Function at 0x401000
Capabilities:
Delete registry value

Disassembly:
mov dword [0x419025], 0
mov eax, dword [0x419025]
call dword [sym.imp.USER32.DLL_CreatePopupMenu]
mov dword [0x418969], eax
mov dword [0x4180fb], 0
mov eax, dword [0x4180fb]
lea edx, [ebx + 0x418c0a]
add dword [0x4191ad], edx
add edx, 0x93e
add edx, ebx
add dword [0x4189b8], edx
mov ebx, edx
sub ebx, 0x83a
dec ebx
mov edx, ebx
sub edx, 0xba4
shl edx, 1
add edx, dword [0x419636]
sub edx, eax
add dword [0x418f66], edx
jmp 0x40273c
lea ecx, [eax + 8]
sub edi, 2
mov dword [0x419666], 0
mov ecx, dword [0x419666]
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0
pop ecx
push ecx
xor ebx, ebx
push ebx
mov dword [0x419595], 0
mov esi, dword [0x419595]
push esi
mov ebx, 1
push ebx
mov esi, 0x205868
mov ecx, esi
shl ecx, 1
call dword [ecx]
or eax, eax
jne 0x40163e
leave
ret
lea edx, [eax + 3]
add esi, eax
xor esi, ebx
push 0x29a628
pop edi
mov ebx, 0x170a44
add edi, ebx
push dword [edi]
pop edi
call edi
or eax, eax
je 0x401644
leave
ret
add eax, edi
mov edi, 0xd0
mov eax, 0
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, 0x59
mov eax, ebx
push eax
mov edi, 0
push edi
push 9
pop eax
push eax
mov esi, 0x1aab86
mov edx, esi
mov dword [0x41919a], 0x260552
add edx, dword [0x41919a]
push dword [edx]
pop dword [0x4195a0]
mov edx, dword [0x4195a0]
call edx
or eax, eax
jne 0x40169d
leave
ret
or ax, bp
dec edi
sub esi, 2
mov ecx, 0
sub ecx, 0xbd2
sub ecx, dword [0x4186f6]
sub ecx, edi
inc ecx
sub ecx, edi
sub ecx, 0x6d2
jne 0x401746
add ecx, ebx
sub ecx, ebx
inc ecx
mov esi, ecx
add dword [0x418a15], esi
leave
ret
sub ebx, eax
add esi, 1
cmp eax, dword [0x41a844]
xor eax, eax
push eax
mov ecx, 0xbb
mov edx, ecx
push edx
push 0x39
pop esi
push esi
mov edi, 1
push edi
mov esi, 0x2e17de
add esi, 0x1298ee
mov esi, dword [esi]
call esi
or eax, eax
jne 0x401753
leave
ret
lea edi, [0x7c]
cwde
mov esi, 7
push esi
mov esi, 0x7b8be2
mov edi, 0x3adb06
mov ebx, edi
sub esi, ebx
call dword [esi]
or eax, eax
jne 0x4016a5
mov edx, 0x6621a
mov ebx, edx
add ebx, 0x3b2bea
push ebx
mov edx, 0
push edx
mov ecx, dword [sym.imp.advapi32.dll_RegDeleteValueA]
call ecx
or eax, eax
je 0x401753
leave
ret
mov eax, ebp
mov ebx, eax
push ebx
mov dword [ebp - 0x24], esp
mov ebp, dword [ebp - 0x24]
sub esp, 0x2c
push edi
push esi
push 0x2634b
sub ebx, esi
dec eax
push 0
call fcn.004010d8
mov dword [ebp - 0x14], eax
or eax, eax
jne 0x402764
mov esi, edi
push 0xc1af5
push 0xb1070
call fcn.00401118
mov dword [0x41868a], eax
push 0
push 0x90f8c
push 0
lea eax, [0x4180e6]
push eax
call fcn.004011d4
push 0
push 0
push 0
mov edi, 0x654a12
mov dword [ebp - 8], 0x24995e
sub edi, dword [ebp - 8]
call dword [edi]
mov eax, 0
ror eax, 1
add eax, dword [0x4181db]
dec eax
sub eax, dword [0x4186e1]
rol eax, 1
mov dword [ebp - 0x24], eax
mov esi, eax
add dword [0x4191ed], esi
lea eax, [0x4188f6]
push eax
mov dword [ebp - 0x20], esi
inc edi
push 0xab79f
call fcn.00401480
mov dword [ebp - 0xc], eax
push 0
push 0x858ef
call fcn.00401554
push 0
lea eax, [0x418302]
push eax
lea eax, [0x418788]
push eax
sub eax, ebx
sub esi, eax
push 0
call fcn.00401228
mov dword [ebp - 0x20], eax
push 0
push 0
push 0x80000000
mov dword [ebp - 0x1c], 0x327e6c
