Function at 0x425c78
Capabilities:
Delete registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1f
push 0
push 0
dec ecx
jne 0x425c80
push ebx
push esi
push edi
mov eax, 0x425ae8
call fcn.00404008
mov esi, dword [0x427504]
mov edi, dword [0x4274f0]
xor eax, eax
push ebp
push 0x4267e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x427604]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x42743c]
mov byte [eax], 0
call fcn.00407d68
mov eax, dword [0x427638]
mov eax, dword [eax]
call fcn.00402e58
push eax
push 0
push 0
call fcn.00404174
mov edx, dword [0x427588]
mov dword [edx], eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x425d02
mov eax, dword [0x427588]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x4274e0]
mov eax, dword [eax]
mov edx, 0x4267fc
call fcn.00402da4
jne 0x425d24
mov eax, dword [0x4274e0]
mov edx, 0x426810
call fcn.00402a38
lea eax, [ebp - 0x40]
call fcn.00424b14
cmp dword [ebp - 0x40], 0
jne 0x425d71
mov bl, 1
mov eax, dword [0x42754c]
cmp byte [eax], 1
jne 0x425d73
mov eax, dword [0x4273fc]
mov eax, dword [eax]
mov edx, dword [0x427570]
or eax, dword [edx]
push eax
mov eax, dword [0x4275d0]
mov eax, dword [eax]
call fcn.00402e58
push eax
mov eax, dword [0x4274f4]
mov eax, dword [eax]
call fcn.00402e58
push eax
push 0
call sub.user32.dll_MessageBoxA
jmp 0x425d73
xor ebx, ebx
mov ecx, dword [edi]
lea eax, [ebp - 0x48]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
mov edx, 0x426838
call fcn.00406ae4
mov edx, dword [ebp - 0x44]
mov eax, 0x429e60
call fcn.00402a38
cmp dword [0x429e60], 0
jne 0x425dfd
mov ecx, dword [edi]
lea eax, [ebp - 0x50]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x4c]
mov edx, 0x42684c
call fcn.00406ae4
mov edx, dword [ebp - 0x4c]
mov eax, 0x429e60
call fcn.00402a38
cmp dword [0x429e60], 0
je 0x425ed8
lea edx, [ebp - 0x54]
mov eax, dword [0x429e60]
call fcn.00424c1c
call fcn.004256d0
call fcn.00424fe4
jmp 0x425ed8
push esi
mov edx, dword [0x429e60]
mov eax, 0x426864
call fcn.00402f98
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x429e60]
call fcn.00402eb4
mov edx, dword [0x429e60]
mov eax, 0x426864
call fcn.00402f98
mov ecx, eax
mov eax, 0x429e60
mov edx, 1
call fcn.00402ef4
mov eax, dword [0x427524]
push eax
mov edx, dword [0x429e60]
mov eax, 0x426864
call fcn.00402f98
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x429e60]
call fcn.00402eb4
mov edx, dword [0x429e60]
mov eax, 0x426864
call fcn.00402f98
mov ecx, eax
mov eax, 0x429e60
mov edx, 1
call fcn.00402ef4
mov eax, dword [0x427598]
push eax
mov edx, dword [0x429e60]
mov eax, 0x426864
call fcn.00402f98
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x429e60]
call fcn.00402eb4
mov edx, dword [0x429e60]
mov eax, 0x426864
call fcn.00402f98
mov ecx, eax
mov eax, 0x429e60
mov edx, 1
call fcn.00402ef4
call fcn.004256d0
mov ecx, dword [edi]
lea eax, [ebp - 0x5c]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov edx, 0x42684c
call fcn.00406ae4
mov edx, dword [ebp - 0x58]
mov eax, 0x429e60
call fcn.00402a38
lea edx, [ebp - 0x60]
mov eax, dword [esi]
call fcn.00405fc0
mov edx, dword [ebp - 0x60]
mov eax, dword [0x427494]
mov ecx, 0x4267fc
call fcn.00402cac
mov eax, dword [0x427630]
cmp byte [eax], 1
jne 0x425f77
lea edx, [ebp - 0x64]
mov eax, dword [esi]
call fcn.004065c0
mov eax, dword [ebp - 0x64]
push eax
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.00401448
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.004065c0
