Function at 0x402080
Capabilities:
Delete file
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x41c470]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x241], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 1
je 0x4020ec
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4020ec
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 6
je 0x4020ec
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 7
je 0x4020ec
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 8
je 0x4020ec
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 9
je 0x4020ec
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x402100
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov byte [ebp - 0x241], cl
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 1
je 0x402142
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 2
je 0x402142
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x14
je 0x402142
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x13
je 0x402142
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 5
je 0x402142
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 4
jne 0x402193
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
je 0x40217e
mov edx, dword [ebp - 4]
movsx eax, word [edx]
cmp eax, 0x5c5c
je 0x40217e
mov ecx, dword [ebp - 4]
push ecx
push 0x41d5b0
lea edx, [ebp - 0x240]
push edx
call fcn.0040a630
add esp, 8
push eax
call fcn.0040a640
add esp, 8
jmp 0x402191
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.0040a630
add esp, 8
jmp 0x4021b1
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 3
je 0x4021b1
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.0040a630
add esp, 8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
mov dword [ebp - 0x2c4], ecx
cmp dword [ebp - 0x2c4], 0x14
ja case.default.0x4021d0
mov edx, dword [ebp - 0x2c4]
jmp dword [edx*4 + 0x403100]
push 0x41d6b8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4021fc
push 0x41632c
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x402210
push 0x416330
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
push 0x41d6b8
push 0x416338
lea edx, [ebp - 0x138]
push edx
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x402256
lea eax, [ebp - 0x138]
push eax
push 0
push 0x180
mov ecx, dword [0x41d490]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
movzx edx, byte [ebp - 0x241]
push edx
push 0x41d5b0
call fcn.004016b0
add esp, 8
movzx ecx, byte [ebp - 0x241]
cmp eax, ecx
jne 0x40228c
push 0x416340
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
jmp 0x4022a0
push 0x416344
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
push 0x41d5b0
push 0x41634c
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x4022e5
lea edx, [ebp - 0x138]
push edx
push 0
push 0x180
mov eax, dword [0x41d490]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
movzx ecx, byte [ebp - 0x241]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.004016b0
add esp, 8
mov dword [ebp - 0x248], eax
movzx eax, byte [ebp - 0x241]
cmp dword [ebp - 0x248], eax
jne 0x40232c
push 0x416354
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
jmp 0x40235f
cmp dword [ebp - 0x248], 0
jle 0x40234b
push 0x416358
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
jmp 0x40235f
push 0x416360
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
lea ecx, [ebp - 0x240]
push ecx
push str.dir_:_t
lea edx, [ebp - 0x138]
push edx
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x4023a7
lea eax, [ebp - 0x138]
push eax
push 0
push 0x180
mov ecx, dword [0x41d490]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
mov dword [ebp - 0x24c], 0
cmp dword [0x41d494], 0
je 0x402509
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffff
je 0x402507
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x260]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41d498]
mov dword [ebp - 0x268], eax
mov ecx, dword [0x41d49c]
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x260]
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x264]
cmp ecx, dword [ebp - 0x254]
jl 0x4024c2
jg 0x40247b
