Function at 0x401e48
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0040b070
push ebx
push esi
push edi
push str.UnbindProtocol
push 0x40ef04
mov dword [ebp - 0x30], ecx
push 6
call fcn.00407ea7
add esp, 0xc
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push 8
push esi
push str.Enum
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
mov edi, str.AI98D.UnbindProtocol
cmp ebx, esi
jne 0x4022b3
mov dword [ebp - 0x28], esi
xor ebx, ebx
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x144]
push 0x105
push ecx
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4022a8
lea eax, [ebp - 0x18]
push eax
push 8
lea eax, [ebp - 0x144]
push esi
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, esi
jne 0x40226d
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x24c]
push 0x105
push ecx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x402262
lea eax, [ebp - 0x10]
push eax
push 8
lea eax, [ebp - 0x24c]
push esi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, esi
jne 0x402220
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x354]
push 0x105
push ecx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x402215
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x354]
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, esi
jne 0x4021cc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push str.Class
mov dword [ebp - 0x34], 4
push dword [ebp - 0xc]
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x402135
cmp dword [ebp - 0x2c], 1
jne 0x4021c1
lea eax, [ebp - 0x38]
push 0x40ecf8
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x4021c1
lea eax, [ebp - 8]
push eax
push 3
push esi
push str.Bindings
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x4020c4
push esi
lea eax, [ebp - 0x3c]
push esi
push eax
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x45c]
push eax
mov dword [ebp - 4], 0x105
mov dword [ebp - 0x24], 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4020b6
push 9
lea eax, [ebp - 0x45c]
push str.MDC8021X_
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x402053
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, eax
cmp ebx, esi
jne 0x402075
xor ebx, ebx
mov eax, dword [ebp - 0x24]
push esi
lea ecx, [ebp - 0x3c]
inc dword [ebp - 0x24]
push esi
push ecx
lea ecx, [ebp - 4]
push esi
push ecx
lea ecx, [ebp - 0x45c]
push ecx
mov dword [ebp - 4], 0x105
push eax
jmp 0x40200f
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x4020b6
push esi
push ebx
lea ecx, [ebp - 0xe20]
call fcn.0040847c
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegDeleteValue__HKLM_Enum__ws__ws__ws_Bindings_MDC8021X___failed:__s
push 3
call fcn.00407ea7
add esp, 0x1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4021c1
cmp eax, 2
jne 0x4020f3
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegOpenKey__HKLM_Enum__ws__ws__ws_Bindings___5_failed:_no_subkey_Bindings_present.
push 3
call fcn.00407ea7
add esp, 0x18
jmp 0x4021c1
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x4021c1
push esi
lea ecx, [ebp - 0x1014]
push dword [ebp - 4]
call fcn.0040847c
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegOpenKeyEx__HKLM_Enum__ws__ws__ws_Bindings___5_failed:__s
jmp 0x4021b7
cmp eax, 0xea
jne 0x402159
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegQueryValueEx__HKLM_Enum__ws__ws__ws_Class___1_no_match_to_Net
jmp 0x4020e4
cmp eax, 2
jne 0x40217e
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegQueryValueEx__HKLM_Enum__ws__ws__ws_Class___1_warning:_no_subkey_Class_present.
jmp 0x4020e4
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x4021c1
push esi
lea ecx, [ebp - 0x844]
push dword [ebp - 4]
call fcn.0040847c
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegQueryValueEx__HKLM_Enum__ws__ws__ws_Class___1_failed:__s
push 3
call fcn.00407ea7
add esp, 0x1c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40220d
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x40220d
push esi
push ebx
lea ecx, [ebp - 0xa38]
call fcn.0040847c
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegOpenKeyEx__HKLM_Enum__ws__ws__ws___4_failed:__s
push 3
call fcn.00407ea7
add esp, 0x1c
cmp ebx, esi
je 0x401f30
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40225a
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x40225a
push esi
push ebx
lea ecx, [ebp - 0xc2c]
call fcn.0040847c
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegOpenKeyEx__HKLM_Enum__ws__ws___3_failed:__s
push 3
call fcn.00407ea7
add esp, 0x18
cmp ebx, esi
je 0x401ee6
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4022a0
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x4022a0
push esi
push ebx
lea ecx, [ebp - 0x650]
call fcn.0040847c
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push str._s:_RegOpenKeyEx__HKLM_Enum__ws___2_failed:__s
push 3
call fcn.00407ea7
add esp, 0x14
cmp ebx, esi
je 0x401e9c
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4022df
push esi
push 3
call fcn.00407ea7
pop ecx
test eax, eax
pop ecx
je 0x4022df
push esi
push ebx
lea ecx, [ebp - 0x650]
call fcn.0040847c
push eax
push edi
push str._s:_RegOpenKeyEx__HKLM_Enum___1_failed:__s
push 3
call fcn.00407ea7
add esp, 0x10
cmp ebx, esi
je 0x4022fa
push str.Cannot_unbind_from_NDI_interface._UnBind_Protocol_Failed__r_n
mov ecx, 0x41c374
call fcn.0040aea6
push dword [0x41c374]
jmp 0x4022ff
push str.Protocol_Bindings_removed._r_n
mov eax, dword [ebp - 0x30]
push esi
push 0xc2
push dword [eax + 0x80]
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push edi
push str._s____d
push 6
call fcn.00407ea7
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret