Function at 0x418b53
Capabilities:
Delete registry key

Disassembly:
push 0xfc
mov eax, 0x44a435
call fcn.004386f7
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x10]
push 7
mov dword [ebp - 0x80], eax
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], ax
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 6
call fcn.0042c4ac
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 7
call fcn.0042c4ac
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 8
call fcn.0042c4ac
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 9
call fcn.0042c4ac
push 0x2000000
xor esi, esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
inc esi
push 0x80000002
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x8c], ebx
call fcn.0042cc14
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0042c897
mov edi, dword [ebp - 0xc4]
mov dword [ebp - 0x9c], edi
cmp edi, dword [ebp - 0xc0]
je 0x419094
push 0x2000000
push 0x44d8ac
push 0x80000003
lea ecx, [ebp - 0xe0]
call fcn.0042cc14
push 8
pop esi
mov ebx, eax
mov dword [ebp - 0x74], ebx
cmp dword [edi + 0x14], esi
jb 0x418ca2
mov eax, dword [edi]
jmp 0x418ca4
mov eax, edi
push eax
lea ecx, [ebp - 0xe0]
call fcn.0042cb86
test eax, eax
je 0x419127
cmp dword [edi + 0x14], esi
jb 0x418cc1
mov esi, dword [edi]
jmp 0x418cc3
mov esi, edi
xor eax, eax
cmp word [esi], ax
je 0x418cd1
push esi
call fcn.0043860f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401db2
mov esi, 0x44d8a8
push esi
call fcn.0043860f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004053dd
mov esi, dword [ebp - 0xac]
xor eax, eax
cmp word [esi], ax
je 0x418d05
push esi
call fcn.0043860f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004053dd
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0x2a
call fcn.0040baaf
cmp eax, 0xffffffff
jne 0x418d93
push 1
push esi
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0x3f
call fcn.0040baaf
cmp eax, 0xffffffff
jne 0x418d93
mov ebx, dword [ebp - 0x94]
mov esi, dword [ebp - 0x98]
cmp esi, ebx
je 0x418d76
xor edi, edi
push edi
push 1
mov ecx, esi
call fcn.00401ba5
add esi, 0x18
cmp esi, ebx
jne 0x418d59
mov esi, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x94], esi
call fcn.00421582
mov ebx, dword [ebp - 0x74]
jmp 0x418e99
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401cf8
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0x5c
call fcn.0040bbab
lea ecx, [ebp - 0x28]
cmp eax, 0xffffffff
je 0x418e2b
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x5c
call fcn.0040bbab
push eax
push esi
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x28]
call fcn.004058e2
push eax
lea ecx, [ebp - 0x28]
call fcn.00406613
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.00401ba5
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], 0x5c
call fcn.0040bbab
inc eax
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00401f31
lea ecx, [ebp - 0x40]
cmp ecx, eax
je 0x418e31
push 0xffffffffffffffff
push esi
push eax
call fcn.00401cf8
jmp 0x418e31
push esi
call fcn.00401efe
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x80]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
lea ecx, [ebp - 0xa4]
call fcn.0042cc14
mov esi, eax
test esi, esi
je 0x418e79
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00403424
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0xa4]
call fcn.0042c95e
mov ebx, esi
mov dword [ebp - 0x74], ebx
jmp 0x418e99
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Cannot_open_the_key___1_s___by_CMpReg_n
push str.CUninstallActions::DeleteUsersRegistryKey
push 5
call fcn.00405a24
add esp, 0x10
mov esi, dword [ebp - 0x98]
cmp esi, dword [ebp - 0x94]
je 0x41907a
mov edi, dword [ebp - 0x7c]
cmp dword [esi + 0x14], 8
jb 0x418eb8
mov eax, dword [esi]
jmp 0x418eba
mov eax, esi
push eax
push str.DelReg_CMD_UNINSTREG_DELETEKEY::__1_s___n
push str.CUninstallActions::DeleteUsersRegistryKey
push 5
call fcn.00405a24
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x418ed9
mov eax, dword [esi]
jmp 0x418edb
mov eax, esi
push dword [ebp - 0x80]
lea ecx, [ebp - 0x88]
push eax
push ebx
