Function at 0x4031f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov esi, eax
sub esi, 0x10
call fcn.00402bd0
mov eax, esi
mov edx, dword [eax]
mov dword [esp], edx
mov edx, dword [eax + 4]
mov dword [esp + 4], edx
mov edx, dword [eax + 0xc]
test dl, 8
jne 0x402cbd
push 0x8000
push 0
push esi
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
je 0x402cb8
xor edi, edi
jmp 0x402cf7
or edi, 0xffffffff
jmp 0x402cf7
mov ebx, esi
mov ebp, edx
and ebp, 0xfffffff0
xor edi, edi
push 0x1c
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.004026dc
push 0x8000
push 0
push ebx
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
jne 0x402ce9
or edi, 0xffffffff
jmp 0x402cf7
mov esi, dword [esp + 0x14]
cmp ebp, esi
jbe 0x402cf7
sub ebp, esi
add ebx, esi
jmp 0x402cc6
test edi, edi
jne 0x402d0e
mov eax, dword [esp + 4]
mov edx, dword [esp]
mov dword [eax], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov byte [0x562ac4], 0
mov eax, edi
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
mov edx, dword [eax - 4]
test dl, 7
mov ecx, eax
push ebx
mov bl, byte [0x560051]
jne 0x4032e8
test bl, bl
mov ebx, dword [edx]
jne 0x40326c
sub dword [edx + 0xc], 1
mov eax, dword [edx + 8]
je 0x403240
test eax, eax
mov dword [edx + 8], ecx
lea eax, [eax + 1]
mov dword [ecx - 4], eax
je 0x403228
xor eax, eax
mov byte [ebx], al
pop ebx
ret
mov ecx, dword [ebx + 4]
mov dword [edx + 0x14], ebx
mov dword [edx + 4], ecx
mov dword [ecx + 0x14], edx
mov dword [ebx + 4], edx
mov byte [ebx], 0
xor eax, eax
pop ebx
ret
test eax, eax
je 0x403257
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov dword [ecx + 0x14], eax
xor eax, eax
cmp dword [ebx + 0x10], edx
jne 0x40325a
mov dword [ebx + 0xc], eax
mov byte [ebx], al
mov eax, edx
mov edx, dword [edx - 4]
mov bl, byte [0x560051]
jmp 0x4032f1
mov eax, 0x100
lock cmpxchg byte [ebx], ah
je 0x40320b
pause
cmp byte [0x5608d9], 0
jne 0x40326c
push ecx
push edx
push 0
call sub.advapi32.dll_RegDeleteValueW
pop edx
pop ecx
mov eax, 0x100
lock cmpxchg byte [ebx], ah
je 0x40320b
push ecx
push edx
push 0xa
call sub.advapi32.dll_RegDeleteValueW
pop edx
pop ecx
jmp 0x40326c
mov eax, 0x100
lock cmpxchg byte [0x560a37], ah
je 0x4032fd
pause
cmp byte [0x5608d9], 0
jne 0x4032ac
push 0
call sub.advapi32.dll_RegDeleteValueW
mov eax, 0x100
lock cmpxchg byte [0x560a37], ah
je 0x4032fd
push 0xa
call sub.advapi32.dll_RegDeleteValueW
jmp 0x4032ac
test dl, 5
jne 0x4033d8
and edx, 0xfffffff0
test bl, bl
mov ebx, edx
push esi
mov esi, eax
jne 0x4032ac
test dword [ebx + esi - 4], 1
mov ecx, dword [ebx + esi - 4]
jne 0x403340
or ecx, 8
mov dword [ebx + esi - 4], ecx
test byte [esi - 4], 8
jne 0x403358
cmp ebx, 0x13ffe0
je 0x403370
lea eax, [ebx + 3]
mov dword [esi - 4], eax
mov dword [ebx + esi - 8], ebx
mov eax, esi
mov edx, ebx
call fcn.00402a8c
mov byte [0x560a37], 0
xor eax, eax
pop esi
pop ebx
ret
lea eax, [ebx + esi]
and ecx, 0xfffffff0
add ebx, ecx
cmp ecx, 0xb30
jb 0x403312
call fcn.00402a4c
jmp 0x403312
mov ecx, dword [esi - 8]
sub esi, ecx
add ebx, ecx
cmp ecx, 0xb30
jb 0x403318
mov eax, esi
call fcn.00402a4c
jmp 0x403318
cmp dword [0x560a3c], 0x13ffe0
jne 0x4033a8
sub esi, 0x10
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov dword [edx], eax
mov byte [0x560a37], 0
push 0x8000
push 0
push esi
call sub.advapi32.dll_RegDeleteKeyW
cmp eax, 1
sbb eax, eax
pop esi
pop ebx
ret
lea ebx, [esi + 0x13ffe0]
call fcn.00402aec
mov dword [ebx - 4], 2
mov dword [0x560a3c], 0x13ffe0
mov dword [0x560a38], ebx
mov byte [0x560a37], 0
xor eax, eax
pop esi
pop ebx
ret
pop ebx
test dl, 3
je 0x402c7c
mov eax, 0xffffffff
ret