Function at 0x401670
Capabilities:
Delete directory
Delete file
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x331c
call fcn.00403d70
push ebx
push esi
push edi
push 0x16
pop ecx
mov esi, str.2A85B11F_C71F_4fbd_9B99_EBC6613D63C4_Event
lea edi, [ebp - 0x6ac]
lea eax, [ebp - 0x6ac]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push eax
push ebx
push 1
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
cmp edi, ebx
je 0x401715
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401715
push ebx
push str.TTPlayer_PlayerWnd
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401715
mov esi, 0x4050b0
push 0x34
push esi
push dword [0x405d30]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x401709
push ebx
push ebx
push 0x10
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40171a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4019a0
mov esi, 0x4050b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x402001
cmp word [edi], bx
je 0x402001
lea eax, [ebp - 0x8b4]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x8b4]
push 0x405848
push eax
call esi
lea eax, [ebp - 0x8b4]
push edi
push eax
call esi
lea eax, [ebp - 0x8b4]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00402cb3
test eax, eax
je 0x401799
lea eax, [ebp - 0x8b4]
push 0x10
push eax
push dword [0x405d3c]
jmp 0x40198b
mov esi, 0x81
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x23e]
mov word [ebp - 0x240], bx
mov dword [ebp - 0xc], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.AppPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4017e8
cmp dword [ebp - 8], 1
jne 0x4017e8
xor eax, eax
cmp eax, ebx
je 0x4017f1
push 0x10
push 0x4050b0
jmp 0x40178e
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x14e2]
mov word [ebp - 0x14e4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x14e4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x405a44
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x40184c
cmp dword [ebp - 0xc], 1
jne 0x40184c
xor eax, eax
cmp eax, ebx
jne 0x40184c
lea eax, [ebp - 0x14e4]
mov ecx, 0x405d44
push eax
call fcn.00402610
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x231a]
mov word [ebp - 0x231c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x231c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x405a3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4018a7
cmp dword [ebp - 0xc], 1
jne 0x4018a7
xor eax, eax
cmp eax, ebx
jne 0x4018a7
lea eax, [ebp - 0x231c]
mov ecx, 0x405d40
push eax
call fcn.00402610
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x18f2]
mov word [ebp - 0x18f4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x18f4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x405a34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401902
cmp dword [ebp - 0xc], 1
jne 0x401902
xor eax, eax
cmp eax, ebx
jne 0x401902
lea eax, [ebp - 0x18f4]
mov ecx, 0x405d4c
push eax
call fcn.00402610
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xaba]
mov word [ebp - 0xabc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0xabc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xabc]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x401944
mov word [eax + 2], bx
lea eax, [ebp - 0xabc]
push str.ttpctrl.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [ebp - 0xabc]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4019a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4019bb
push 0x30
push 0x4050b0
push dword [0x405d54]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 4], ebx
je 0x4019a0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x402264
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xabc]
push eax
call fcn.0040151f
pop ecx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xcc2]
mov word [ebp - 0xcc4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x10d2]
mov word [ebp - 0x10d4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.ThirdPart
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
je 0x401a1b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
lea ecx, [ebp - 4]
call fcn.00402cb3
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401a55
push dword [ebp + 8]
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x401a55
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0xcc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xcc4]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401ab8
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push 0x80000002
lea ecx, [ebp - 4]
mov word [esi], bx
call fcn.00402cb3
test eax, eax
jne 0x401ab8
add esi, 2
push esi
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x401ab8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov esi, str..lnk
lea eax, [ebp - 0x240]
push esi
push dword [0x405ddc]
push ebx
push eax
call fcn.0040137c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
test eax, eax
je 0x401ae7
lea eax, [ebp - 0x240]
push eax
call edi
push esi
lea eax, [ebp - 0x240]
push dword [0x405ddc]
push 2
push eax
call fcn.0040137c
add esp, 0x10
test eax, eax
je 0x401b0c
lea eax, [ebp - 0x240]
push eax
call edi
push str..url
lea eax, [ebp - 0x240]
push dword [0x405de8]
push ebx
push eax
call fcn.0040137c
add esp, 0x10
test eax, eax
je 0x401b34
lea eax, [ebp - 0x240]
push eax
call edi
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x448]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x3f4]
push dword [0x405ddc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x448]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push 0x1a
push eax
call fcn.0040137c
add esp, 0x10
test eax, eax
je 0x401b92
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0xeca]
mov word [ebp - 0xecc], bx
mov word [ebp - 0x2114], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x2112]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x4000000
lea eax, [ebp - 0xecc]
push esi
push eax
push dword [0x405ddc]
call edi
pop ecx
inc eax
push eax
push dword [0x405ddc]
call fcn.0040116c
lea eax, [ebp - 0xecc]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.0040137c
add esp, 0x24
test eax, eax
je 0x401c1c
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xecc]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push 2
push eax
call fcn.0040137c
add esp, 0x10
test eax, eax
je 0x401c4a
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4000000