call fcn.0042cc14
test eax, eax
je 0x419062
lea ecx, [ebp - 0x108]
call fcn.0042c4ac
xor eax, eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
push str.Advapi32.dll
mov byte [ebp - 4], 0xc
call fcn.00401fef
pop ecx
mov dword [ebp - 0x78], eax
test eax, eax
je 0x418f3a
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8c], eax
mov ebx, dword [ebp + 0xc]
and ebx, 0xff00
je 0x419006
cmp ebx, 0x100
je 0x418fac
cmp ebx, 0x200
je 0x418f98
cmp ebx, 0x300
je 0x418fc2
push ebx
push str.CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
push str.CUninstallActions::DeleteUsersRegistryKey
push 5
call fcn.00405a24
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x418f80
mov eax, dword [esi]
jmp 0x418f82
mov eax, esi
mov ecx, dword [ebp - 0xa8]
push ebx
mov ebx, dword [ebp - 0x74]
push eax
push ebx
call fcn.00416f2e
jmp 0x419033
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042c897
jmp 0x418fd4
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042c897
test eax, eax
jne 0x419037
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042c7b6
test eax, eax
jne 0x419037
lea ecx, [ebp - 0x88]
call fcn.0042c5a8
mov ecx, dword [ebp - 0x8c]
test ecx, ecx
jne 0x419015
cmp dword [esi + 0x14], 8
jb 0x418ff7
mov eax, dword [esi]
jmp 0x418ff9
mov eax, esi
mov ebx, dword [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x41902e
lea ecx, [ebp - 0x88]
call fcn.0042c6fb
and edi, eax
jmp 0x418fd8
cmp dword [esi + 0x14], 8
jb 0x41901f
mov eax, dword [esi]
jmp 0x419021
mov eax, esi
mov ebx, dword [ebp - 0x74]
xor edx, edx
push edx
push dword [ebp - 0x80]
push eax
push ebx
call ecx
neg eax
sbb eax, eax
inc eax
and edi, eax
jmp 0x41903a
mov ebx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x419048
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0xd0]
call fcn.004052ea
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0xa
call fcn.0042c4fc
add esi, 0x18
cmp esi, dword [ebp - 0x94]
jne 0x418eae
mov dword [ebp - 0x7c], edi
mov edi, dword [ebp - 0x9c]
xor ebx, ebx
add edi, 0x18
mov dword [ebp - 0x9c], edi
cmp edi, dword [ebp - 0xc0]
jne 0x418c77
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 9
call fcn.0042c4fc
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 8
call fcn.0042c4fc
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 7
call fcn.0042c4fc
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 6
call fcn.0042c4fc
lea ecx, [ebp - 0x98]
call fcn.004052ea
lea ecx, [ebp - 0xf8]
call fcn.004052ea
lea ecx, [ebp - 0xec]
call fcn.004052ea
lea ecx, [ebp - 0xc4]
call fcn.004052ea
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00401ba5
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00401ba5
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ba5
mov eax, esi
call fcn.004386a6
ret 0xc
push 1
push str.SeRestorePrivilege
call fcn.004369a5
pop ecx
pop ecx
test eax, eax
je 0x41907a
mov ebx, 0x80000003
mov dword [ebp - 0x74], ebx
cmp dword [edi + 0x14], esi
jb 0x41914e
mov eax, dword [edi]
jmp 0x419150
mov eax, edi
push eax
call fcn.00436806
pop ecx
test eax, eax
je 0x41953a
cmp dword [edi + 0x14], esi
jb 0x419168
mov esi, dword [edi]
jmp 0x41916a
mov esi, edi
xor eax, eax
cmp word [esi], ax
je 0x419178
push esi
call fcn.0043860f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401db2
mov esi, 0x44d8a8
push esi
call fcn.0043860f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004053dd
mov esi, dword [ebp - 0xac]
xor eax, eax
cmp word [esi], ax
je 0x4191ac
push esi
call fcn.0043860f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004053dd
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0x2a
call fcn.0040baaf
cmp eax, 0xffffffff
jne 0x41923a
push 1
push esi
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0x3f
call fcn.0040baaf
cmp eax, 0xffffffff
jne 0x41923a
mov ebx, dword [ebp - 0x94]
mov esi, dword [ebp - 0x98]
cmp esi, ebx
je 0x41921d
xor edi, edi
push edi
push 1
mov ecx, esi
call fcn.00401ba5
add esi, 0x18
cmp esi, ebx
jne 0x419200
mov esi, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x94], esi
call fcn.00421582
mov ebx, dword [ebp - 0x74]