mov edx, dword [ebp - 0x68]
pop eax
call fcn.00402da4
je 0x425f77
mov eax, dword [esi]
call fcn.004056f0
mov eax, dword [0x427550]
mov eax, dword [eax]
call fcn.004056f0
mov eax, dword [0x427494]
mov eax, dword [eax]
call fcn.004056f0
mov eax, dword [0x427488]
cmp byte [eax], 1
jne 0x425fe0
lea edx, [ebp - 0x70]
mov eax, dword [esi]
call fcn.004065c0
mov eax, dword [ebp - 0x70]
push eax
lea edx, [ebp - 0x78]
xor eax, eax
call fcn.00401448
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.004065c0
mov edx, dword [ebp - 0x74]
pop eax
call fcn.00402da4
je 0x425fe0
mov eax, dword [esi]
call fcn.00405598
mov eax, dword [0x427550]
mov eax, dword [eax]
call fcn.00405598
mov eax, dword [0x427494]
mov eax, dword [eax]
call fcn.00405598
lea edx, [ebp - 0x7c]
mov eax, dword [esi]
call fcn.00405fc0
mov eax, dword [ebp - 0x7c]
call fcn.00405598
call fcn.004256d0
lea edx, [ebp - 0x80]
mov eax, dword [esi]
call fcn.004065c0
mov eax, dword [ebp - 0x80]
push eax
lea edx, [ebp - 0x88]
xor eax, eax
call fcn.00401448
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.004065c0
mov edx, dword [ebp - 0x84]
pop eax
call fcn.00402da4
je 0x42616b
mov eax, dword [0x4275e0]
cmp byte [eax], 0
jne 0x42616b
mov eax, dword [0x42760c]
cmp byte [eax], 1
jne 0x42616b
push dword [esi]
push 0x426864
mov eax, dword [0x427524]
push dword [eax]
push 0x426864
mov eax, dword [0x427598]
push dword [eax]
push 0x426864
lea eax, [ebp - 0x90]
mov edx, 6
call fcn.00402d20
mov eax, dword [ebp - 0x90]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00402bd0
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [edi]
lea eax, [ebp - 0x98]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0x98]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0x94]
call fcn.00402bd0
mov edx, dword [ebp - 0x94]
mov ecx, 0x426838
mov eax, 0x80000001
call fcn.00406508
mov eax, dword [0x427588]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4274e4]
cmp byte [eax], 1
jne 0x426134
lea edx, [ebp - 0x9c]
mov eax, 1
call fcn.00401448
mov eax, dword [ebp - 0x9c]
mov edx, 0x426870
call fcn.00402da4
jne 0x426134
push 0x426878
mov dl, 1
mov eax, dword [0x40e8e8]
call fcn.0040e940
push eax
mov eax, dword [esi]
call fcn.00402e58
push eax
mov eax, dword [0x427450]
mov eax, dword [eax]
call fcn.00402e58
mov edx, eax
pop ecx
pop eax
call fcn.0040ec54
push 0x426878
push 0x426878
push 0
mov eax, dword [esi]
call fcn.00402e58
mov ecx, eax
mov edx, 0x42687c
xor eax, eax
call fcn.004064b0
mov eax, dword [0x4274f8]
cmp byte [eax], 1
jne 0x426164
call fcn.004255e8
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x4274e4]
cmp byte [eax], 1
jne 0x4261c6
lea edx, [ebp - 0xa0]
mov eax, 1
call fcn.00401448
mov eax, dword [ebp - 0xa0]
mov edx, 0x426870
call fcn.00402da4
je 0x4261c6
push 0x426878
mov dl, 1
mov eax, dword [0x40e8e8]
call fcn.0040e940
push eax
mov eax, dword [esi]
call fcn.00402e58
push eax
mov eax, dword [0x427450]
mov eax, dword [eax]
call fcn.00402e58
mov edx, eax
pop ecx
pop eax
call fcn.0040ec54
mov eax, dword [0x4274f8]
cmp byte [eax], 1
jne 0x426226
lea edx, [ebp - 0xa4]
mov eax, dword [esi]
call fcn.004065c0
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xa8]
mov eax, dword [0x429e60]
call fcn.004065c0
mov edx, dword [ebp - 0xa8]
pop eax
call fcn.00402da4
je 0x426226
mov eax, dword [0x4275e0]
cmp byte [eax], 1
jne 0x426226
jmp 0x426218
mov eax, dword [0x429e60]
call fcn.00405e60
