Function at 0x404193
Capabilities:
Delete file
Query or enumerate registry key

Disassembly:
push 0x4d4
mov eax, 0x41b02d
call fcn.0041a746
mov dword [ebp - 4], 1
lea ecx, [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax - 0xc]
push esi
call fcn.0040241a
lea ecx, [esi + 1]
cmp ecx, 0x7fffffff
ja 0x4045f5
push ecx
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247c
lea eax, [ebp + 0xc]
mov edx, str.ExecutorUtilities_
push eax
lea ecx, [ebp - 0x48c]
call fcn.00404ee2
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0040392f
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 1
call fcn.004020ac
push ecx
push ecx
lea ecx, [ebp + 8]
call fcn.00404fbb
push 0x5c
pop eax
xor ebx, ebx
mov word [ebp - 0x22c], ax
push 0x250
lea eax, [ebp - 0x480]
mov dword [ebp - 0x484], ebx
push ebx
push eax
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
call fcn.0040a160
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x484]
push dword [ebp + 8]
call fcn.00406131
jmp 0x4042af
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x484]
call fcn.00406036
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x48c]
call fcn.004020ac
cmp dword [ebp - 0x484], 0
je 0x4042b3
cmp dword [ebp - 0x228], 0
je 0x4042b3
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x484]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x40425f
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
push 0x2001f
push str.SOFTWAREOutlookFreeware.comProfiles
push 0x80000001
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 4
call fcn.00401c05
test eax, eax
je 0x404305
cmp dword [ebp - 0x4b0], 0
je 0x4045ab
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4045ab
mov edi, dword [ebp - 0x4b0]
mov esi, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x488], 0x105
lea eax, [ebp - 0x4d0]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
mov dword [ebp - 0x4c8], esi
test eax, eax
jne 0x4045a2
mov dword [ebp - 0x488], 0x105
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], eax
push 0x2001f
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 5
push eax
push edi
lea ecx, [ebp - 0x4a4]
call fcn.00401c05
test eax, eax
jne 0x404573
mov esi, str.Rules
push esi
call fcn.0040d7ad
pop ecx
push eax
push esi
lea ecx, [ebp + 8]
call fcn.00401d3f
xor esi, esi
lea eax, [ebp - 0x4d8]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
push dword [ebp - 0x4a4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
mov dword [ebp - 0x488], 0x105
mov dword [ebp - 0x4c4], esi
test eax, eax
jne 0x40456d
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x224]
lea ecx, [ebp - 0x4c0]
call fcn.00404ee2
mov dword [esp], 0x2001f
lea ecx, [ebp - 0x4bc]
push dword [eax]
push dword [ebp - 0x4a4]
call fcn.00401c05
lea ecx, [ebp - 0x4c0]
mov esi, eax
call fcn.004020ac
test esi, esi
mov esi, dword [ebp - 0x4bc]
jne 0x40454d
xor eax, eax
mov dword [ebp - 0x48c], eax
lea ecx, [ebp - 0x4e0]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x488]
push ecx
lea ecx, [ebp - 0x224]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x48c]
mov dword [ebp - 0x488], 0x105
test eax, eax
jne 0x40454d
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x490], eax
push 0x2001f
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 7
push eax
push esi
lea ecx, [ebp - 0x498]
call fcn.00401c05
test eax, eax
jne 0x404519
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x224]
push eax
push str.Schema
lea ecx, [ebp - 0x498]
call fcn.00401b33
test eax, eax
jne 0x404519
lea eax, [ebp - 0x224]
push 0x5c
push eax
call fcn.0040a6db
pop ecx
pop ecx
test eax, eax
je 0x404519
add eax, 2
je 0x40459b
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404519
push str.Globals
lea ecx, [ebp - 0x498]
call fcn.004074f4
cmp dword [ebp - 0x498], 0
mov dword [ebp - 0x488], 0x105
je 0x40453b
push dword [ebp - 0x498]
call ebx
and dword [ebp - 0x498], 0
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x48c]
jmp 0x40444f
test esi, esi
je 0x40455b
push esi
call ebx
and dword [ebp - 0x4bc], 0
and dword [ebp - 0x4b8], 0
mov esi, dword [ebp - 0x4c4]
jmp 0x4043a6
mov esi, dword [ebp - 0x4c8]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x4a4], 0
je 0x40458f
push dword [ebp - 0x4a4]
call ebx
and dword [ebp - 0x4a4], 0
and dword [ebp - 0x4a0], 0
jmp 0x40431d
push 0x80004005
jmp 0x4045fa
test edi, edi
je 0x4045a9
push edi
call ebx
xor ebx, ebx
push dword [ebp - 0x230]
mov dword [ebp - 0x228], ebx
call fcn.00408c86
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x230], ebx
pop ecx
test eax, eax
je 0x4045df
cmp eax, 0xffffffff
je 0x4045df
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x484], ebx
lea ecx, [ebp + 8]
call fcn.004020ac
lea ecx, [ebp + 0xc]
call fcn.004020ac
call fcn.0041a6f5
ret
push 0x80070057
call fcn.00402460
int3