mov edx, dword [ebp - 0x268]
cmp edx, dword [ebp - 0x258]
jbe 0x4024c2
mov eax, dword [ebp - 0x268]
sub eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x264]
sbb ecx, dword [ebp - 0x254]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2c8], ecx
cmp dword [ebp - 0x2c8], 0
jg 0x4024c0
jl 0x4024b6
cmp dword [ebp - 0x2cc], 0x5f5e100
jae 0x4024c0
mov dword [ebp - 0x24c], 1
jmp 0x402507
mov edx, dword [ebp - 0x258]
sub edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x254]
sbb eax, dword [ebp - 0x264]
mov dword [ebp - 0x2d4], edx
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jg 0x402507
jl 0x4024fd
cmp dword [ebp - 0x2d4], 0x5f5e100
jae 0x402507
mov dword [ebp - 0x24c], 1
jmp 0x402513
mov dword [ebp - 0x24c], 1
cmp dword [ebp - 0x24c], 0
je 0x40252b
lea ecx, [ebp - 0x240]
push ecx
call fcn.00401e40
add esp, 4
cmp dword [ebp - 0x24c], 0
je 0x40255b
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40255b
push 0x416370
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x40256f
push 0x416374
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
lea edx, [ebp - 0x240]
push edx
push str.ole:_t
lea eax, [ebp - 0x138]
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x4025b7
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0x180
mov edx, dword [0x41d490]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
mov dword [ebp - 0x26c], 0
cmp dword [0x41d494], 0
je 0x40271a
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
je 0x402718
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0
lea ecx, [ebp - 0x280]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x41d498]
mov dword [ebp - 0x288], ecx
mov edx, dword [0x41d49c]
mov dword [ebp - 0x284], edx
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x284]
cmp edx, dword [ebp - 0x274]
jl 0x4026d3
jg 0x40268c
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x278]
jbe 0x4026d3
mov ecx, dword [ebp - 0x288]
sub ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x284]
sbb edx, dword [ebp - 0x274]
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d8], edx
cmp dword [ebp - 0x2d8], 0
jg 0x4026d1
jl 0x4026c7
cmp dword [ebp - 0x2dc], 0x5f5e100
jae 0x4026d1
mov dword [ebp - 0x26c], 1
jmp 0x402718
mov eax, dword [ebp - 0x278]
sub eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x274]
sbb ecx, dword [ebp - 0x284]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], ecx
cmp dword [ebp - 0x2e0], 0
jg 0x402718
jl 0x40270e
cmp dword [ebp - 0x2e4], 0x5f5e100
jae 0x402718
mov dword [ebp - 0x26c], 1
jmp 0x402724
mov dword [ebp - 0x26c], 1
cmp dword [ebp - 0x26c], 0
je 0x402754
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402754
push 0x416384
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x402768
push 0x416388
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
lea edx, [ebp - 0x240]
push edx
push str.file:_t
lea eax, [ebp - 0x138]
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x4027b0
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0x180
mov edx, dword [0x41d490]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [0x41d498], ecx
mov dword [0x41d49c], edx
mov dword [0x41d494], 1
jmp case.default.0x4021d0
mov dword [ebp - 0x28c], 0
lea eax, [ebp - 0x290]
push eax
push 0x416398
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4028e9
mov dword [ebp - 0x29c], 4
mov dword [ebp - 0x294], 0
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x294]
push edx
lea eax, [ebp - 0x298]
push eax
push 0
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x290]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4028e9
cmp dword [ebp - 0x298], 4
jne 0x4028e9
cmp dword [ebp - 0x294], 0
jbe 0x4028e9
mov eax, dword [ebp - 0x294]
sub eax, 1
mov dword [ebp - 0x294], eax
jne 0x4028b9
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x290]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [0x41d4a4], 0
jne 0x4028ad
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4028ab
mov dword [ebp - 0x28c], 2
jmp 0x4028b7
mov dword [ebp - 0x28c], 2
jmp 0x4028e9
push 4
lea ecx, [ebp - 0x294]
push ecx