mov eax, dword [0x429e60]
call fcn.00405df4
cmp al, 1
je 0x42620e
push 0x429e64
mov ecx, dword [edi]
lea eax, [ebp - 0xac]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0xac]
call fcn.00402e58
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
push 0x426884
mov eax, dword [0x429e64]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x429e64]
push eax
call sub.advapi32.dll_RegCloseKey
push 0x429e64
mov ecx, dword [edi]
lea eax, [ebp - 0xb0]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0xb0]
call fcn.00402e58
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
push 0x426894
mov eax, dword [0x429e64]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x429e64]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [0x427568]
cmp dword [eax], 0
jle 0x4262ce
mov eax, dword [0x427568]
mov eax, dword [eax]
mov edx, ebx
call fcn.0042456c
push 0xd
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [esi]
mov cx, 0xc
mov dx, 0xb
call fcn.00407350
mov eax, dword [ebp - 0xb8]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xb4]
call fcn.00402bd0
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [edi]
lea eax, [ebp - 0xc0]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0xc0]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xbc]
call fcn.00402bd0
mov edx, dword [ebp - 0xbc]
mov ecx, 0x4268a8
mov eax, 0x80000001
call fcn.00406508
call fcn.00404a0c
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00404af8
mov eax, dword [0x427444]
call fcn.004029e4
mov eax, dword [0x427494]
mov eax, dword [eax]
call fcn.00405df4
cmp al, 1
jne 0x426396
lea ecx, [ebp - 0xc4]
mov edx, 0x429e5c
mov eax, dword [0x427494]
mov eax, dword [eax]
call fcn.004057dc
mov edx, dword [ebp - 0xc4]
mov eax, dword [0x427444]
call fcn.00402a38
jmp 0x4263be
mov eax, dword [0x427428]
mov eax, dword [eax]
call fcn.00402c60
mov edx, dword [0x4273e8]
cmp eax, dword [edx]
jne 0x4263be
mov eax, dword [0x427444]
mov edx, dword [0x427428]
mov edx, dword [edx]
call fcn.00402a38
lea edx, [ebp - 0xc8]
mov eax, dword [esi]
call fcn.00405fc0
mov edx, dword [ebp - 0xc8]
mov ecx, dword [0x4274e0]
mov ecx, dword [ecx]
mov eax, dword [0x427550]
call fcn.00402cac
mov eax, dword [0x4275b0]
cmp byte [eax], 1
jne 0x426443
mov eax, dword [0x427550]
mov eax, dword [eax]
call fcn.00405df4
test al, al
jne 0x42640d
mov eax, dword [0x427550]
mov eax, dword [eax]
xor ecx, ecx
xor edx, edx
call fcn.00405b78
mov eax, dword [0x427550]
mov eax, dword [eax]
call fcn.004056f0
push 2
mov eax, dword [0x427550]
mov eax, dword [eax]
call fcn.00402e58
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, 0x4109e0
xor ecx, ecx
xor edx, edx
call fcn.004055fc
mov edx, dword [0x4275c8]
mov dword [edx], eax
mov eax, dword [0x427610]
cmp byte [eax], 1
jne 0x426638
mov eax, dword [0x427630]
cmp byte [eax], 1
jne 0x42646c
mov eax, 0x429e68
mov edx, 0x4268bc
call fcn.00402a38
jmp 0x42647b
mov eax, 0x429e68
mov edx, 0x4268c8
call fcn.00402a38
mov eax, dword [0x427488]
cmp byte [eax], 1
jne 0x426496
mov eax, 0x429e6c
mov edx, 0x4268bc
call fcn.00402a38
jmp 0x4264a5
mov eax, 0x429e6c
mov edx, 0x4268c8
call fcn.00402a38
mov eax, dword [0x4273e8]
cmp dword [eax], 1
jg 0x4264b8
mov eax, dword [0x4273e8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x427450]
cmp dword [eax], 0
jne 0x4264d3
mov eax, 0x429e70
mov edx, 0x4268d4
call fcn.00402a38
jmp 0x4264e5
mov eax, 0x429e70
mov edx, dword [0x427450]
mov edx, dword [edx]
call fcn.00402a38
mov eax, dword [0x427598]
cmp dword [eax], 0
jne 0x426500
mov eax, 0x429e74
mov edx, 0x4268d4
call fcn.00402a38
jmp 0x426512
mov eax, 0x429e74
mov edx, dword [0x427598]
mov edx, dword [edx]
call fcn.00402a38
mov eax, dword [0x427524]
cmp dword [eax], 0
jne 0x42652d
mov eax, 0x429e78
mov edx, 0x4268d4
call fcn.00402a38
jmp 0x42653f
mov eax, 0x429e78
mov edx, dword [0x427524]
mov edx, dword [edx]
call fcn.00402a38
mov eax, 0x429e7c
mov edx, dword [0x4274c4]
mov edx, dword [edx]
call fcn.00402a38
push dword [esi]
push 0x426864
mov eax, dword [0x427638]
push dword [eax]
push 0x426864
push dword [edi]
push 0x426864
push dword [0x429e70]
push 0x426864
push dword [0x429e74]
push 0x426864
push dword [0x429e78]
push 0x426864
push dword [0x429e68]
push 0x426864
push dword [0x429e6c]
push 0x426864
lea edx, [ebp - 0xcc]
mov eax, dword [0x4273e8]
mov eax, dword [eax]
call fcn.00406bb8
push dword [ebp - 0xcc]
push 0x426864
push dword [0x429e7c]
push 0x426864
mov eax, 0x429e60
mov edx, 0x14
call fcn.00402d20
push 0xd
lea eax, [ebp - 0xd4]
push eax
mov cx, 0xc
mov dx, 0xb
mov eax, dword [0x429e60]
call fcn.00407350
mov eax, dword [ebp - 0xd4]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xd0]
call fcn.00402bd0
mov eax, dword [ebp - 0xd0]
push eax
lea eax, [ebp - 0xd8]
mov edx, 0x4268d8
call fcn.00402bd0
mov edx, dword [ebp - 0xd8]
mov ecx, 0x4268f4
mov eax, 0x80000001
call fcn.00406508
mov eax, dword [0x427444]
cmp dword [eax], 0
je 0x426688
mov eax, dword [0x427444]
mov eax, dword [eax]
call fcn.00402c60
mov edx, dword [0x4273e8]
cmp eax, dword [edx]
jne 0x426688
mov ecx, dword [0x4273e8]
mov ecx, dword [ecx]
mov edx, dword [0x427444]
mov edx, dword [edx]
mov eax, dword [0x427494]
mov eax, dword [eax]
call fcn.00405b78
mov eax, dword [0x427494]
mov eax, dword [eax]
call fcn.0040a7a4
mov edx, dword [0x42743c]
mov byte [edx], al
mov eax, dword [0x42746c]
cmp byte [eax], 1
jne 0x42670d
push 0xd
lea eax, [ebp - 0xe0]
push eax
mov eax, dword [0x427524]
mov eax, dword [eax]
mov cx, 0xc
mov dx, 0xb
call fcn.00407350
mov eax, dword [ebp - 0xe0]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xdc]
call fcn.00402bd0
mov eax, dword [ebp - 0xdc]
push eax
mov ecx, dword [edi]
lea eax, [ebp - 0xe8]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0xe8]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xe4]
call fcn.00402bd0
mov edx, dword [ebp - 0xe4]
mov ecx, 0x42690c
mov eax, 0x80000001
call fcn.00406508
mov eax, dword [0x4274d4]
cmp byte [eax], 1
jne 0x426792
push 0xd
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [0x427598]
mov eax, dword [eax]
mov cx, 0xc
mov dx, 0xb
call fcn.00407350
mov eax, dword [ebp - 0xf0]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xec]
call fcn.00402bd0
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [edi]
lea eax, [ebp - 0xf8]
mov edx, 0x426824
call fcn.00402cac
mov eax, dword [ebp - 0xf8]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0xf4]
call fcn.00402bd0
mov edx, dword [ebp - 0xf4]
mov ecx, 0x42691c
mov eax, 0x80000001
call fcn.00406508
mov eax, dword [0x42741c]
cmp byte [eax], 1
jne 0x4267aa
mov eax, 0x425624
xor ecx, ecx
xor edx, edx
call fcn.004055fc
mov eax, dword [0x427474]
cmp byte [eax], 1
jne 0x4267c2
mov eax, 0x40ed04
xor ecx, ecx
xor edx, edx
call fcn.004055fc
call fcn.004256b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4267ec
lea eax, [ebp - 0xf8]
mov edx, 0x2f
call fcn.00402a08
ret