Function at 0x401470
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x558
lea eax, [esp + 0x533]
call fcn.00409d90
lea eax, [esp + 0x40c]
mov edx, str.6ZCFy9_exc_Sz8mEyMve
call fcn.004224a0
mov edx, eax
lea eax, [esp + 0x543]
call fcn.00401bc0
movzx edi, byte [esp + 0x54c]
movzx esi, byte [esp + 0x54d]
movzx ebp, byte [esp + 0x54e]
movzx ebx, byte [esp + 0x54f]
movzx ecx, byte [esp + 0x550]
movzx edx, byte [esp + 0x551]
movzx eax, byte [esp + 0x552]
push eax
push edx
push ecx
push ebx
push ebp
push esi
push edi
movzx eax, byte [esp + 0x567]
push eax
movzx edx, byte [esp + 0x56a]
push edx
movzx ecx, byte [esp + 0x56d]
push ecx
movzx ebx, byte [esp + 0x570]
push ebx
movzx ebp, byte [esp + 0x573]
push ebp
movzx esi, byte [esp + 0x576]
push esi
movzx edi, byte [esp + 0x579]
push edi
movzx eax, byte [esp + 0x57c]
push eax
movzx edx, byte [esp + 0x57f]
push edx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea ecx, [esp + 0x550]
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea eax, [esp + 0x40c]
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxPLt64EmtnU
call fcn.004224a0
lea ebx, [esp + 0x48c]
lea edx, [esp + 0x50c]
push edx
push eax
push ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
call fcn.00422e10
test eax, eax
je 0x40158b
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, ebx
call fcn.004018d0
lea ebp, [esp + 0x20c]
mov esi, ebp
push 0x5428fc
push ebx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov edi, eax
test edi, edi
je 0x4015cd
sub edi, ebx
push edi
push ebx
push ebp
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add ebp, edi
push ebp
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea ebx, [edi + ebx + 1]
jmp 0x401594
mov edx, ebx
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x4015f3
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push ebx
push ebp
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0xf013f
mov ecx, 0xf003f
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x554]
push eax
push ecx
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4016e2
lea ebp, [esp + 0xc]
xor edi, edi
push 0x200
push ebp
push edi
push dword [esp + 0x560]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
cmp ebx, 0x103
je 0x40167a
test ebx, ebx
jne 0x401674
mov eax, dword [esp + 0x554]
mov edx, ebp
mov ecx, 1
call fcn.00401710
mov ebx, eax
test ebx, ebx
jl 0x40167a
inc edi
cmp edi, 0x64
jl 0x401639
push dword [esp + 0x554]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jl 0x4016e2
call fcn.00401b70
test eax, eax
je 0x4016d6
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RegDeleteKeyEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x4016ed
call fcn.00401b70
push 0
mov edx, 0x100
test eax, eax
cmovne eax, edx
push eax
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
add esp, 0x558
pop ebx
pop ebp
pop esi
pop edi
ret
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0x558
pop ebx
pop ebp
pop esi
pop edi
ret
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0x558
pop ebx
pop ebp
pop esi
pop edi
ret