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0xe3280
add ebx, dword [ebp - 0x24]
push dword [ebx]
pop ebx
call ebx
mov edi, 0x93
mov ebx, edi
push ebx
mov edi, 0x1bf1b1
mov esi, edi
mov dword [0x41873d], 0x2598b9
add esi, dword [0x41873d]
push esi
push 1
pop esi
push esi
mov eax, dword [sym.imp.USER32.DLL_GetClassNameA]
call eax
or eax, eax
jne 0x40171f
mov dword [0x4180ce], 0
mov edx, dword [0x4180ce]
push edx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
push edx
mov dword [ebp - 0x2c], 0
mov edi, dword [ebp - 0x2c]
push edi
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
push eax
push 0x9d3d9
pop ebx
mov dword [ebp - 4], 0x36dceb
add ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call ebx
or eax, eax
jne 0x401792
mov esi, 0
push esi
mov dword [ebp - 0x2c], 0xab
mov ecx, dword [ebp - 0x2c]
push ecx
xor eax, eax
push eax
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 4]
push eax
mov esi, 0x18
push esi
mov dword [ebp - 0x28], 0
mov edi, dword [ebp - 0x28]
push edi
mov edi, 3
mov esi, edi
push esi
mov dword [ebp - 4], 0x7b343
mov ebx, dword [ebp - 4]
mov eax, 0x38fd9d
add ebx, eax
push dword [ebx]
pop dword [0x4193bc]
mov ebx, dword [0x4193bc]
call ebx
or eax, eax
jne 0x40171c
lea eax, [0x41879d]
push eax
or ebx, edi
sub edi, eax
inc ebx
add eax, ebx
add edi, esi
push 0
call fcn.00401118
mov esi, 0x82167
add esi, 0x396eba
push esi
mov dword [ebp - 0x28], 0x26e7e8
mov edi, dword [ebp - 0x28]
mov ecx, 0x1aa49b
add edi, ecx
push edi
mov ecx, 0x5491
add ecx, 0x412cdb
push ecx
mov edi, 0
push edi
mov edx, dword [sym.imp.advapi32.dll_RegReplaceKeyA]
call edx
push 0
push 0x400000
push 0
push 0
push 0x30
push 0x2a
push 0xb
push 0x6b
push 0x300
push 0
push 0
push 0x10
mov esi, dword [sym.imp.USER32.DLL_CreateWindowExA]
call esi
push 0x685
pop ebx
shr ebx, 4
sub ebx, esi
shl ebx, 1
rol ebx, 2
dec ebx
add ebx, 0xe28
jns 0x4029aa
add ebx, 0x1a1
jbe 0x4029aa
sub dword [0x418659], ebx
mov ecx, ebx
add ecx, ebx
sub dword [0x4187e1], ecx
push 0x36c
pop edi
shl edi, 6
dec edi
mov esi, edi
shl esi, 6
rol esi, 4
add esi, 0x667
dec esi
mov dword [ebp - 0x24], esi
push 0x71
push 0x3c
push 0xf3
push eax
mov ebx, 0x2b82e0
mov edi, ebx
mov esi, 0x152dac
add edi, esi
mov edi, dword [edi]
call edi
lea ebx, [ebx + 0x41947d]
rol ebx, 1
add ebx, 0x4e4
jns 0x402a06
sub ebx, 0x48d
js 0x402a06
shr ebx, 1
inc ebx
sub ebx, dword [0x41941c]
sub ebx, 0xe56
shl ebx, 1
sub dword [0x418acc], ebx
sub eax, 0x2280b14
push 0xd5
pop ecx
dec ecx
rol ecx, 7
dec ecx
add ecx, dword [0x4181e5]
dec ecx
sub dword [0x4181f9], ecx
xor edi, edi
dec edi
sub edi, ecx
add edi, 0x948
jns 0x402a4b
sub edi, dword [0x41915a]
sub edi, dword [0x418eae]
rol edi, 6
sub dword [0x418f35], edi
sub eax, 0xfd97c9f1
mov dword [0x419172], eax
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x28]
push ebx
mov dword [0x418001], 0
mov eax, dword [0x418001]
push eax
mov ecx, 0xcdc8e0
mov edi, ecx
sub edi, 0x8d1834
call dword [edi]
or eax, eax
je 0x4016c3
mov edx, dword [0x419172]
push edx
mov esi, 0x3c538
mov ecx, esi
mov edx, 0x3dbde2
add ecx, edx
push ecx
push 3
pop eax
push eax
push 0x2f307d
pop esi
mov dword [ebp - 0x28], 0x11800b
add esi, dword [ebp - 0x28]
mov esi, dword [esi]
call esi
or eax, eax
jne 0x4016c3
ret