Function at 0x409790
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4262b0
call fcn.0041bdc0
sub esp, 0x48
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0x10], esi
jne 0x4097ae
mov dword [ebp + 0x10], 0x427e78
mov eax, reloc.WSOCK32.dll_closesocket
cmp dword [ebp + 0xc], eax
jne 0x4098b8
mov ecx, dword [ebp + 0x10]
cmp word [ecx], si
jne 0x4098b8
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x409ca3
lea ecx, [ebp - 0x3c]
call fcn.00402ccc
mov eax, dword [ebp + 8]
mov edi, 0x100
mov dword [ebp - 4], esi
mov dword [ebp + 0x10], esi
mov cx, word [eax + 0x35e]
mov word [eax + 0x35e], 1
mov word [ebp - 0x20], cx
lea ecx, [ebp - 0x3c]
mov dword [ebp + 0xc], edi
call fcn.00402cd9
lea ecx, [ebp - 0x3c]
call fcn.00409563
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
lea ecx, [ebp + 0xc]
push esi
push ecx
push eax
push esi
push dword [ebp - 0x10]
call ebx
cmp eax, esi
jne 0x40988d
lea ecx, [ebp - 0x3c]
call fcn.00402ebf
push 0x5c
lea ecx, [ebp - 0x3c]
call fcn.00402e39
push dword [ebp + 0x14]
lea ecx, [ebp - 0x3c]
call fcn.00409563
push eax
push reloc.WSOCK32.dll_closesocket
push dword [ebp + 8]
call fcn.00409790
add esp, 0x10
inc dword [ebp + 0x10]
lea ecx, [ebp - 0x3c]
mov dword [ebp + 0xc], edi
call fcn.00402cd9
lea ecx, [ebp - 0x3c]
call fcn.00409563
push esi
push esi
push esi
lea ecx, [ebp + 0xc]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
jmp 0x409832
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3c]
call fcn.00402d02
mov ecx, dword [ebp + 8]
mov ax, word [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
mov word [ecx + 0x35e], ax
lea ecx, [ebp - 0x3c]
jmp 0x409c9e
lea ecx, [ebp - 0x30]
call fcn.00402ccc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 3
mov edi, 0x100
dec dword [ebp - 0x1c]
lea ecx, [ebp - 0x30]
call fcn.00402cd9
push dword [ebp + 0x10]
lea ecx, [ebp - 0x30]
call fcn.00402e0f
mov eax, dword [ebp - 0x1c]
sub eax, esi
je 0x40990c
dec eax
jne 0x409919
push str.SOFTWARE_
lea ecx, [ebp - 0x30]
call fcn.00402e0f
push str.ClassesVirtualStoreMACHINE_
lea ecx, [ebp - 0x30]
call fcn.00402e0f
push str.SOFTWARE_
lea ecx, [ebp - 0x30]
call fcn.00402e0f
push str.Public_DomainBlat
lea ecx, [ebp - 0x30]
call fcn.00402e0f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x30]
push eax
push 0xf003f
push esi
call fcn.00409563
push eax
push dword [ebp + 0xc]
call ebx
cmp eax, esi
jne 0x409c37
lea ecx, [ebp - 0x48]
call fcn.00402ccc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00402ccc
push edi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00402d7a
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x48]
push eax
call fcn.00402d1f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x14]
push str._all_
call fcn.00409563
push eax
call fcn.0041b0d0
pop ecx
test eax, eax
pop ecx
jne 0x4099b9
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409cb4
add esp, 0xc
jmp 0x409b18
mov ecx, dword [ebp + 0x14]
push str._default_
call fcn.00409563
push eax
call fcn.0041b0d0
pop ecx
test eax, eax
pop ecx
jne 0x409a5c
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x30]
push eax
push 0xf003f
push esi
mov dword [ebp - 0x14], esi
call fcn.00409563
push eax
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x409a4e
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], edi
call fcn.00402cd9
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
push esi
mov dword [ebp - 0x24], eax
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00409563
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x409a4e
lea ecx, [ebp - 0x3c]
call fcn.00409563
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
jne 0x409a47
mov dword [ebp - 0x20], 1
dec dword [ebp - 0x14]
cmp eax, esi
je 0x4099f5
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409b18
mov ecx, dword [ebp + 0x14]
call fcn.00409563
cmp word [eax], si
je 0x409b18
push 0x42a210
lea ecx, [ebp - 0x30]
call fcn.00402e0f
push dword [ebp + 0x14]
lea ecx, [ebp - 0x30]
call fcn.00402e48
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x30]
push eax
push 0xf003f
push esi
mov dword [ebp - 0x14], esi
call fcn.00409563
push eax
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x409afd
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], edi
call fcn.00402cd9
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
push esi
mov dword [ebp - 0x24], eax
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00409563
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x409afd
lea ecx, [ebp - 0x3c]
call fcn.00409563
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
jne 0x409af6
mov dword [ebp - 0x20], 1
dec dword [ebp - 0x14]
cmp eax, esi
je 0x409aa4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x30]
call fcn.00409563
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x48]
push eax
push 0xf003f
push esi
call fcn.00409563
push eax
push dword [ebp + 0xc]
call ebx
cmp eax, esi
jne 0x409c17
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], edi
call fcn.00402cd9
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00409563
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
mov dword [ebp - 0x14], eax
jne 0x409bca
lea ecx, [ebp - 0x54]
call fcn.00402ccc
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x48]
push eax
push 0xf003f
push esi
call fcn.00409563
push eax
push dword [ebp + 0xc]
call ebx
lea ecx, [ebp - 0x54]
call fcn.00402cd9
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x18], edi
call fcn.00409563
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
call fcn.00402cbe
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0x103
jne 0x409c17
lea ecx, [ebp - 0x48]
call fcn.00409563
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
jne 0x409c17
lea ecx, [ebp - 0x48]
call fcn.00402eb2
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x14], eax
call fcn.00409563
mov ecx, dword [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov word [eax + ecx*2 - 0xa], si
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x3c]
call fcn.00402d02
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00402cbe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00402cbe
cmp dword [ebp - 0x1c], esi
ja 0x4098df
cmp dword [ebp - 0x20], esi
jne 0x409c8f
cmp dword [ebp + 0xc], 0x80000002
jne 0x409c64
push dword [ebp + 0x14]
push esi
push connect
push dword [ebp + 8]
call fcn.00409790
add esp, 0x10
jmp 0x409c8f
cmp dword [ebp + 0xc], 0x80000001
jne 0x409c78
push dword [ebp + 0x14]
push esi
push reloc.WSOCK32.dll_closesocket
jmp 0x409c57
mov eax, dword [ebp + 8]
cmp word [eax + 0x35e], si
jne 0x409c8f
push str.Error_in_finding_or_accessing_blat_profile_in_the_registry_n
call fcn.0041b83f
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00402d02
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402cbe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret