Function at 0x409ef0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c6bb
mov eax, dword fs:[0]
push eax
mov eax, 0x2024
call fcn.00417900
mov eax, dword [0x43d180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2024], edi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2018]
push eax
push 1
push 0
push 0x42dcb8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2014], 0x1000
mov dword [ebp - 0x2028], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x2014]
push eax
push 0
push 0
push 0x42d928
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x338]
call fcn.004116e0
push esi
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00409b60
push 0x80
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0xa4]
push 0
push eax
call fcn.00417930
lea eax, [ebp - 0xa4]
push eax
call fcn.00410880
add esp, 0x10
mov ecx, edi
call fcn.00410910
mov ecx, dword [ebp - 0x2024]
mov edi, eax
mov esi, edx
call fcn.00410900
mov dword [ebp - 0x2028], eax
lea eax, [ebp - 0x2020]
push eax
call fcn.00418289
push esi
push edi
push dword [ebp - 0x201c]
push dword [ebp - 0x2020]
call fcn.00418242
movsd xmm0, qword [0x42e0d0]
add esp, 0x14
fstp qword [ebp - 0x2030]
comisd xmm0, xmmword [ebp - 0x2030]
jb 0x40a038
cmp dword [ebp + 8], 0
jne 0x40a038
mov edi, dword [ebp - 0x2024]
mov esi, 0x28
jmp 0x40a31a
call fcn.00409010
test eax, eax
je 0x40a04d
push str.UntrustedDrivers
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, dword [ebp - 0x2014]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x2b0], ax
lea eax, [ebp - 0x2ae]
push eax
call fcn.00417930
lea eax, [ebp - 0x2b0]
push eax
call fcn.00408d20
xor eax, eax
xorps xmm0, xmm0
push 0x10
mov word [ebp - 0x24], ax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x24]
push 0xa
push eax
push esi
movdqu xmmword [ebp - 0x22], xmm0
call fcn.00417b8d
mov edi, dword [ebp - 0x2024]
add esp, 0x20
push 0x50
lea ecx, [edi + 0x3cb0]
call fcn.00408e50
push eax
lea ecx, [ebp - 0x338]
call fcn.00411900
lea ecx, [edi + 0x3cb0]
call fcn.00408f30
push eax
lea ecx, [ebp - 0x338]
call fcn.004118f0
lea eax, [ebp - 0x11d0]
mov ecx, edi
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00409e30
push eax
push dword [ebp - 0x2018]
lea ecx, [ebp - 0x338]
call fcn.00411cc0
test eax, eax
jne 0x40a292
push eax
push 3
mov ecx, edi
call fcn.00410d10
cmp dword [ebp - 0x11cc], 0xc8
mov esi, 0x2a
jne 0x40a278
mov eax, dword [ebp - 0x2028]
cmp eax, dword [ebp - 0x7b0]
jge 0x40a167
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x338]
call fcn.00411780
lea eax, [ebp - 0x79c]
mov ecx, edi
push eax
push dword [ebp - 0x7b0]
call fcn.0040fd00
mov eax, dword [ebp - 0x11c8]
cmp eax, 0x450
jg 0x40a1a0
je 0x40a185
test eax, eax
je 0x40a1b0
cmp eax, 0x44c
jne 0x40a27d
push 1
push 0
mov ecx, edi
call fcn.00410d10
push 0
push 0
mov ecx, edi
call fcn.00410c00
jmp 0x40a27d
sub eax, 0x456
je 0x40a21c
sub eax, 0x5b
jne 0x40a27d
lea eax, [ebp - 0x11c4]
mov ecx, edi
push eax
mov esi, 0x28
call fcn.00410d50
lea eax, [ebp - 0x101c]
mov ecx, edi
push eax
call fcn.00410ba0
push dword [ebp - 0x7b8]
mov ecx, edi
call fcn.00410ca0
push dword [ebp - 0x7b4]
mov ecx, edi
call fcn.00410b90
push dword [ebp - 0x33c]
mov ecx, edi
call fcn.00410b70
lea eax, [ebp - 0x2020]
push eax
call fcn.00418289
add esp, 4
mov ecx, edi
push dword [ebp - 0x201c]
push dword [ebp - 0x2020]
call fcn.00410c00
jmp 0x40a27d
push 6
push 0
mov ecx, edi
mov esi, 0x29
call fcn.00410d10
push 0
push 0
mov ecx, edi
call fcn.00410c00
push dword [ebp - 0x2018]
lea eax, [ebp - 0x13d8]
mov dword [ebp - 0x15e8], 0x418
push 0x42de44
push 0x104
push eax
mov dword [ebp - 0x15e4], 0x80000bb8
call fcn.00401280
lea eax, [ebp - 0x15e8]
push eax
call sub.GIDBIN1.dll_GIDSDKAddEvent
add esp, 0x14
jmp 0x40a27d
mov esi, 0x2c
push 1
mov ecx, edi
call fcn.0040a9b0
mov ecx, edi
call fcn.004110d0
jmp 0x40a315
lea eax, [ebp - 0x2020]
mov esi, 0x2c
push eax
call fcn.00418289
add esp, 4
mov ecx, edi
call fcn.00410930
push edx
push eax
push dword [ebp - 0x201c]
push dword [ebp - 0x2020]
call fcn.00418242
fstp qword [ebp - 0x2030]
movsd xmm0, qword [ebp - 0x2030]
add esp, 0x10
comisd xmm0, xmmword [0x42e0d8]
jb 0x40a302
push 3
mov ecx, edi
call fcn.00410980
cmp eax, 0xa
jge 0x40a2fd
inc eax
mov ecx, edi
push eax
push 3
call fcn.00410d10
mov ecx, edi
call fcn.004110d0
jmp 0x40a302
mov esi, 0x2f
push dword [ebp - 0x201c]
mov ecx, edi
push dword [ebp - 0x2020]
call fcn.00410c20
cmp esi, 0x28
jne 0x40a35c
mov ecx, edi
call fcn.004109c0
lea ecx, [ebp - 0xa4]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40a34d
test dx, dx
je 0x40a349
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40a34d
add ecx, 4
add eax, 4
test dx, dx
jne 0x40a327
xor eax, eax
jmp 0x40a352
sbb eax, eax
or eax, 1
test eax, eax
mov ecx, 0x2b
cmovs esi, ecx
push esi
mov ecx, edi
call fcn.00409e30
push eax
push dword [ebp - 0x2018]
push str.Query__s__s___d
call fcn.00401350
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.00411760
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret 8