Function at 0x409904
Capabilities:
Delete file
Delete registry key

Disassembly:
sub esp, 0x314
mov eax, dword [0x518450]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push eax
call fcn.004bad3c
lea esi, [esp + 0x20]
mov edx, 0x56d1b51d
push 0x2769a401
mov ecx, 0x795827a
add esi, eax
call fcn.0040145b
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x40994a
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x2000e
push edi
lea eax, [esp + 0x24]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop ebx
test eax, eax
jne 0x409aaf
push 0x4ef5ec
push 0x840d61de
mov edx, 0xf5b570cf
mov ecx, 0xa4f147b4
call fcn.00401485
pop ecx
push eax
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x220]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call ebp
push 0x104
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x18]
push 0x5c
push eax
call fcn.004bb2a8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x409aaf
push 0x642840be
mov edx, 0x159051a5
mov ecx, 0x44d466ee
add esi, ebx
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x409a0a
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x18]
push eax
call edi
push 0x135f7a5a
mov edx, 0x62e76b41
mov ecx, 0x33a35cee
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x409a3e
lea eax, [esp + 0x18]
push eax
call edi
push 0xf2126a1b
mov edx, 0x83aa7b00
mov ecx, 0xd2ee4cb3
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x409a6c
lea eax, [esp + 0x18]
push eax
call edi
push 0x9155d6cb
mov edx, 0xe0edc7cd
mov ecx, 0xb1a9f05a
call fcn.00401485
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, ebx
test cx, cx
jne 0x409a98
lea eax, [esp + 0x18]
push eax
call edi
xor edi, edi
xor ecx, ecx
inc ecx
call fcn.00408ee8
lea eax, [esp + 0x10]
push eax
push dword [0x52aaf0]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x409adc
push dword [esp + 0x10]
call ebp
jmp 0x409d38
call fcn.0042148a
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x1a
push edi
call ebx
test eax, eax
jne 0x409b55
push 0xe58fdd54
mov edx, 0x9437cc52
mov ecx, 0xc573fba7
call fcn.00401485
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x409b10
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x409b26
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0041fe91
xor edi, edi
pop ecx
cmp al, 1
je 0x409cab
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x409bc3
push 0x4c04975e
mov edx, 0x3dbc8658
mov ecx, 0x6cf8b18b
call fcn.00401485
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x409b7e
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x409b94
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0041fe91
xor edi, edi
pop ecx
cmp al, 1
je 0x409cab
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x409cab
push 0x4537fef5
mov edx, 0x348fefe4
mov ecx, 0x65cbd9d5
call fcn.00401485
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x409bf0
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ebx, ebx
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x409c06
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0xc96aa805
mov edx, 0xb8d2b919
mov ecx, 0xe9968f18
call fcn.00401485
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x409c45
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x409c59
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0041fe91
xor edi, edi
pop ecx
test al, al
jne 0x409cab
push edi
push 0x80
push 1
push edi
push 2
push 0x40000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409cab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push dword [0x52aaf0]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x409d06
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x281c785e
mov ecx, 0x79584e35
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push edi
push 0x59a4694e
call fcn.00401485
pop ecx
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
call ebp
push edi
push str.2.6.8
push 0xbad58d61
mov edx, 0xcb6d9c63
mov ecx, 0x9a29aa1e
call fcn.0040145b
pop ecx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004bad3c
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.0040acd1
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b9a6c
add esp, 0x314
ret