Function at 0x409330
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x70c
push ebx
push ebp
push esi
push edi
mov ecx, 9
mov esi, str.4fdd91a1_8d47_4806_a351_689c2264a92e
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x39], eax
mov ecx, 9
mov dword [esp + 0x3d], eax
mov esi, str.4fdd91b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x41], eax
lea edi, [esp + 0x46]
mov byte [esp + 0x45], al
xor edx, edx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x6b], ecx
mov esi, str.4fdd91c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x6f], ecx
lea edi, [esp + 0x78]
mov dword [esp + 0x73], ecx
mov byte [esp + 0x77], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x9d], edx
mov ecx, 9
mov dword [esp + 0xa1], edx
mov esi, str.4fdd91d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0xa5], edx
lea edi, [esp + 0xaa]
mov byte [esp + 0xa9], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xcf], eax
mov ecx, 9
mov dword [esp + 0xd3], eax
mov esi, str.4fdd92a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0xd7], eax
lea edi, [esp + 0xdc]
mov byte [esp + 0xdb], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x101], ecx
mov esi, str.4fdd92b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x105], ecx
lea edi, [esp + 0x10e]
mov dword [esp + 0x109], ecx
mov byte [esp + 0x10d], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x133], edx
mov ecx, 9
mov dword [esp + 0x137], edx
mov esi, str.4fdd92c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x13b], edx
lea edi, [esp + 0x140]
mov byte [esp + 0x13f], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x165], eax
mov ecx, 9
mov dword [esp + 0x169], eax
mov esi, str.4fdd92d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x16d], eax
lea edi, [esp + 0x172]
mov byte [esp + 0x171], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x197], ecx
mov dword [esp + 0x19b], ecx
mov dword [esp + 0x19f], ecx
mov byte [esp + 0x1a3], cl
mov ecx, 9
mov esi, str.4fdd92e1_8d47_4806_a351_689c2264a92e
lea edi, [esp + 0x1a4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1c9], edx
mov ecx, 9
mov dword [esp + 0x1cd], edx
mov esi, str.4fdd92f1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x1d1], edx
lea edi, [esp + 0x1d6]
mov byte [esp + 0x1d5], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1fb], eax
mov ecx, 9
mov dword [esp + 0x1ff], eax
mov esi, str.4fdd93a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x203], eax
lea edi, [esp + 0x208]
mov byte [esp + 0x207], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x22d], ecx
mov esi, str.4fdd93b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x231], ecx
lea edi, [esp + 0x23a]
mov dword [esp + 0x235], ecx
mov byte [esp + 0x239], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x25f], edx
mov ecx, 9
mov dword [esp + 0x263], edx
mov esi, str.4fdd93c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x267], edx
lea edi, [esp + 0x26c]
mov byte [esp + 0x26b], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x291], eax
mov ecx, 9
mov dword [esp + 0x295], eax
mov esi, str.4fdd93d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x299], eax
lea edi, [esp + 0x29e]
mov byte [esp + 0x29d], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x2c3], ecx
mov esi, str.4fdd93e1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x2c7], ecx
lea edi, [esp + 0x2d0]
mov dword [esp + 0x2cb], ecx
mov byte [esp + 0x2cf], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x2f5], edx
mov ecx, 9
mov dword [esp + 0x2f9], edx
mov esi, str.4fdd93f1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x2fd], edx
lea edi, [esp + 0x302]
mov byte [esp + 0x301], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x327], eax
mov ecx, 9
mov dword [esp + 0x32b], eax
mov esi, str.4fdd94a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x32f], eax
lea edi, [esp + 0x334]
mov byte [esp + 0x333], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x359], ecx
mov dword [esp + 0x35d], ecx
mov esi, str.4fdd94b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x361], ecx
lea edi, [esp + 0x366]
mov byte [esp + 0x365], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x38b], edx
mov ecx, 9
mov dword [esp + 0x38f], edx
mov esi, str.4fdd94c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x393], edx
lea edi, [esp + 0x398]
mov byte [esp + 0x397], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3bd], eax
mov ecx, 9
mov dword [esp + 0x3c1], eax
mov esi, str.4fdd94d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x3c5], eax
lea edi, [esp + 0x3ca]
mov byte [esp + 0x3c9], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3ef], ecx
mov esi, str.4fdd94e1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x3f3], ecx
lea edi, [esp + 0x3fc]
mov dword [esp + 0x3f7], ecx
mov byte [esp + 0x3fb], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x421], edx
mov ecx, 9
mov dword [esp + 0x425], edx
mov esi, str.4fdd94f1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x429], edx
lea edi, [esp + 0x42e]
mov byte [esp + 0x42d], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x453], eax
mov ecx, 9
mov dword [esp + 0x457], eax
mov esi, str.4fdd95a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x45b], eax
lea edi, [esp + 0x460]
mov byte [esp + 0x45f], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x485], ecx
mov esi, str.4fdd95b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x489], ecx
lea edi, [esp + 0x492]
mov dword [esp + 0x48d], ecx
mov byte [esp + 0x491], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x4b7], edx
mov ecx, 9
mov dword [esp + 0x4bb], edx
mov esi, str.4fdd95c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x4bf], edx
lea edi, [esp + 0x4c4]
mov byte [esp + 0x4c3], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x4e9], eax
mov ecx, 9
mov dword [esp + 0x4ed], eax
mov esi, str.4fdd95d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x4f1], eax
lea edi, [esp + 0x4f6]
mov byte [esp + 0x4f5], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dl, byte [0x41b8cc]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x51b], ecx
lea edi, [esp + 0x529]
mov dword [esp + 0x51f], ecx
mov byte [esp + 0x528], dl
mov dword [esp + 0x523], ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov byte [esp + 0x527], cl
mov ecx, 0x7c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea esi, [esp + 0x14]
mov ebx, 0x1a
push 0x12c
lea eax, [esp + 0x52c]
push str.SOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiers0Paths
push eax
call fcn.0040d1a0
push 0x1f4
lea ecx, [esp + 0x538]
push esi
push ecx
call fcn.0040d750
push 0x1f4
lea edx, [esp + 0x544]
push 0x418378
push edx
call fcn.0040d750
add esp, 0x24
lea eax, [esp + 0x10]
lea ecx, [esp + 0x528]
push eax
push ecx
push 0x80000002
call edi
test eax, eax
jne 0x4098ad
lea edx, [esp + 0x528]
push edx
push 0x80000002
call ebp
add esi, 0x32
dec ebx
jne 0x409842
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70c
ret