Function at 0x403d00
Capabilities:
Delete registry key

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x68]
mov dword [esp + 0x34], 0
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x38], 0
test esi, esi
je 0x403e28
test edi, edi
je 0x403e28
mov ebp, dword [sym.imp.ucrtbase.dll_wcsrchr]
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call ebp
mov ebx, eax
test eax, eax
je 0x403f28
cmp word [esi], 0
mov eax, esi
je 0x403f68
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403d60
sub eax, esi
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x403d80
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call ebp
xor edx, edx
mov word [eax], dx
lea ebp, [eax + 2]
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x403f40
mov dword [esp + 4], edi
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x403e38
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
xor esi, esi
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebp
sub esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x403e2a
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
cmp dword [esp + 0x3c], 2
je 0x403f00
test eax, eax
jne 0x403f00
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.shcore.dll_SHCopyKeyW]
sub esp, 0x10
test eax, eax
jne 0x403f72
mov eax, dword [esp + 0x64]
mov dword [esp + 4], esi
mov esi, 1
mov dword [esp], eax
call dword [sym.imp.shcore.dll_SHDeleteKeyW]
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 8
test eax, eax
je 0x403df5
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x7e0
mov dword [esp], eax
call fcn.004026d0
jmp 0x403df3
mov eax, dword [esp + 0x60]
mov dword [esp + 8], ebp
xor esi, esi
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call fcn.004026d0
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403df5
mov eax, dword [esp + 0x64]
mov ebp, esi
mov dword [esp + 0x34], eax
jmp 0x403dd9
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x7e0
xor esi, esi
mov dword [esp], eax
call fcn.004026d0
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403df5
mov eax, 2
jmp 0x403d6e
mov eax, dword [esp + 0x38]
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call ebp
sub esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
sub esp, 8
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x7e0
mov dword [esp], eax
call fcn.004026d0
jmp 0x403df3