mov edx, dword [ebp - 0x298]
push edx
push 0
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x290]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x28c], 1
cmp dword [ebp - 0x28c], 0
jne 0x402908
push 0x4163d0
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
jmp 0x40293b
cmp dword [ebp - 0x28c], 1
jne 0x402927
push 0x4163d8
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x40293b
push 0x4163e0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
lea edx, [ebp - 0x240]
push edx
push str.dll:_t
lea eax, [ebp - 0x138]
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x402983
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0x180
mov edx, dword [0x41d490]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4029a3
mov dword [0x41d4a4], 1
jmp case.default.0x4021d0
mov dword [ebp - 0x2a0], 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
mov dword [ebp - 0x2e8], edx
mov eax, dword [ebp - 0x2e8]
sub eax, 6
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
ja case.default.0x4029e0
mov ecx, dword [ebp - 0x2e8]
jmp dword [ecx*4 + 0x403154]
mov dword [ebp - 0x2a0], 0x80000000
push 0x4163ec
push 0x41d4a8
call fcn.0040a630
add esp, 8
jmp case.default.0x4029e0
mov dword [ebp - 0x2a0], 0x80000005
push 0x4163f4
push 0x41d4a8
call fcn.0040a630
add esp, 8
jmp case.default.0x4029e0
mov dword [ebp - 0x2a0], 0x80000001
push 0x4163fc
push 0x41d4a8
call fcn.0040a630
add esp, 8
jmp case.default.0x4029e0
mov dword [ebp - 0x2a0], 0x80000002
push 0x416404
push 0x41d4a8
call fcn.0040a630
add esp, 8
jmp case.default.0x4029e0
mov dword [ebp - 0x2a0], 0x80000003
push 0x41640c
push 0x41d4a8
call fcn.0040a630
add esp, 8
movzx edx, byte [ebp - 0x241]
push edx
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x2a0]
push ecx
call fcn.00401820
add esp, 0xc
mov dword [ebp - 0x2a4], eax
movzx edx, byte [ebp - 0x241]
cmp dword [ebp - 0x2a4], edx
jne 0x402ac4
push 0x416414
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x402af7
cmp dword [ebp - 0x2a4], 0
jle 0x402ae3
push str.PART_t
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
jmp 0x402af7
push 0x416420
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
lea eax, [ebp - 0x240]
push eax
push 0x41d4a8
push str.key:_t
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x402b4c
lea edx, [ebp - 0x138]
push edx
push 0
push 0x180
mov eax, dword [0x41d490]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
lea ecx, [ebp - 0x240]
push ecx
call fcn.00401a20
add esp, 4
test eax, eax
je 0x402b7a
push 0x416430
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
jmp 0x402b8e
push 0x416434
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
lea ecx, [ebp - 0x240]
push ecx
push str.group:_t
lea edx, [ebp - 0x138]
push edx
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x402bd6
lea eax, [ebp - 0x138]
push eax
push 0
push 0x180
mov ecx, dword [0x41d490]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
lea edx, [ebp - 0x240]
push edx
call fcn.00401ca0
add esp, 4
test eax, eax
je 0x402c04
push 0x416444
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x402c18
push 0x416448
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
lea edx, [ebp - 0x240]
push edx
push str.link:_t
lea eax, [ebp - 0x138]
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x402c60
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0x180
mov edx, dword [0x41d490]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
cmp dword [0x41d5ac], 0
je 0x402c84
mov eax, dword [0x41d4a0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x41d5ac], 0
mov dword [ebp - 0x2a8], 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
mov dword [ebp - 0x2ec], edx
mov eax, dword [ebp - 0x2ec]
sub eax, 0xd
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 4
ja case.default.0x402cbc
mov ecx, dword [ebp - 0x2ec]
jmp dword [ecx*4 + 0x403168]
mov dword [ebp - 0x2a8], 0x80000000
lea edx, [ebp - 0x240]
push edx
push str.HKCR_
push 0x41d4a8
call fcn.0040a630
add esp, 8
push eax
call fcn.0040a640
add esp, 8
jmp case.default.0x402cbc
mov dword [ebp - 0x2a8], 0x80000005
lea eax, [ebp - 0x240]
push eax
push str.HKCC_
push 0x41d4a8
call fcn.0040a630
add esp, 8
push eax
call fcn.0040a640
add esp, 8
jmp case.default.0x402cbc
mov dword [ebp - 0x2a8], 0x80000001
lea ecx, [ebp - 0x240]
push ecx
push str.HKCU_
push 0x41d4a8
call fcn.0040a630
add esp, 8
push eax
call fcn.0040a640
add esp, 8
jmp case.default.0x402cbc
mov dword [ebp - 0x2a8], 0x80000002
lea edx, [ebp - 0x240]
push edx
push str.HKLM_
push 0x41d4a8
call fcn.0040a630
add esp, 8
push eax
call fcn.0040a640
add esp, 8
jmp case.default.0x402cbc
mov dword [ebp - 0x2a8], 0x80000003
lea eax, [ebp - 0x240]
push eax
push str.HKU_
push 0x41d4a8
call fcn.0040a630
add esp, 8
push eax
call fcn.0040a640
add esp, 8
push 0x41d4a0
push 0xf003f
push 0
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ddb
mov dword [0x41d5ac], 1
jmp case.default.0x4021d0
mov dword [ebp - 0x2ac], 0
cmp dword [0x41d5ac], 0
je 0x402e15
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [0x41d4a0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x402e15
mov dword [ebp - 0x2ac], 1
cmp dword [ebp - 0x2ac], 0
je 0x402e34
push 0x416480
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
jmp 0x402e48
push 0x416484
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
push 0x41648c
lea ecx, [ebp - 0x240]
push ecx
push 0x416490
push 0x41d4a8
push str.reg:_t
lea edx, [ebp - 0x138]
push edx
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je 0x402eba
lea eax, [ebp - 0x138]
push eax
push 0
push 0x180
mov ecx, dword [0x41d490]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4021d0
mov dword [ebp - 0x2b0], 0
lea edx, [ebp - 0x2b4]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDlls
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402fca
mov dword [ebp - 0x2c0], 4
mov dword [ebp - 0x2b8], 0
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
lea edx, [ebp - 0x2bc]
push edx
push 0
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x2b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402fca
cmp dword [ebp - 0x2bc], 4
jne 0x402fca
cmp dword [ebp - 0x2b8], 0
jbe 0x402fca
mov edx, dword [ebp - 0x2b8]
sub edx, 1
mov dword [ebp - 0x2b8], edx
jne 0x402f9a
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x2b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea edx, [ebp - 0x240]
push edx
call fcn.00401e40
add esp, 4
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402f98
mov dword [ebp - 0x2b0], 2
jmp 0x402fca
push 4
lea ecx, [ebp - 0x2b8]
push ecx
mov edx, dword [ebp - 0x2bc]
push edx
push 0
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x2b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x2b0], 1
cmp dword [ebp - 0x2b0], 0
jne 0x402fe9
push str.ERR_t
lea edx, [ebp - 0x138]
push edx
call fcn.0040a630
add esp, 8
jmp 0x40301c
cmp dword [ebp - 0x2b0], 1
jne 0x403008
push str.LEFT_t
lea eax, [ebp - 0x138]
push eax
call fcn.0040a630
add esp, 8
jmp 0x40301c
push 0x4164e4
lea ecx, [ebp - 0x138]
push ecx
call fcn.0040a630
add esp, 8
lea edx, [ebp - 0x240]
push edx
push str.oledll:_t
lea eax, [ebp - 0x138]
push eax
call fcn.0040a640
add esp, 8
push eax
call fcn.0040a640
add esp, 8
cmp dword [0x41d490], 0
je case.default.0x4021d0
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0x180
mov edx, dword [0x41d490]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 3
je 0x403079
mov dword [0x41d494], 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 5
je 0x40308e
mov dword [0x41d4a4], 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0xd
je 0x4030f0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0xe
je 0x4030f0
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0xf
je 0x4030f0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x10
je 0x4030f0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x11
je 0x4030f0
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x12
je 0x4030f0
cmp dword [0x41d5ac], 0
je 0x4030f0
mov ecx, dword [0x41d4a0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x41d5ac], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00409fb6
mov esp, ebp
pop ebp
ret