Function at 0x406330
Capabilities:
Delete file
Query environment variable
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x40b729
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x411028]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x411744]
xor edi, edi
cmp eax, edi
je 0x406369
push 0x411750
call eax
mov eax, dword [0x411740]
cmp eax, edi
je 0x406379
push Ordinal_4
call eax
xor esi, esi
mov dword [esp + 0x1c], edi
cmp dword [0x41174c], edi
je 0x4063a4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x41174c]
cmp dword [esp + 0x1c], edi
je 0x4063a4
mov esi, 0x100
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
or esi, 0x20006
push esi
push edi
push edi
push edi
push str.SOFTWAREGlarySoftRegistryDefraghivelist
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x4065dd
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x2c], edi
mov edi, dword [ebx + 0xc]
cmp edi, dword [ebx + 0x10]
jbe 0x4063f1
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov esi, dword [ebx]
mov ebp, dword [ebx + 0x10]
cmp dword [ebx + 0xc], ebp
jbe 0x406401
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ebx, dword [ebx]
test esi, esi
je 0x40640b
cmp esi, ebx
je 0x406415
mov ebx, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
call ebx
jmp 0x40641b
mov ebx, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
cmp edi, ebp
je 0x4064d8
push 0x40d988
lea ecx, [esp + 0x18]
call dword [0x40c328]
test esi, esi
jne 0x4064c5
call ebx
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406445
call ebx
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
test esi, esi
jne 0x4064cc
call ebx
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406462
call ebx
mov ecx, edi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::MakeUpper]
mov eax, dword [esp + 0x14]
mov ebx, dword [eax - 0xc]
mov ebp, eax
test esi, esi
jne 0x4064d0
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x40648a
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, dword [edi]
mov eax, dword [esp + 0x18]
lea ecx, [ebx + ebx + 2]
push ecx
push ebp
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
jne 0x4064d4
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x4064b9
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ebx, dword [esp + 0x34]
add edi, 0x20
jmp 0x4063f3
mov eax, dword [esi]
jmp 0x40643e
mov eax, dword [esi]
jmp 0x40645b
mov eax, dword [esi]
jmp 0x40647f
mov eax, dword [esi]
jmp 0x4064ae
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
call fcn.00406800
test eax, eax
jne 0x40652a
mov eax, dword [0x411748]
test eax, eax
je 0x406506
mov edx, dword [0x411750]
push edx
call eax
mov eax, dword [0x41173c]
test eax, eax
je 0x406516
push Ordinal_4
call eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, 0x10a
jmp 0x4065dd
call fcn.00406a70
call fcn.00406940
mov esi, eax
test esi, esi
je 0x40656a
mov eax, dword [0x411748]
test eax, eax
je 0x40654c
mov ecx, dword [0x411750]
push ecx
call eax
mov eax, dword [0x41173c]
test eax, eax
je 0x40655c
push Ordinal_4
call eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
jmp 0x4065dd
call fcn.00406600
push 0xfffe
call sub.mfc90u.dll_new__
add esp, 4
push 0xfffe
mov esi, eax
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x7fff
push esi
push str._TEMP_gumarktemp.dat
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call sub.mfc90u.dll_delete__
mov eax, dword [0x411748]
add esp, 4
test eax, eax
je 0x4065c1
mov edx, dword [0x411750]
push edx
call eax
mov eax, dword [0x41173c]
test eax, eax
je 0x4065d1
push Ordinal_4
call eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4