Function at 0x40fb70
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a07a8
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x4c2100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
mov ebx, dword [ebp + 0x1c]
cmp ebx, 7
mov esi, dword [ebp + 8]
cmova eax, esi
cmp dword [edi + 0x14], 7
jbe 0x40fbcc
mov ecx, dword [edi]
push dword [ebp + 0x18]
mov edx, dword [edi + 0x10]
push eax
call fcn.00416db0
add esp, 8
test eax, eax
je 0x40fc1c
cmp ebx, 7
jbe 0x41018b
lea ecx, [ebx*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x40fc0d
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410201
push ecx
push esi
call fcn.00476bd7
add esp, 8
jmp 0x41018b
mov byte [ebp - 0x1ac], 0
lea edx, [edi + 0x18]
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x48]
call fcn.0041a2c0
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 0x1ac], 0
push dword [ebp - 0x1ac]
call fcn.0041ac10
add esp, 4
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x1e4]
call fcn.00413500
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x18], 8
push eax
lea ecx, [ebp - 0x1e4]
call fcn.004035a0
lea ecx, [ebp - 0x1e4]
call fcn.00405750
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1d0]
cmp ecx, 7
jbe 0x40fcd1
mov edx, dword [ebp - 0x1e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40fcc7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101a9
push ecx
push edx
call fcn.00476bd7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d0], 7
mov word [ebp - 0x1e4], ax
cmp ecx, 7
jbe 0x40fd32
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40fd28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101a9
push ecx
push edx
call fcn.00476bd7
add esp, 8
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], 0
push eax
push 0
push 0
push 0x4a2400
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x40fdd3
mov ecx, dword [ebp - 0x34]
cmp ecx, 7
jbe 0x40fd90
mov edx, dword [ebp - 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40fd86
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410201
push ecx
push edx
call fcn.00476bd7
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 7
jbe 0x41018b
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40fdc4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410201
push ecx
push edx
call fcn.00476bd7
add esp, 8
jmp 0x41018b
push 0xb0
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.004786f0
add esp, 8
lea ecx, [ebp - 0x1a8]
call fcn.00410e00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x198]
mov edx, dword [ebp - 0x1b0]
lea ebx, [edi + 0x48]
call fcn.00417410
mov edx, 0x4bb120
mov ecx, eax
call fcn.00417410
cmp dword [ebx + 0x14], 7
mov edx, ebx
jbe 0x40fe22
mov edx, dword [ebx]
push dword [ebx + 0x10]
mov ecx, eax
call fcn.0041a6d0
add esp, 4
mov edx, str..lnk
mov ecx, eax
call fcn.00417750
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00410cf0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x30]
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x1cc]
push dword [ebp - 0x18]
call fcn.0041a2c0
add esp, 4
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 7
call fcn.00405020
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1b8]
mov byte [ebp - 0x1b1], al
cmp ecx, 7
jbe 0x40fec5
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40feb5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101ae
push ecx
push edx
call fcn.00476bd7
mov al, byte [ebp - 0x1b1]
add esp, 8
test al, al
je 0x40ff34
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x30]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1cc]
call fcn.0041a2c0
add esp, 4
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 8
call fcn.00405100
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1b8]
cmp ecx, 7
jbe 0x40ff34
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ff2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101b3
push ecx
push edx
call fcn.00476bd7
add esp, 8
cmp dword [edi + 0x44], 7
lea eax, [edi + 0x30]
mov dword [ebp - 0x1ac], 0
jbe 0x40ff49
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x1ac]
push ecx
push 0
push 0x2011f
push 0
push 0
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4101b8
mov esi, dword [ebp - 0x1ac]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 9
cmp dword [ebx + 0x14], 7
jbe 0x40ff88
mov ebx, dword [ebx]
push 0
push 0x20006
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x4101da
push 0xb0
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.004786f0
add esp, 8
lea ecx, [ebp - 0xf8]
call fcn.00410e00
mov edx, str.start__min_cmd__c_del
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe8]
call fcn.00417750
cmp dword [edi + 0x14], 7
mov ecx, eax
mov eax, dword [edi + 0x10]
jbe 0x40ffe0
mov edi, dword [edi]
push eax
mov edx, edi
call fcn.0041a6d0
add esp, 4
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0xf8]
push eax
call fcn.00410cf0
cmp dword [eax + 0x14], 7
jbe 0x410005
mov eax, dword [eax]
push eax
call fcn.0047e83e
mov ecx, dword [ebp - 0x1b8]
add esp, 4
cmp ecx, 7
jbe 0x41004e
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410044
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101fc
push ecx
push edx
call fcn.00476bd7
add esp, 8
lea ecx, [ebp - 0xf8]
call fcn.0040dae0
test esi, esi
je 0x4100ac
cmp esi, reloc.WS2_32.dll_accept
je 0x4100ac
cmp esi, reloc.WS2_32.dll_bind
je 0x4100ac
cmp esi, 0x80000000
je 0x4100ac
cmp esi, reloc.WS2_32.dll_getpeername
je 0x4100ac
cmp esi, reloc.WS2_32.dll_getsockopt
je 0x4100ac
cmp esi, reloc.WS2_32.dll_connect
je 0x4100ac
cmp esi, 0x80000060
je 0x4100ac
cmp esi, 0x80000050
je 0x4100ac
cmp esi, reloc.WS2_32.dll_closesocket
je 0x4100ac
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x4100e6
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4100dc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410201
push ecx
push edx
call fcn.00476bd7
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0040dae0
mov ecx, dword [ebp - 0x34]
cmp ecx, 7
jbe 0x41013f
mov edx, dword [ebp - 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410135
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410201
push ecx
push edx
call fcn.00476bd7
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 7
jbe 0x410179
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41016f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410206
push ecx
push edx
call fcn.00476bd7
add esp, 8
mov al, 1
jmp 0x41018d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00476631
mov esp, ebp
pop ebp
ret
call fcn.0047fa03
call fcn.0047fa03
call fcn.0047fa03
push str.RegCreateKeyExW_failed.
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004061e0
push 0x4c0ce0
lea eax, [ebp - 0x1f8]
push eax
call fcn.0047804d
push str.RegDeleteKeyExW_failed.
push eax
lea ecx, [ebp - 0x20c]
call fcn.004061e0
push 0x4c0ce0
lea eax, [ebp - 0x20c]
push eax
call fcn.0047804d
call fcn.0047fa03
call fcn.0047fa03
call fcn.0047fa03
int3