Function at 0x40c6ec
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
mov eax, dword [0x6a2c70]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x3d4], ecx
mov ecx, 0x6bee08
push 0xa
call fcn.0043f7ed
push str.MYMC00000001
mov edi, eax
mov ecx, 0x6aed68
push 0x80000002
mov dword [ebp - 0x3d8], edi
call fcn.00409438
mov dword [ebp - 0x3e4], eax
test eax, eax
jne 0x40c748
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 8]
xor al, al
jmp 0x40ca9f
push ebx
push esi
push 0x579fbc
mov esi, str..IniPROFILEID.ini
push esi
call fcn.00551d18
pop ecx
xor ebx, ebx
pop ecx
test eax, eax
je 0x40c8a0
push eax
call fcn.0054f7fb
push 0xc8
lea eax, [ebp - 0xcc]
push ebx
push eax
call fcn.0054f520
movzx ebx, byte [ebp + 8]
lea eax, [ebp - 0x1cc]
push ebx
push str.ACCOUNT_d
push eax
call fcn.00550fcb
push esi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x1cc]
push str.UserName
push eax
call fcn.005377a5
mov edi, dword [ebp - 0x3d4]
lea eax, [ebp - 0xcc]
push 0x11
push eax
lea esi, [edi + 0x7c]
push esi
call fcn.004f8cc3
push str..IniPROFILEID.ini
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x1cc]
push str.PassWord
push eax
call fcn.005377a5
add esp, 0x48
lea eax, [ebp - 0xcc]
add edi, 0x8d
push 0x11
push eax
push edi
call fcn.004f8cc3
push 0x11
lea eax, [ebp - 0xcc]
push esi
push eax
call fcn.004f8cc3
push ebx
push str.MSOMSO
lea eax, [ebp - 0x1cc]
push str._s_UserName__d
push eax
call fcn.00550fcb
add esp, 0x28
lea eax, [ebp - 0xcc]
mov esi, str.MYMC00000001
mov ecx, 0x6aed68
push eax
push 1
lea eax, [ebp - 0x1cc]
push eax
push esi
call fcn.0040950b
push 0x11
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.004f8cc3
push ebx
push str.MSOMSO
lea eax, [ebp - 0x1cc]
push str._s_PassWord__d
push eax
call fcn.00550fcb
add esp, 0x1c
lea eax, [ebp - 0xcc]
mov ecx, 0x6aed68
push eax
push 1
lea eax, [ebp - 0x1cc]
push eax
push esi
call fcn.0040950b
cmp byte [ebp + 8], 3
jne 0x40c898
push str..IniPROFILEID.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [ebp - 0x3d8]
xor ebx, ebx
movzx eax, byte [ebp + 8]
push eax
push str.MSOMSO
mov dword [ebp - 0x3d8], eax
lea eax, [ebp - 0x3cc]
push str._s_UserName__d
push eax
call fcn.00550fcb
mov esi, dword [ebp - 0x3d4]
lea eax, [ebp - 0x3cc]
add esp, 0x10
mov ecx, 0x6aed68
add esi, 0x7c
push 0x11
push 1
push eax
push str.MYMC00000001
call fcn.00409489
push eax
push esi
call fcn.004f8cc3
push dword [ebp - 0x3d8]
lea eax, [ebp - 0x3cc]
push str.MSOMSO
push str._s_PassWord__d
push eax
call fcn.00550fcb
add esp, 0x1c
lea eax, [ebp - 0x3cc]
mov ecx, 0x6aed68
push 0x11
push 1
push eax
push str.MYMC00000001
call fcn.00409489
push eax
mov eax, dword [ebp - 0x3d4]
add eax, 0x8d
push eax
call fcn.004f8cc3
push 0xfe
lea eax, [ebp - 0x2cb]
mov byte [ebp - 0x2cc], bl
push ebx
push eax
call fcn.0054f520
mov eax, 0xe6
add esp, 0x18
cmp byte [esi], 0
mov dword [ebp - 0x3e0], eax
mov byte [ebp - 0x3cd], al
mov byte [ebp - 0x3dc], al
je 0x40ca08
mov ecx, dword [ebp - 0x3d4]
cmp byte [ecx + 0x8d], 0
je 0x40ca08
push 5
push str.NULL
push esi
call fcn.00551d2d
add esp, 0xc
test eax, eax
je 0x40ca08
mov eax, dword [ebp - 0x3d4]
push 5
add eax, 0x8d
push str.NULL
push eax
call fcn.00551d2d
add esp, 0xc
test eax, eax
je 0x40ca08
mov eax, 0x82
mov word [ebp - 0x3d3], 0xff82
mov dword [ebp - 0x3dc], eax
lea ecx, [ebp - 0x2cc]
mov ax, word [ebp - 0x3d3]
sub ecx, esi
mov word [ebp - 0x3d4], ax
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x40c9e4
mov al, byte [ebp - 0x3d3]
mov byte [ebp - 0x3cd], al
mov al, byte [ebp - 0x3d4]
mov dword [ebp - 0x3e0], eax
jmp 0x40ca2f
mov eax, dword [ebp - 0x3d8]
mov ecx, 0x6c93c8
inc eax
push eax
push 0xa4e
call fcn.004be778
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00550fcb
add esp, 0xc
push pe_nt_image_headers32
call fcn.0054f5fe
pop ecx
test eax, eax
je 0x40ca47
mov ecx, eax
call fcn.0040a2c0
mov ebx, eax
lea ecx, [ebp - 0x2cc]
lea edx, [ebx + 4]
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40ca54
mov eax, dword [ebp - 0x3e0]
movzx edx, al
movzx eax, byte [ebp - 0x3cd]
shl edx, 8
or edx, eax
mov eax, dword [ebp - 0x3dc]
shl edx, 8
movzx ecx, al
or edx, ecx
lea ecx, [edi + 0x934]
mov dword [ebx], edx
mov edx, dword [ecx]
push ebx
call dword [edx + 8]
push dword [ebp - 0x3e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0054ee82
mov esp, ebp
pop ebp
ret 4