lea eax, [ebp - 0x2114]
push esi
push eax
push dword [0x405dec]
call edi
pop ecx
inc eax
push eax
push dword [0x405dec]
call fcn.0040116c
lea eax, [ebp - 0x2114]
push str..url
push eax
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.0040137c
add esp, 0x24
test eax, eax
je 0x401c9a
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x1d04]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x1cb0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xecc]
push eax
lea eax, [ebp - 0x1d04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1d04]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push 0x1a
push eax
call fcn.0040137c
add esp, 0x10
test eax, eax
je 0x401cf9
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
lea eax, [ebp - 0x448]
push 0x405848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x448]
xor edi, edi
mov dword [ebp + 8], eax
push dword [edi + 0x4052d0]
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.004011ca
add edi, 4
pop ecx
cmp edi, 0x38
jb 0x401d3a
xor edi, edi
push dword [edi + 0x4052b8]
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.0040128d
add edi, 4
pop ecx
cmp edi, 0x18
jb 0x401d5c
push dword [0x405ddc]
lea eax, [ebp - 0x331c]
push dword [0x405de0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.00402269
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x405d58
call fcn.00402c25
push ebx
push 0x4029f8
push edi
push 0x65
push dword [0x405d60]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x64e]
mov word [ebp - 0x650], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.AppUninst
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401e73
cmp dword [ebp - 8], 1
jne 0x401e73
mov edi, dword [ebp - 0xc]
xor eax, eax
shr edi, 1
cmp eax, ebx
jne 0x401e73
cmp edi, ebx
je 0x401e73
mov ecx, 0x108
lea edi, [ebp - 0x273e]
mov word [ebp - 0x2740], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x2740]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0xa
lea eax, [ebp - 0x2740]
push 0x7530
push eax
call fcn.0040239c
add esp, 0x1c
cmp dword [ebp - 0x1c], ebx
jne 0x401ed1
mov edi, dword [ebp + 8]
push str.ttplayer.xml
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.PlayList
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.0040128d
mov dword [esp], str.Skin
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.0040128d
mov dword [esp], str.Cache
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.0040128d
pop ecx
cmp dword [ebp - 0x18], ebx
jne 0x401f05
push str.Lyrics
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.0040128d
mov dword [esp], str.CDDB
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.0040128d
pop ecx
lea eax, [ebp - 0xcc4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp word [ebp - 0x10d4], bx
je 0x401feb
lea eax, [ebp - 0x8b4]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x8b4]
push 0x405848
push eax
call esi
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0x8b4]
push eax
call esi
lea eax, [ebp - 0x8b4]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
call fcn.00402cb3
test eax, eax
jne 0x401feb
mov ecx, 0x81
lea edi, [ebp - 0x64e]
mov word [ebp - 0x650], bx
mov dword [ebp + 8], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 8]
xor esi, esi
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.UninstallString
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401fda
cmp dword [ebp - 8], 1
jne 0x401fda
mov esi, dword [ebp + 8]
xor eax, eax
shr esi, 1
cmp eax, ebx
jne 0x401fda
cmp esi, ebx
je 0x401fda
push 0xa
lea eax, [ebp - 0x650]
push 0xea60
push eax
call fcn.0040239c
add esp, 0xc
cmp dword [ebp - 4], ebx
je 0x401ff9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x401ff9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x402264
mov eax, dword [str.TTPlayer]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x12dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x12dc]
push 0x405848
push eax
call edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x12dc]
push eax
call edi
lea eax, [ebp - 0x12dc]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.00402cb3
test eax, eax
je 0x40207c
push 0x10
push esi
push dword [0x405d3c]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x4019a0
push dword [ebp + 8]
jmp 0x40199a
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x64e]
mov word [ebp - 0x650], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.DisplayName
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x40211b
cmp dword [ebp - 0x10], 1
jne 0x40211b
xor eax, eax
cmp eax, ebx
jne 0x40211b
lea eax, [ebp - 0x650]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x405d34]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x2b1c]
push dword [0x405d48]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2b1c]
push 0x34
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40206b
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x16ea]
mov word [ebp - 0x16ec], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x16ec]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x405a44
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x402179
cmp dword [ebp - 8], 1
jne 0x402179
xor eax, eax
cmp eax, ebx
jne 0x402179
lea eax, [ebp - 0x16ec]
mov ecx, 0x405d44
push eax
call fcn.00402610
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1afa]
mov word [ebp - 0x1afc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x1afc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x405a3c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4021d7
cmp dword [ebp - 8], 1
jne 0x4021d7
xor eax, eax
cmp eax, ebx
jne 0x4021d7
lea eax, [ebp - 0x1afc]
mov ecx, 0x405d40
push eax
call fcn.00402610
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1f0a]
mov word [ebp - 0x1f0c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x1f0c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x405a34
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x402235
cmp dword [ebp - 8], 1
jne 0x402235
xor eax, eax
cmp eax, ebx
jne 0x402235
lea eax, [ebp - 0x1f0c]
mov ecx, 0x405d4c
push eax
call fcn.00402610
push dword [ebp - 0xc]
call fcn.004013b9
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x402254
push 0x10
push esi
push dword [0x405d3c]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x402262
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret