Function at 0x408270
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
sub esp, 0x310
mov eax, dword [0x45d580]
push eax
push 0x443228
lea eax, [ebp - 0x124]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
mov edx, dword [0x45d580]
push edx
push 0x4431f7
lea eax, [ebp - 0x124]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
mov ecx, dword [0x45d580]
push ecx
push 0x44325f
lea eax, [ebp - 0x124]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
mov ebx, dword [0x45d580]
push ebx
push 0x4431cc
lea eax, [ebp - 0x124]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
mov edi, dword [0x45d580]
push edi
push 0x44318f
lea eax, [ebp - 0x124]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
lea eax, [ebp - 0x18]
push eax
push 9
push 0
push 0x44327e
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x408472
mov dword [ebp - 0x24], 0x100
xor esi, esi
xor ebx, ebx
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegEnumKeyExA]
test eax, eax
jne 0x408468
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
je 0x4083d6
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0x100
inc ebx
jmp 0x40838b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
mov dword [ebp - 0x24], 0x100
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x408464
cmp dword [ebp - 0x20], 1
jne 0x408464
lea edx, [ebp - 0x324]
lea eax, [ebp - 0x124]
call fcn.0042dd90
test eax, eax
je 0x408464
lea edx, [ebp - 0x324]
call fcn.0042cc00
test eax, eax
jne 0x408464
mov eax, 1
mov edx, dword [ebp - 0x1c]
push edx
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp edi, dword [ebp - 0x24]
je 0x4083cc
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
test eax, eax
jne 0x4083cc
inc esi
mov dword [ebp - 0x24], 0x100
inc ebx
jmp 0x40838b
mov eax, edi
jmp 0x40842b
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov ecx, dword [0x45d580]
push ecx
push 0x44317b
lea eax, [ebp - 0x124]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push 3
push 0
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x408504
mov dword [ebp - 0x24], 0x100
xor ebx, ebx
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueA]
test eax, eax
jne 0x4084fa
cmp byte [ebp - 0x224], 0x2e
je 0x4084e7
inc ebx
mov dword [ebp - 0x24], 0x100
jmp 0x4084b6
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
jmp 0x4084de
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret