Function at 0x4045a1
Capabilities:
Delete registry value
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
xor esi, esi
neg eax
sbb eax, eax
and eax, 0xfff2ffda
add eax, 0xf003f
push eax
push esi
push str.SYSTEMMountedDevices
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4049d3
cmp dword [ebp - 4], esi
je 0x4049d3
push ebx
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40473d
mov eax, dword [ebp - 0x14]
push esi
push esi
lea ecx, [ebp - 0x18]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x224]
dec eax
push ecx
mov dword [ebp - 0x10], eax
push eax
jmp 0x404729
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.__Volumebc85a584_55b1_11e0_9cfd_806d6172696f
call ebx
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x1c], eax
call ebx
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x404711
push str.__Volume
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
lea ecx, [ebp - 0x224]
cmp eax, ecx
jne 0x404711
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x290]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [0x40ba00]
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
call fcn.004039d6
cmp eax, esi
jne 0x404711
mov eax, 0x407f88
cmp dword [ebp + 8], esi
jne 0x4046bc
mov eax, 0x407f84
lea ecx, [ebp - 0x224]
push ecx
push eax
push str.Regkey__sdelete_HKLMSystemMountedDevices_s_n
call fcn.0040335e
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x4046db
inc dword [ebp - 8]
jmp 0x404711
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4046fe
push str._OK_n
call fcn.0040335e
inc dword [ebp - 8]
jmp 0x404710
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._failed__err_u__n
call fcn.0040335e
pop ecx
pop ecx
dec dword [ebp - 0x10]
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x100
call edi
test eax, eax
je 0x404637
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40486f
mov eax, dword [ebp - 0x14]
push esi
push esi
lea ecx, [ebp - 0x18]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x224]
dec eax
push ecx
mov dword [ebp - 0x10], eax
push eax
jmp 0x40485b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.12345678_1234_1234_1234_123456789ABC
call ebx
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x1c], eax
call ebx
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x404843
push 0x40876c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
lea ecx, [ebp - 0x224]
cmp eax, ecx
jne 0x404843
cmp word [ebp - 0x1d8], 0x7d
jne 0x404843
lea eax, [ebp - 0x22c]
push eax
mov eax, ecx
push eax
push dword [ebp - 4]
call fcn.004040f3
test eax, eax
jne 0x404843
mov eax, 0x407f88
cmp dword [ebp + 8], esi
jne 0x4047ee
mov eax, 0x407f84
lea ecx, [ebp - 0x224]
push ecx
push eax
push str.Regkey__sdelete_HKLMSystemMountedDevices_s_n
call fcn.0040335e
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x40480d
inc dword [ebp - 8]
jmp 0x404843
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x404830
push str._OK_n
call fcn.0040335e
inc dword [ebp - 8]
jmp 0x404842
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._failed__err_u__n
call fcn.0040335e
pop ecx
pop ecx
dec dword [ebp - 0x10]
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x100
call edi
test eax, eax
je 0x40477b
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4049c8
mov eax, dword [ebp - 0x14]
push esi
push esi
lea ecx, [ebp - 0x18]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x224]
dec eax
push ecx
mov dword [ebp - 0x10], eax
push eax
jmp 0x4049b4
cmp dword [ebp - 0xc], esi
je 0x4049c8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.DosDevicesA:
call ebx
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x1c], eax
call ebx
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x40499c
push str.DosDevices_
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
lea ecx, [ebp - 0x224]
cmp eax, ecx
jne 0x40499c
mov eax, dword [0x4086a8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4086ac]
mov dword [ebp - 0x20], eax
mov ax, word [ebp - 0x20c]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x40499c
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
call fcn.004040f3
test eax, eax
jne 0x40499c
mov eax, 0x407f88
cmp dword [ebp + 8], esi
jne 0x404947
mov eax, 0x407f84
lea ecx, [ebp - 0x224]
push ecx
push eax
push str.Regkey__sdelete_HKLMSystemMountedDevices_s_n
call fcn.0040335e
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x404966
inc dword [ebp - 8]
jmp 0x40499c
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x404989
push str._OK_n
call fcn.0040335e
inc dword [ebp - 8]
jmp 0x40499b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._failed__err_u__n
call fcn.0040335e
pop ecx
pop ecx
dec dword [ebp - 0x10]
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x100
call edi
test eax, eax
je 0x4048ad
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret 4