x4380c0
mov eax, dword [esi]
test eax, eax
je 0x404f8f
push eax
push edi
call fcn.00417d40
add esp, 8
test eax, eax
jne 0x404f88
mov ebx, dword [esi + 4]
add esi, 8
test ebx, ebx
je 0x404f71
mov ecx, dword [esp + 0x1c]
add ecx, 1
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x1c]
call fcn.004058f0
mov byte [esp + 0x3c], 4
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x405005
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x404ff3
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x404ff3
push eax
call fcn.004021a0
mov ebp, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x404fe6
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebp + 0x10]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x44], edi
jmp 0x405005
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x4c]
call fcn.00402290
mov edi, dword [esp + 0x44]
mov byte [esp + 0x3c], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40502a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [edi - 4], 1
jle 0x405041
mov ecx, dword [edi - 0xc]
push ecx
lea ecx, [esp + 0x48]
call fcn.004020b0
mov edi, dword [esp + 0x44]
call fcn.004086f0
test edi, edi
jne 0x40504e
xor eax, eax
jmp 0x405068
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405053
sub eax, edx
sar eax, 1
js 0x405227
cmp eax, dword [edi - 8]
jg 0x405227
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push 0
push edi
mov dword [edi - 0xc], eax
push ebx
mov word [edi + eax*2], 0
mov dword [esp + 0x30], 0
call esi
test eax, eax
jne 0x4050b5
lea eax, [esp + 0x18]
test eax, eax
je 0x4050ae
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
jmp 0x405103
mov edx, dword [esp + 0x1c]
push edx
jmp 0x4050fd
cmp dword [0x43ad84], 0
mov eax, 0x100
jne 0x4050c5
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
or eax, 0xf003f
push eax
push 0
push edi
push ebx
mov dword [esp + 0x38], 0
call esi
test eax, eax
jne 0x405191
lea edx, [esp + 0x18]
test edx, edx
je 0x4050f8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
jmp 0x405103
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
cmp word [eax], 0
mov esi, eax
je 0x405121
nop
push eax
call dword [sym.imp.USER32.dll_CharNextW]
cmp word [eax], 0
jne 0x405110
cmp esi, eax
ja 0x405146
movzx ecx, word [eax]
cmp cx, 0x2f
je 0x405146
cmp cx, 0x5c
je 0x405146
cmp cx, 0x3a
je 0x405146
cmp eax, esi
je 0x405155
push eax
push esi
call dword [sym.imp.USER32.dll_CharPrevW]
cmp esi, eax
jbe 0x405121
push eax
call dword [sym.imp.USER32.dll_CharNextW]
test eax, eax
jne 0x405159
xor ecx, ecx
jmp 0x40516f
mov eax, esi
jmp 0x40514d
mov ecx, eax
lea esi, [ecx + 2]
mov edi, edi
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x405160
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00402290
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp]
mov edx, dword [eax + 0x20]
mov ecx, ebp
call edx
test eax, eax
jne 0x404e84
mov byte [esp + 0x3c], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4051c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x3c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4051e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405211
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
push 0x80070057
call fcn.00401160
int3