Function at 0x401120
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x450
mov eax, dword [0x40e004]
xor eax, esp
mov dword [esp + 0x44c], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 7
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401183
lea eax, [esi + 1]
pop esi
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.00401baf
add esp, 0x450
ret
mov eax, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
push esi
push str.PendingFileRenameOperations
push eax
call edi
mov eax, dword [esp + 0xc]
cmp eax, esi
jne 0x4011d1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.00401baf
add esp, 0x450
ret
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add eax, 0x100
push eax
push 8
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov ebx, eax
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x4014d4
mov edx, dword [esp + 0x14]
add edx, 0x100
push edx
push 8
call ebp
push eax
call esi
mov dword [esp + 0x20], eax
test eax, eax
je 0x4014d4
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x30]
push ecx
push 0
push str.PendingFileRenameOperations
push edx
call edi
test eax, eax
jne 0x4014d4
mov ecx, dword [0x40fb70]
push 0x104
lea eax, [esp + 0x258]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, ebx
mov ebx, dword [esp + 0x20]
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], esi
mov ebp, ebx
cmp word [edx], si
je 0x40145a
lea esp, [esp]
lea eax, [esp + 0x2c]
mov esi, edi
mov ecx, eax
xor ebx, ebx
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4012a1
movzx ecx, word [esi + eax]
test cx, cx
je 0x4012a1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x401281
jmp 0x4012a5
test edx, edx
jne 0x4012ad
sub eax, 2
mov ebx, 0x8007007a
xor edx, edx
mov word [eax], dx
test ebx, ebx
jl 0x4014d4
lea eax, [esp + 0x254]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00401e6a
add esp, 8
lea esi, [esp + 0x18]
lea edx, [esp + 0x2c]
mov ebx, eax
call fcn.00401060
test eax, eax
jl 0x4014d4
test ebx, ebx
jne 0x4013cf
mov ecx, dword [esp + 0x14]
shr ecx, 1
je 0x4014d4
cmp ecx, 0x7fffffff
ja 0x4014d4
lea eax, [esp + 0x2c]
mov edx, ebp
call fcn.004010a0
test eax, eax
jl 0x4014d4
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ecx, [edx + eax + 1]
lea edi, [edi + eax*2 + 2]
lea ebp, [ebp + eax*2 + 2]
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x2c]
mov ecx, edi
mov edx, eax
mov esi, 0x114
sub ecx, edx
lea edx, [esi + 0x7ffffeea]
test edx, edx
je 0x401360
movzx edx, word [ecx + eax]
test dx, dx
je 0x401360
mov word [eax], dx
add eax, 2
sub esi, 1
jne 0x401340
jmp 0x401364
test esi, esi
jne 0x40136c
sub eax, 2
mov ebx, 0x8007007a
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
jl 0x4014d4
mov ecx, dword [esp + 0x14]
shr ecx, 1
je 0x4014d4
cmp ecx, 0x7fffffff
ja 0x4014d4
lea eax, [esp + 0x2c]
mov edx, ebp
call fcn.004010a0
test eax, eax
jl 0x4014d4
lea esi, [esp + 0x18]
lea edx, [esp + 0x2c]
call fcn.00401060
test eax, eax
jl 0x4014d4
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [ebp + eax*2 + 2]
lea eax, [edx + eax + 1]
mov dword [esp + 0x1c], eax
jmp 0x401429
mov ecx, dword [esp + 0x18]
lea edi, [edi + ecx*2 + 2]
lea eax, [esp + 0x2c]
mov edx, edi
mov ecx, eax
xor ebx, ebx
mov esi, 0x114
sub edx, ecx
jmp 0x4013f0
lea ecx, [esi + 0x7ffffeea]
test ecx, ecx
je 0x401410
movzx ecx, word [edx + eax]
test cx, cx
je 0x401410
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x4013f0
jmp 0x401414
test esi, esi
jne 0x40141c
sub eax, 2
mov ebx, 0x8007007a
xor edx, edx
mov word [eax], dx
test ebx, ebx
jl 0x4014d4
lea esi, [esp + 0x18]
lea edx, [esp + 0x2c]
call fcn.00401060
test eax, eax
jl 0x4014d4
mov eax, dword [esp + 0x18]
cmp word [edi + eax*2 + 2], 0
lea edi, [edi + eax*2 + 2]
jne 0x401270
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
lea ecx, [esi + esi + 2]
push ecx
push ebx
push edx
push 0
push str.PendingFileRenameOperations
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
jne 0x40148b
mov ecx, dword [esp + 0x10]
push str.PendingFileRenameOperations
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edx
push 8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push ebx
push 8
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x45c]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.00401baf
add esp, 0x450
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4014e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x4014fd
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x401511
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
xor eax, eax
jmp 0x4014bb