jmp 0x419344
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401cf8
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0x5c
call fcn.0040bbab
lea ecx, [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4192d2
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x5c
call fcn.0040bbab
push eax
push esi
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x28]
call fcn.004058e2
push eax
lea ecx, [ebp - 0x28]
call fcn.00406613
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.00401ba5
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], 0x5c
call fcn.0040bbab
inc eax
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00401f31
lea ecx, [ebp - 0x40]
cmp ecx, eax
je 0x4192d8
push 0xffffffffffffffff
push esi
push eax
call fcn.00401cf8
jmp 0x4192d8
push esi
call fcn.00401efe
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x80]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x80000003
lea ecx, [ebp - 0xa4]
call fcn.0042cc14
mov esi, eax
test esi, esi
je 0x419324
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00403424
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0xa4]
call fcn.0042c95e
mov ebx, esi
mov dword [ebp - 0x74], ebx
jmp 0x419344
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Cannot_open_the_key___1_s___by_CMpReg_n
push str.CUninstallActions::DeleteUsersRegistryKey
push 5
call fcn.00405a24
add esp, 0x10
mov esi, dword [ebp - 0x98]
cmp esi, dword [ebp - 0x94]
je 0x419527
mov edi, dword [ebp - 0x7c]
cmp dword [esi + 0x14], 8
jb 0x419363
mov eax, dword [esi]
jmp 0x419365
mov eax, esi
push eax
push str.DelReg_CMD_UNINSTREG_DELETEKEY::__1_s___n
push str.CUninstallActions::DeleteUsersRegistryKey
push 5
call fcn.00405a24
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x419384
mov eax, dword [esi]
jmp 0x419386
mov eax, esi
push 0x2000000
push eax
push ebx
lea ecx, [ebp - 0x88]
call fcn.0042cc14
test eax, eax
je 0x41950f
lea ecx, [ebp - 0x100]
call fcn.0042c4ac
xor eax, eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
push str.Advapi32.dll
mov byte [ebp - 4], 0xe
call fcn.00401fef
pop ecx
mov dword [ebp - 0x78], eax
test eax, eax
je 0x4193e7
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8c], eax
mov ebx, dword [ebp + 0xc]
and ebx, 0xff00
je 0x4194b3
cmp ebx, 0x100
je 0x419459
cmp ebx, 0x200
je 0x419445
cmp ebx, 0x300
je 0x41946f
push ebx
push str.CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
push str.CUninstallActions::DeleteUsersRegistryKey
push 5
call fcn.00405a24
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x41942d
mov eax, dword [esi]
jmp 0x41942f
mov eax, esi
mov ecx, dword [ebp - 0xa8]
push ebx
mov ebx, dword [ebp - 0x74]
push eax
push ebx
call fcn.00416f2e
jmp 0x4194e0
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042c897
jmp 0x419481
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042c897
test eax, eax
jne 0x4194e4
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x88]
call fcn.0042c7b6
test eax, eax
jne 0x4194e4
lea ecx, [ebp - 0x88]
call fcn.0042c5a8
mov ecx, dword [ebp - 0x8c]
test ecx, ecx
jne 0x4194c2
cmp dword [esi + 0x14], 8
jb 0x4194a4
mov eax, dword [esi]
jmp 0x4194a6
mov eax, esi
mov ebx, dword [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4194db
lea ecx, [ebp - 0x88]
call fcn.0042c6fb
and edi, eax
jmp 0x419485
cmp dword [esi + 0x14], 8
jb 0x4194cc
mov eax, dword [esi]
jmp 0x4194ce
mov eax, esi
mov ebx, dword [ebp - 0x74]
xor edx, edx
push edx
push dword [ebp - 0x80]
push eax
push ebx
call ecx
neg eax
sbb eax, eax
inc eax
and edi, eax
jmp 0x4194e7
mov ebx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x4194f5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0xb8]
call fcn.004052ea
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0xa
call fcn.0042c4fc
add esi, 0x18
cmp esi, dword [ebp - 0x94]
jne 0x419359
mov dword [ebp - 0x7c], edi
mov edi, dword [ebp - 0x9c]
cmp dword [edi + 0x14], 8
jb 0x419531
mov eax, dword [edi]
jmp 0x419533
mov eax, edi
push eax
call fcn.00436a9f
pop ecx
xor ebx, ebx
push ebx
push str.SeRestorePrivilege
call fcn.004369a5
pop ecx
pop ecx
jmp 0x41907c