Function at 0x40d494
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a360a
mov eax, dword fs:[0]
push eax
sub esp, 0x2f8
mov eax, dword [0x4d0620]
xor eax, esp
mov dword [esp + 0x2f0], eax
push ebx
push esi
push edi
mov eax, dword [0x4d0620]
xor eax, esp
push eax
lea eax, [esp + 0x308]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x2c], 1
call fcn.0045db7e
push eax
lea ecx, [esp + 0x2c]
call fcn.0040161b
xor ebx, ebx
mov dword [esp + 0x310], ebx
call fcn.0045db7e
push eax
lea ecx, [esp + 0x24]
call fcn.0040161b
mov byte [esp + 0x310], 1
call fcn.0045db7e
push eax
lea ecx, [esp + 0x40]
call fcn.0040161b
lea esi, [esp + 0x5c]
mov byte [esp + 0x310], 2
call fcn.00426f1a
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], vtable.CAfterUpdateActionMgr.0
lea ecx, [esp + 0x34]
mov byte [esp + 0x310], 4
call fcn.0042b875
lea esi, [esp + 0x34]
call fcn.0042b836
mov byte [esp + 0x310], 3
cmp dword [0x4ef1d8], ebx
jne 0x40d568
call fcn.004039b5
lea esi, [edi + 0xc4]
cmp dword [esi], ebx
je 0x40d57a
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esi], ebx
mov eax, dword [0x4ee06c]
cmp eax, ebx
je 0x40d590
push eax
call fcn.0045d845
pop ecx
mov dword [0x4ee06c], ebx
lea esi, [edi + 0x128]
mov edi, dword [esi]
cmp edi, ebx
je 0x40d5ac
mov ecx, edi
call fcn.00460f9b
push edi
call fcn.0045d845
pop ecx
mov dword [esi], ebx
cmp dword [0x4ef884], ebx
jne 0x40d697
push 0x2b
pop esi
call fcn.00436a31
test eax, eax
je 0x40d68b
push 4
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x24]
push eax
push 0x20007
push ebx
push str.SOFTWAREKingsoftAntiVirusKisFree
push reloc.WS2_32.dll_accept
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40d68b
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov esi, str.Free2Comm
push esi
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x40d681
cmp dword [esp + 0x30], ebx
je 0x40d681
call fcn.0045db7e
push eax
lea ecx, [esp + 0x18]
call fcn.0040161b
push 0x8080
mov byte [esp + 0x314], 5
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
lea ecx, [esp + 0x20]
call fcn.0042a68d
add esp, 0xc
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [esp + 0x310], 3
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401325
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4ef884], ebx
je 0x40d8dd
cmp dword [0x4eef64], ebx
jne 0x40d8dd
call fcn.0045db7e
push eax
lea ecx, [esp + 0x20]
call fcn.0040161b
push 0x8033
mov byte [esp + 0x314], 6
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0xc]
call fcn.0045db7e
push eax
lea ecx, [esp + 0x1c]
call fcn.0040161b
push 0x12c
mov byte [esp + 0x314], 7
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
call fcn.0045db7e
push eax
lea ecx, [esp + 0x18]
call fcn.0040161b
push 0x12d
mov byte [esp + 0x314], 8
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0xc]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xd4]
call fcn.004015ba
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xd8]
call fcn.004015ba
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xe0]
call fcn.004015ba
cmp dword [0x4efdd4], ebx
jne 0x40d774
lea ecx, [esp + 0x5c]
call fcn.0045f67f
cmp eax, 2
jne 0x40d86b
push 0x208
lea eax, [esp + 0xf2]
push ebx
push eax
mov word [esp + 0xf8], bx
call fcn.0047e7d0
xor eax, eax
mov word [esp + 0x50], bx
lea edi, [esp + 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
mov edi, str.HKEY_CURRENT_USER_
lea eax, [esp + 0xec]
push edi
push eax
call fcn.00402e8c
mov esi, 0x4eef7c
lea eax, [esp + 0xf4]
push esi
push eax
call fcn.00402eac
lea eax, [esp + 0xfc]
push str.updateNeedReboot
push eax
call fcn.00402eac
push 1
lea ecx, [esp + 0x108]
call fcn.0042a03f
add esp, 0x1c
cmp dword [0x4efdd4], ebx
je 0x40d7fe
mov dword [esp + 0xe8], 1
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xffffffffffffffff
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x5c]
call fcn.0040ec86
lea eax, [esp + 0xec]
push edi
push eax
call fcn.00402e8c
lea eax, [esp + 0xf4]
push esi
push eax
call fcn.00402eac
lea eax, [esp + 0xfc]
push str.updateNeedRebootLastTime
push eax
call fcn.00402eac
push 1
lea ecx, [esp + 0x108]
call fcn.0042a03f
add esp, 0x1c
push dword [esp + 0x54]
lea ecx, [esp + 0xf0]
call fcn.0042a03f
pop ecx
jmp 0x40d874
call fcn.0040228b
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.00401325
mov byte [esp + 0x310], 3
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.00401325
cmp dword [esp + 0x2c], ebx
jne 0x40d8dd
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
push 0x8032
lea edx, [esp + 0x2c]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
push 8
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0xc]
push ebx
push dword [esp + 0x24]
push dword [esp + 0x30]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x4ef184], ebx
je 0x40d911
mov eax, dword [0x4ef188]
cmp eax, ebx
je 0x40d911
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
push dword [0x4ef184]
mov esi, dword [0x4ef188]
call fcn.0042df20
mov dword [0x4ef184], ebx
mov dword [0x4ef188], ebx
lea esi, [esp + 0x5c]
mov byte [esp + 0x310], 2
call fcn.0040d96d
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00401325
xor eax, eax
inc eax
mov ecx, dword [esp + 0x308]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2f0]
xor ecx, esp
call fcn.0047b9fe
mov esp, ebp
pop ebp
ret