Function at 0x403620
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f8
push edi
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402ef0
add esp, 4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004014e0
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.004018a0
add esp, 0xc
cmp eax, 0x723f2ad5
jne 0x403664
mov al, byte [ebp - 4]
jmp 0x403a38
mov eax, dword [0x42eb64]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [0x42eb68]
mov dword [ebp - 0x4cc], ecx
mov dx, word [0x42eb6c]
mov word [ebp - 0x4c8], dx
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x4c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4d0]
push eax
call fcn.004014e0
add esp, 4
lea ecx, [ebp + eax - 0x4d0]
mov dword [ebp - 0x4e4], ecx
push 0xa
mov edx, dword [ebp - 0x4e4]
push edx
call fcn.00402a50
add esp, 8
mov eax, dword [ebp - 0x4e4]
mov byte [eax + 0xa], 0
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x46c]
push edx
call fcn.00402a30
add esp, 8
mov eax, dword [ebp - 0x4e4]
mov byte [eax + 9], 0
push 0
lea ecx, [ebp - 0x4e0]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x4d0]
push edx
push closesocket
call dword [0x42ec58]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x46c]
push ecx
push closesocket
call dword [0x42ec58]
mov byte [ebp - 0x408], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x407]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [0x42e968]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.00402a30
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x408]
push edx
call section.CODE
add esp, 8
push 0
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x408]
push ecx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
mov edx, dword [0x42ea84]
mov dword [ebp - 0x4dc], edx
mov eax, dword [0x42ea88]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [0x42ea8c]
mov dword [ebp - 0x4d4], ecx
push 0
push 0
call fcn.00402410
push eax
push 1
lea edx, [ebp - 0x4dc]
push edx
call fcn.00402f30
add esp, 4
push eax
lea eax, [ebp - 0x4d0]
push eax
push closesocket
call fcn.00402f90
mov ecx, dword [0x42ea80]
mov dword [ebp - 0x4d5], ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 2
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
push closesocket
call fcn.00402f90
movsx edx, byte [0x42f6ec]
test edx, edx
je 0x403870
mov eax, dword [0x42eb58]
mov dword [ebp - 0x4f0], eax
mov ecx, dword [0x42eb5c]
mov dword [ebp - 0x4ec], ecx
mov dx, word [0x42eb60]
mov word [ebp - 0x4e8], dx
mov byte [ebp - 0x4e9], 0x72
push 1
push 0
push 0x42f6ec
push 1
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x408]
push ecx
push closesocket
call fcn.00402f90
mov edx, dword [0x42eac0]
mov dword [ebp - 0x4f8], edx
mov ax, word [0x42eac4]
mov word [ebp - 0x4f4], ax
mov cl, byte [0x42eac6]
mov byte [ebp - 0x4f2], cl
push 1
push 0
push 0x42f720
push 1
lea edx, [ebp - 0x4f8]
push edx
call fcn.00402f30
add esp, 4
push eax
lea eax, [ebp - 0x408]
push eax
push closesocket
call fcn.00402f90
push str.ntizOR_zd
call fcn.004014e0
add esp, 4
add eax, 1
push eax
push str.ntizOR_zd
lea ecx, [ebp - 0x408]
push ecx
call fcn.004014e0
add esp, 4
lea edx, [ebp + eax - 0x408]
push edx
call fcn.00402970
add esp, 0xc
push 0x42eb48
lea eax, [ebp - 0x408]
push eax
call section.CODE
add esp, 8
lea ecx, [ebp - 0x408]
push ecx
push closesocket
lea edx, [ebp - 0x4d0]
push edx
push closesocket
call fcn.00403380
add esp, 0x10
and eax, 0xff
test eax, eax
je 0x4039fa
push 0
push 0x42f828
push 0x42eb3c
push 0x42f828
push 0
push 0x42f828
push 0
push 0
push 2
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [0x42ec80]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401b10
add esp, 4
test eax, eax
je 0x403986
mov edx, dword [ebp + 8]
push edx
call fcn.004034c0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x4039bc
push 0x5c
lea eax, [ebp - 0x408]
push eax
call fcn.00401850
add esp, 8
mov byte [eax], 0
lea ecx, [ebp - 0x408]
push ecx
push closesocket
lea edx, [ebp - 0x46c]
push edx
push closesocket
call fcn.00403380
add esp, 0x10
jmp 0x4039fa
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.00402a30
add esp, 8
push str.RB_j_
lea edx, [ebp - 0x408]
push edx
call fcn.00402d40
add esp, 8
push 0
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x42ec94]
mov edx, dword [ebp - 0x4e0]
push edx
call dword [0x42ec1c]
mov eax, dword [ebp - 8]
push eax
call dword [0x42ec1c]
lea ecx, [ebp - 0x4d0]
push ecx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea edx, [ebp - 0x46c]
push edx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov al, byte [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret