Function at 0x406642
Capabilities:
Delete registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41b0d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x433028]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [0x4349bb]
xor ebx, ebx
cmp al, bl
jne 0x406689
mov ecx, dword [sym.imp.pcoshelper.dll_Ordinal_1261]
cmp byte [ecx], bl
jne 0x406689
xor cl, cl
jmp 0x40668b
mov cl, 1
mov byte [0x433df5], cl
mov byte [0x4349b9], bl
mov byte [0x4349ba], bl
mov byte [0x4349b8], 1
mov edi, 0x4263a8
cmp al, bl
je 0x4066e8
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push edi
call dword [0x424498]
push 0xffffffffffffffff
push 1
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push edi
mov dword [esp + 0x78], ebx
call dword [0x424498]
or dword [esp + 0x74], 0xffffffff
push 5
push dword [0x4349b0]
call fcn.00416d3e
push ebx
push ebx
push 0x402
push dword [esi + 0x408]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x4349bb], bl
je 0x40671b
mov eax, dword [0x433df8]
cmp byte [eax + 0xff1], bl
je 0x40671b
push eax
call fcn.00411e3c
jmp 0x406bb7
lea ecx, [esp + 0x1c]
mov dword [0x433dc8], ebx
mov dword [0x433dcc], ebx
mov dword [esi + 0x2a8], ebx
call dword [0x424328]
push edi
push str.SCANTAB2ERRCOUNT
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x434888
mov dword [esp + 0x5c], 1
call dword [sym.imp.pcoshelper.dll_Ordinal_727]
mov byte [esp + 0x50], 2
push dword [esi + 0x2a8]
mov eax, dword [eax]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
lea ecx, [esp + 0x24]
mov byte [esp + 0x50], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push dword [esp + 0x1c]
lea ecx, [esi + 0x5e0]
call sub.mfc90u.dll_CWnd::SetWindowTextW
mov eax, dword [0x433df8]
mov dword [esi + 0x2ac], ebx
mov ecx, dword [eax + 0xec4]
mov ecx, dword [ecx + 0xda4]
mov dword [esp + 0x24], ecx
cmp byte [0x4349bb], bl
je 0x4067c5
cmp byte [eax + 0xff1], bl
je 0x4067c5
push eax
call fcn.00411e3c
jmp 0x406bad
push ebx
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.0040d74d
mov byte [esp + 0x50], 3
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
jne 0x406916
cmp byte [0x4349bb], bl
jne 0x4068b7
mov eax, dword [sym.imp.pcoshelper.dll_Ordinal_1261]
cmp byte [eax], bl
jne 0x4068b7
push edi
push str.SCANTAB_SELECT_DRIVES
lea eax, [esp + 0x38]
push eax
mov ecx, 0x434888
call dword [sym.imp.pcoshelper.dll_Ordinal_727]
push ebx
mov byte [esp + 0x54], 5
mov eax, dword [eax]
push 0x10
push eax
call sub.mfc90u.dll_AfxMessageBox
lea ecx, [esp + 0x30]
mov byte [esp + 0x50], 3
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [0x433df8]
xor esi, esi
inc esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.pcoshelper.dll_Ordinal_383]
mov ecx, dword [0x433df8]
call dword [sym.imp.pcoshelper.dll_Ordinal_379]
mov eax, dword [0x433df8]
mov ecx, dword [eax + 0xea4]
push esi
push esi
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.pcoshelper.dll_Ordinal_381]
mov eax, dword [0x433df8]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push 0x4ec
mov edi, 0x111
push edi
push dword [eax + 0x20]
call esi
mov eax, dword [0x433df8]
mov eax, dword [eax + 0xec4]
push ebx
push 0x4af
push edi
push dword [eax + 0x20]
call esi
mov eax, dword [0x433df8]
mov eax, dword [eax + 0xec4]
mov ecx, dword [eax + 0xda4]
call sub.mfc90u.dll_CWnd::SetFocus
jmp 0x406ba3
mov eax, dword [0x433df8]
mov eax, dword [eax + 0xec4]
mov ecx, dword [eax + 0xda4]
call fcn.0040d182
push 1
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x2c]
call fcn.0040d74d
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 4
call dword [0x424334]
lea ecx, [esp + 0x34]
mov byte [esp + 0x50], 3
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
jne 0x406963
push dword [esi + 0x2a8]
call fcn.00411442
pop ecx
jmp 0x406ba3
cmp byte [0x4349bb], bl
jne 0x406928
mov ecx, dword [sym.imp.pcoshelper.dll_Ordinal_1261]
cmp byte [ecx], bl
je 0x406984
mov eax, dword [0x433df8]
mov eax, dword [eax + 0xec4]
mov ecx, dword [eax + 0xda4]
call fcn.0040d182
push ebx
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x2c]
call fcn.0040d74d
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 6
call dword [0x424334]
lea ecx, [esp + 0x38]
jmp 0x4068f1
cmp byte [0x4349bb], bl
je 0x406984
mov ecx, dword [0x433df8]
cmp byte [ecx + 0xff1], bl
je 0x406984
push ecx
call fcn.00411e3c
jmp 0x406ba3
push eax
mov ecx, esi
call fcn.00406416
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call fcn.00413f23
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push ebx
push str.DirectFastRemove
push str.Removal
mov ecx, 0x434888
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 1
mov byte [esp + 0x22], 1
call sub.mfc90u.dll_CWinApp::GetProfileIntW
test eax, eax
lea eax, [esp + 0x16]
push eax
lea eax, [esp + 0x19]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1f]
push eax
setne byte [esp + 0x27]
call fcn.0040e2ec
cmp byte [0x4349bb], bl
jne 0x406a00
mov eax, dword [sym.imp.pcoshelper.dll_Ordinal_1261]
cmp byte [eax], bl
je 0x406a16
mov byte [esp + 0x17], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], 1
lea ecx, [esp + 0x20]
call dword [0x424328]
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x54], 7
call dword [sym.imp.pcoshelper.dll_Ordinal_1024]
lea ecx, [esp + 0x2c]
mov dword [esp], str.OneClickCure
call dword [0x424498]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
mov byte [esp + 0x54], 8
mov edi, dword [sym.imp.pcoshelper.dll_Ordinal_1048]
push eax
call edi
pop ecx
pop ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 7
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push str.SysClean
lea ecx, [esp + 0x30]
call dword [0x424498]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x58], 9
call edi
pop ecx
pop ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 7
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push dword [esp + 0x20]
push Ordinal_5
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [0x433dfc]
movzx ecx, byte [esp + 0x13]
mov dword [eax + 0xe8], ecx
movzx ecx, byte [esp + 0x14]
mov dword [eax + 0xec], ecx
movzx ecx, byte [esp + 0x15]
mov dword [eax + 0xf8], ecx
movzx ecx, byte [esp + 0x17]
push ebx
push ebx
mov dword [eax + 0x100], ecx
movzx ecx, byte [esp + 0x1e]
push ebx
push ebx
mov dword [eax + 0xf4], ecx
mov ecx, dword [0x433df8]
push ebx
mov dword [eax + 0xf0], ebx
mov dword [eax + 0xfc], ebx
call dword [sym.imp.pcoshelper.dll_Ordinal_328]
mov ecx, dword [0x433df8]
call dword [sym.imp.pcoshelper.dll_Ordinal_324]
mov eax, dword [0x433df8]
mov ecx, dword [eax + 0xea4]
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.pcoshelper.dll_Ordinal_326]
mov eax, dword [0x433df8]
mov ecx, dword [eax + 0xea4]
call dword [sym.imp.pcoshelper.dll_Ordinal_327]
cmp byte [0x4349bb], bl
je 0x406b55
mov eax, dword [0x433df8]
cmp byte [eax + 0xff1], bl
je 0x406b55
push eax
call fcn.00411e3c
jmp 0x406b99
call fcn.00412209
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x400
push 0x6b
push dword [esi + 0x20]
call edi
call fcn.00406bca
cmp byte [0x4349bb], bl
je 0x406b8e
push ebx
push 0x12
push 0x6d
push dword [esi + 0x20]
call edi
push ebx
push 0x1b
push 0x6c
push dword [esi + 0x20]
call edi
lea ecx, [esi + 0x2b0]
call sub.mfc90u.dll_CWnd::SetFocus
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret