Function at 0x404650
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x428dc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov eax, dword [0x4346c0]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x138], edi
push ecx
lea ecx, [esp + 0x10]
call fcn.0041ea0b
push 1
lea edx, [esp + 0x18]
push edi
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x144], 1
call fcn.0041c398
mov eax, dword [eax]
push 0x434228
push eax
mov byte [esp + 0x140], 2
call fcn.0040e344
add esp, 8
test eax, eax
jne 0x404708
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x14]
call fcn.0041c42e
mov eax, dword [eax]
push 0x434224
push eax
call fcn.0040e344
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
sete bl
call fcn.0041e99d
test bl, bl
je 0x404708
mov bl, 1
jmp 0x40470a
xor bl, bl
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 1
call fcn.0041e99d
test bl, bl
je 0x40475d
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0xc]
add eax, 0xfffffffe
push eax
push 1
push edx
call fcn.0041c398
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x13c], 3
call fcn.0041ead6
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 1
call fcn.0041e99d
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x10]
call fcn.0041c59a
test eax, eax
jl 0x404777
mov dword [esp + 0x1c], reloc.OLEAUT32.dll_SysReAllocString
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x10]
call fcn.0041c59a
test eax, eax
jl 0x404791
mov dword [esp + 0x1c], OleUIBusyA
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x10]
call fcn.0041c59a
test eax, eax
jl 0x4047ab
mov dword [esp + 0x1c], SysReAllocStringLen
push 0x43418c
lea ecx, [esp + 0x10]
call fcn.0041c59a
inc eax
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0041c375
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x13c], 4
call fcn.0041ead6
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 1
call fcn.0041e99d
mov esi, dword [esp + 0x144]
test esi, esi
je 0x404845
cmp byte [esi], 0
je 0x404845
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4049d5
mov ecx, dword [esp + 0x18]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x404835
mov edi, 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4049d5
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4049d5
mov eax, dword [0x4346c0]
mov ebx, 0x104
xor esi, esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push esi
push esi
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x3c]
push ecx
push edx
push esi
push eax
call edi
cmp eax, 0x103
je 0x4048e5
test eax, eax
mov byte [esp + 0x138], 1
lea ecx, [esp + 0x14]
jne 0x4048f1
call fcn.0041e99d
mov ecx, dword [0x4346c0]
inc esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push 0
lea eax, [esp + 0x3c]
push edx
push eax
push esi
push ecx
call edi
cmp eax, 0x103
jne 0x4048a0
mov byte [esp + 0x138], 1
lea ecx, [esp + 0x14]
call fcn.0041e99d
dec esi
js 0x4049b1
mov edx, dword [0x4346c0]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
lea eax, [esp + 0x30]
push 0
lea ecx, [esp + 0x3c]
push eax
push ecx
push esi
push edx
call edi
cmp eax, 0x103
je 0x4049a0
test eax, eax
jne 0x4049a0
mov eax, dword [0x4346c0]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._s_s
push eax
mov byte [esp + 0x148], 7
call fcn.0041c920
mov ecx, dword [esp + 0x24]
push 0x438548
push ecx
call fcn.00404650
add esp, 0x18
mov byte [esp + 0x138], 6
test eax, eax
lea ecx, [esp + 0x14]
je 0x40499b
call fcn.0041e99d
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 1
call fcn.0041e99d
dec esi
jns 0x4048fd
jmp 0x4049b1
call fcn.0041e99d
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 1
call fcn.0041e99d
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4049e8
mov edi, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x138], 0
call fcn.0041e99d
jmp 0x4049fd
lea ecx, [esp + 0xc]
mov byte [esp + 0x138], 0
call fcn.0041e99d
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x20]
mov dword [esp + 0x138], 0xffffffff
call fcn.0041e99d
mov ecx, dword [esp + 0x130]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret