Function at 0x4051b8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, ecx
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebx + 0x38]
call esi
cmp eax, dword [ebx + 0x40]
je 0x405242
push eax
mov dword [ebx + 0x40], eax
lea eax, [ebp - 8]
push 0x491494
push eax
call fcn.00449eea
add esp, 0xc
push dword [0x4ab4f0]
push dword [eax]
push str.DifferMode
push 0x486104
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.0043c924
mov eax, dword [0x4ab328]
test eax, eax
je 0x405242
mov ecx, dword [ebx + 0x40]
sub ecx, edi
je 0x405239
sub ecx, 1
mov ecx, dword [eax]
je 0x405234
push 4
push 1
jmp 0x40523e
push edi
push 5
jmp 0x40523e
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x20]
push ecx
mov edx, str._shellDismCompact
mov ecx, 0x80000000
call fcn.0044d290
pop ecx
push 0
push 0
push 0xf0
push dword [ebx + 0x2c]
mov edi, eax
call esi
mov esi, 0x80000002
cmp edi, eax
je 0x40559f
test edi, edi
je 0x405304
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellUnCompact
mov ecx, esi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress4k
mov ecx, esi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress8k
mov ecx, esi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress16k
mov ecx, esi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofLZX
mov ecx, esi
call fcn.0044cfe3
lea edi, [esi - 2]
mov edx, str.Directory_shellDismCompact
mov ecx, edi
call fcn.0044cfe3
mov edx, str._shellDismCompact
mov ecx, edi
call fcn.0044cfe3
mov edx, str.Dism.esd_shellDismCompact
mov ecx, edi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellESD2ISO
mov ecx, esi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellESD2WIM
mov ecx, esi
call fcn.0044cfe3
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellDecryptESD
mov ecx, esi
call fcn.0044cfe3
jmp 0x40559f
push 0x486104
mov esi, str.MUIVerb
mov edx, str._shellDismCompact
push esi
mov ecx, 0x80000000
call fcn.0044cefe
push str.UnCompact_WofXpress4k_WofXpress8k_WofXpress16k_WofLZX
mov edi, str.SubCommands
mov edx, str._shellDismCompact
push edi
mov ecx, 0x80000000
call fcn.0044cefe
push 0x486104
push esi
mov esi, str.Directory_shellDismCompact
mov ecx, 0x80000000
mov edx, esi
call fcn.0044cefe
push str.UnCompact_WofXpress4k_WofXpress8k_WofXpress16k_WofLZX
push edi
mov edx, esi
mov ecx, 0x80000000
call fcn.0044cefe
add esp, 0x20
call fcn.0043c5cd
push eax
lea ecx, [ebp - 4]
call fcn.0043ac50
push 0x105
push 0x104
lea ecx, [ebp - 4]
call fcn.0043c822
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [ebp - 4]
call fcn.0043c894
push 0x48ea8c
call sym.Dismx86.exe_DismMultiLanguage
push eax
mov edi, 0x491414
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellUnCompact
push edi
mov ecx, 0x80000002
call fcn.0044cefe
pop ecx
pop ecx
lea eax, [ebp - 4]
mov esi, 0x48eab4
push str.___U___1_
push eax
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.00430fb9
pop ecx
mov edx, eax
lea ecx, [ebp - 8]
call fcn.0043ab55
mov edx, 0x48eab8
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044cefe
mov ecx, dword [ebp - 8]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push str.Xpress4k
call sym.Dismx86.exe_DismMultiLanguage
push eax
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress4k
mov ecx, 0x80000002
call fcn.0044cefe
pop ecx
pop ecx
push str.___C__exe_xpress4k___1_
lea eax, [ebp - 4]
mov edx, esi
push eax
lea ecx, [ebp - 8]
call fcn.00430fb9
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043ab55
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress4kcommand
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044cefe
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push str.Xpress8k
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress8k
mov ecx, 0x80000002
call fcn.0044cefe
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, esi
push str.___C__exe_Xpress8k___1_
push eax
lea ecx, [ebp - 8]
call fcn.00430fb9
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043ab55
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress8kcommand
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044cefe
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push str.Xpress16k
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress16k
mov ecx, 0x80000002
call fcn.0044cefe
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, esi
push str.___C__exe_Xpress16k___1_
push eax
lea ecx, [ebp - 8]
call fcn.00430fb9
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043ab55
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress16kcommand
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044cefe
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push 0x48ee40
call sym.Dismx86.exe_DismMultiLanguage
push eax
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofLZX
mov ecx, 0x80000002
call fcn.0044cefe
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, esi
push str.___C__exe_LZX___1_
push eax
lea ecx, [ebp - 8]
call fcn.00430fb9
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043ab55
mov esi, 0x80000002
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofLZXcommand
mov ecx, esi
push dword [eax]
push edi
call fcn.0044cefe
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push 0x3f0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40571d
call fcn.0043c5cd
push eax
lea ecx, [ebp - 4]
call fcn.0043ac50
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push 0x2001f
push dword [0x4ab220]
mov dword [ebp - 8], ecx
push ecx
push ecx
push str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov edx, str.Element
call fcn.0044cd14
mov esi, dword [ebp - 4]
pop ecx
mov eax, dword [esi - 0xc]
test eax, eax
je 0x405628
dec eax
lea ecx, [ebp - 4]
push eax
call fcn.0043a8ec
test ax, ax
je 0x405628
push 0
lea ecx, [ebp - 4]
call fcn.0043b93f
mov esi, dword [ebp - 4]
mov edx, str.4652daff_77a1_4391_9157_aba3f31b3629
mov ecx, esi
call fcn.00449eaf
push 0
push 0
push 0xf0
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0xc]
test eax, eax
setne dl
test edi, edi
setne cl
cmp dl, cl
je 0x40570d
test edi, edi
je 0x4056a6
cmp dword [esi - 4], 1
jle 0x405674
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043c727
mov esi, dword [ebp - 4]
sub edi, esi
lea ecx, [ebp - 4]
push 0x27
sar edi, 1
push edi
call fcn.0043137d
mov esi, dword [ebp - 4]
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push esi
push 7
push 0
push str.Element
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40570d
mov esi, str.4652daff_77a1_4391_9157_aba3f31b3629
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0043b96c
xor esi, esi
lea ecx, [ebp - 4]
push esi
call fcn.0043b93f
push 3
pop eax
push eax
lea ecx, [ebp - 0x90]
call fcn.00403206
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x8c], esi
jne 0x4056ef
mov eax, dword [ebx + 4]
mov dword [ebp - 0x8c], eax
push esi
push esi
push esi
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
lea ecx, [ebp - 0x90]
call fcn.00405afd
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0043a910
lea ecx, [esi - 0x10]
call fcn.0043c924
push 0x3ec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_IsWindowEnabled]
mov esi, eax
push esi
call edi
test eax, eax
je 0x4057d7
mov eax, dword [ebx + 0x20]
xor ecx, ecx
cmp dword [eax + 0x228], ecx
je 0x4057d7
push ecx
push ecx
push 0x147
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x20]
lea edx, [ebp - 8]
and dword [ebp - 8], 0
push 0
push edx
mov eax, dword [eax + 0x228]
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWOF
push 0x80000002
mov eax, dword [eax + 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jne 0x4057d7
push eax
push eax
push 0x147
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4057ab
push str.ForceAlgorithm
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4057ce
push 3
pop ecx
xor edx, edx
div ecx
push 4
lea eax, [ebp - 0xc]
inc edx
push eax
push 4
push 0
push str.ForceAlgorithm
push dword [ebp - 8]
mov dword [ebp - 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebx + 0x28]
call edi
test eax, eax
je 0x4057fb
push 0
push 0
push 0xf0
push dword [ebx + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4057fb
call fcn.0040585f
push 0
push 0
push 0xf0
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x4aa12c]
cmp ecx, eax
jne 0x405848
xor eax, eax
test ecx, ecx
sete al
mov dword [0x4aa12c], eax
test eax, eax
mov eax, 0x48e394
jne 0x405831
mov eax, 0x48e390
push dword [0x4ab4f0]
push eax
push str.Mode
push 0x486104
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
movzx eax, word [ebp + 0xc]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10