Function at 0x405980
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
lea eax, [ebp - 0x24]
push ebx
sub esp, 0x5c
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._parse_registry_key
test eax, eax
je 0x405a56
cmp dword [ebp + 8], 3
jle 0x405cc0
mov dword [ebp - 0x38], 0
mov edi, 3
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0
lea eax, [edi*4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + edi*4]
movzx eax, word [esi]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x405a26
lea ebx, [esi + 2]
mov dword [esp + 4], 0x4090f8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x405bc8
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x405a60
mov dword [esp], 0x69
call sym._output_message
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsupr]
mov dword [esp], 0x6a
mov dword [esp + 4], eax
call sym._output_message
mov edi, 1
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x2c], 1
inc edi
cmp dword [ebp + 8], edi
jg 0x4059e4
mov eax, dword [ebp - 0x3c]
test eax, eax
movzx eax, byte [ebp - 0x2c]
setne dl
or al, byte [ebp - 0x34]
je 0x405a86
test dl, dl
jne 0x405a26
mov eax, dword [ebp - 0x34]
mov esi, eax
and esi, 1
cmp dword [ebp - 0x38], 0x300
je 0x405a26
test byte [ebp - 0x2c], al
jne 0x405a26
mov eax, dword [ebp - 0x24]
mov byte [ebp - 0x41], dl
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._get_long_key
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
movzx edx, byte [ebp - 0x41]
test eax, eax
je 0x405e0b
lea eax, [ebp - 0x20]
mov byte [ebp - 0x40], dl
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], 0
or eax, 0x2001b
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp], ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
movzx edx, byte [ebp - 0x40]
sub esp, 0x14
test eax, eax
mov edi, eax
jne 0x405e6e
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
test ecx, ecx
jne 0x405dc7
mov ebx, dword [ebp - 0x34]
test ebx, ebx
jne 0x405dc7
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x405e96
mov dword [0x408190], 0
mov dword [esp], 0x200
mov ebx, 0x100
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
lea esi, [esi]
nop
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
je 0x405d36
cmp eax, 0xea
jne 0x405f06
lea eax, [ebx + ebx]
shl ebx, 2
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov ebx, dword [ebp - 0x2c]
mov esi, eax
jmp 0x405b50
mov dword [esp + 4], 0x4090fe
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x405c00
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x405a26
mov dword [ebp - 0x34], 1
jmp 0x405a67
mov dword [esp + 4], 0x409104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x405c30
mov eax, dword [ebp - 0x38]
test ah, 2
jne 0x405a26
or ah, 2
mov dword [ebp - 0x38], eax
jmp 0x405a67
mov dword [esp + 4], 0x409112
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x405c60
mov eax, dword [ebp - 0x38]
test ah, 1
jne 0x405a26
or ah, 1
mov dword [ebp - 0x38], eax
jmp 0x405a67
movzx eax, word [esi + 2]
test ax, ax
je 0x405a26
cmp word [esi + 4], 0
jne 0x405a26
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towlower]
cmp ax, 0x66
je 0x405db0
cmp ax, 0x76
jne 0x405a26
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x405a26
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x30]
inc edi
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x405a67
jmp 0x405a26
mov eax, dword [ebp - 0x24]
xor esi, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._get_long_key
mov dword [ebp - 0x34], 0
mov ebx, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], 0x12e
mov byte [ebp - 0x41], dl
mov dword [esp + 4], eax
mov dword [ebp - 0x40], ecx
call sym._ask_confirm
movzx edx, byte [ebp - 0x41]
mov ecx, dword [ebp - 0x40]
mov edi, eax
test edi, edi
jne 0x405ac9
mov dword [esp], 0x6d
call sym._output_message
jmp 0x405a56
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
sub esp, 8
test eax, eax
je 0x405b50
mov dword [ebp - 0x2c], eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x30]
push ecx
mov dword [esp + 4], eax
mov dword [esp], 0x12f
call sym._output_message
mov edx, dword [ebp - 0x2c]
cmp edx, 2
jne 0x405ec1
cmp dword [0x408190], 0
je 0x405f4b
mov dword [esp], 0x6e
call sym._output_message
jmp 0x405a51
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x405a26
mov dword [ebp - 0x40], 1
jmp 0x405a67
mov dword [0x408190], 0
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x405b33
mov ecx, esi
test cl, cl
jne 0x405ed2
test dl, dl
jne 0x405ed2
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [esp], 0x6c
call sym._output_message
jmp 0x405a56
test dl, dl
jne 0x405e15
mov eax, esi
test al, al
je 0x405e3c
mov eax, dword [ebp - 0x3c]
mov dword [esp], 0x12c
mov byte [ebp - 0x41], dl
mov dword [esp + 4], eax
mov dword [ebp - 0x40], ecx
call sym._ask_confirm
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ebp - 0x41]
mov edi, eax
jmp 0x405d1d
mov edi, dword [ebp - 0x2c]
test edi, edi
je 0x405cfb
mov eax, dword [ebp - 0x30]
mov dword [esp], 0x12d
mov byte [ebp - 0x41], dl
mov dword [esp + 4], eax
mov dword [ebp - 0x40], ecx
call sym._ask_confirm
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ebp - 0x41]
mov edi, eax
jmp 0x405d1d
cmp eax, 2
jne 0x405ec1
cmp dword [0x408190], 0
je 0x405f17
mov dword [esp], 0x6e
mov edi, 1
call sym._output_message
jmp 0x405a56
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov edi, eax
push edx
push edx
test eax, eax
je 0x405f2d
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
cmp edi, 2
je 0x405e73
mov dword [esp], 0x6b
call sym._output_message
jmp 0x405a51
mov ecx, dword [ebp - 0x3c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov ebx, eax
push edx
mov eax, dword [ebp - 0x20]
push edx
test ebx, ebx
je 0x405dee
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
cmp ebx, 2
je 0x405e73
jmp 0x405ec1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x20]
jmp 0x405dee
mov dword [esp], 0x6f
mov edi, 1
call sym._output_message
jmp 0x405a56
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0x409120
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x20]
push esi
push esi
jmp 0x405dee
mov dword [esp], 0x6f
call sym._output_message
jmp 0x405a51