Function at 0x408f40
Capabilities:
Delete registry key
Delete registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1074
call fcn.0052e580
mov eax, dword [0x5a8040]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.PostInstall]
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x206
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
movdqu xmmword [ebp - 0x28], xmm0
push eax
movq xmm0, qword [0x589e7c]
movq qword [ebp - 0x18], xmm0
call fcn.0052c790
xor eax, eax
xorps xmm0, xmm0
push 0x1f8
movq qword [ebp - 0xe], xmm0
movdqu xmm0, xmmword [str.RegKey0]
push eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xc48]
push eax
movdqu xmmword [ebp - 0xc58], xmm0
call fcn.0052c790
movdqu xmm0, xmmword [str.RegSetName0]
push 0x1f0
lea eax, [ebp - 0xe48]
movdqu xmmword [ebp - 0xe60], xmm0
push 0
movq xmm0, qword [0x589f8c]
push eax
movq qword [ebp - 0xe50], xmm0
call fcn.0052c790
movdqu xmm0, xmmword [str.RegsetStrValue0]
push 0x1e8
lea eax, [ebp - 0x1048]
movdqu xmmword [ebp - 0x1068], xmm0
push 0
movdqu xmm0, xmmword [0x589fa4]
push eax
movdqu xmmword [ebp - 0x1058], xmm0
call fcn.0052c790
movdqu xmm0, xmmword [str.RegSetDwordValue0]
mov eax, dword [0x589fd4]
push 0x1e4
movdqu xmmword [ebp - 0x640], xmm0
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x61c]
movdqu xmm0, xmmword [0x589fc4]
push 0
push eax
movdqu xmmword [ebp - 0x630], xmm0
call fcn.0052c790
movdqu xmm0, xmmword [str.RegDelValue0]
movzx eax, word [0x589ff0]
push 0x1ee
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
movdqu xmmword [ebp - 0x848], xmm0
push 0
movq xmm0, qword [0x589fe8]
push eax
movq qword [ebp - 0x838], xmm0
call fcn.0052c790
mov eax, dword [0x58a004]
add esp, 0x48
movdqu xmm0, xmmword [str.RegDelKey0]
mov dword [ebp - 0x428], eax
movzx eax, word [0x58a008]
push 0x1f2
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push 0
push eax
movdqu xmmword [ebp - 0x438], xmm0
call fcn.0052c790
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1070], 0
mov dword [ebp - 0x106c], 0
xor eax, eax
xor edi, edi
push 0x206
push eax
mov word [ebp - 0xa50], ax
lea eax, [ebp - 0xa4e]
push eax
mov dword [ebp - 0x1074], edi
call fcn.0052c790
add esp, 0x18
lea eax, [ebp - 0x230]
push ebx
push 0x104
push eax
push 0x58877c
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x409458
lea eax, [ebp - 0x230]
push str.HKEY_CURRENT_USER
push eax
call fcn.0052b195
lea ecx, [ebp - 0x230]
add esp, 8
cmp ecx, eax
jne 0x409175
mov esi, SysReAllocStringLen
jmp 0x4091c2
lea eax, [ebp - 0x230]
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.0052b195
lea ecx, [ebp - 0x230]
add esp, 8
cmp ecx, eax
jne 0x40919f
mov edi, 0x13
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x4091c7
lea eax, [ebp - 0x230]
push str.HKEY_CLASSES_ROOT
push eax
call fcn.0052b195
lea ecx, [ebp - 0x230]
add esp, 8
cmp ecx, eax
jne 0x4091c7
mov esi, SysReAllocStringLen
mov edi, 0x12
lea eax, [ebp - 0x230]
lea edi, [eax + edi*2]
lea eax, [ebp - 0x1070]
push eax
push 0xf003f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4091f9
lea eax, [ebp - 0x1070]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xa50]
push ebx
push 0x104
push eax
push 0x58877c
lea eax, [ebp - 0xe60]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x4092fd
mov eax, str..DEFAULT
lea ecx, [ebp - 0xa50]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x409257
test dx, dx
je 0x409253
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x409257
add ecx, 4
add eax, 4
test dx, dx
jne 0x409231
xor eax, eax
jmp 0x40925c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409279
push 0x58877c
lea eax, [ebp - 0xa50]
push 0x104
push eax
call fcn.0052b09f
add esp, 0xc
push ebx
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0x58877c
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x4092c1
push 0x104
lea eax, [ebp - 0x230]
push eax
push 1
push 0
lea eax, [ebp - 0xa50]
push eax
push dword [ebp - 0x1070]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x409333
push ebx
push 0
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 4
mov dword [ebp - 0x1074], eax
lea eax, [ebp - 0x1074]
push eax
push 4
push 0
lea eax, [ebp - 0xa50]
push eax
push dword [ebp - 0x1070]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x409333
push ebx
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0x58877c
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x409333
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x1070]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x106c]
lea ecx, [ebp - 0x10]
push 0xa
push 5
inc eax
xor edi, edi
push ecx
push eax
mov dword [ebp - 0x106c], eax
call fcn.0052b93d
push str.RegKey
lea eax, [ebp - 0xc58]
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc58]
push 0x104
push eax
call fcn.0052b0fb
push str.RegSetName
lea eax, [ebp - 0xe60]
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xe60]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0x40
lea eax, [ebp - 0x1068]
push str.RegsetStrValue
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1068]
push 0x104
push eax
call fcn.0052b0fb
push str.RegSetDwordValue
lea eax, [ebp - 0x640]
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x640]
push 0x104
push eax
call fcn.0052b0fb
push str.RegDelName
lea eax, [ebp - 0x848]
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x848]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0x48
lea eax, [ebp - 0x230]
push ebx
push 0x104
push eax
push 0x58877c
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x409150
push ebx
push 0x104
lea eax, [ebp - 0x230]
xor edi, edi
push eax
push 0x58877c
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x409588
push 0xa
inc edi
lea eax, [ebp - 0x10]
push 5
mov dword [ebp - 0x106c], edi
xor edi, edi
push eax
push dword [ebp - 0x106c]
call fcn.0052b93d
lea eax, [ebp - 0x230]
push str.HKEY_CURRENT_USER
push eax
call fcn.0052b195
lea ecx, [ebp - 0x230]
add esp, 0x18
cmp ecx, eax
jne 0x4094c6
mov esi, SysReAllocStringLen
jmp 0x409513
lea eax, [ebp - 0x230]
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.0052b195
lea ecx, [ebp - 0x230]
add esp, 8
cmp ecx, eax
jne 0x4094f0
mov edi, 0x13
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x409518
lea eax, [ebp - 0x230]
push str.HKEY_CLASSES_ROOT
push eax
call fcn.0052b195
lea ecx, [ebp - 0x230]
add esp, 8
cmp ecx, eax
jne 0x409518
mov esi, SysReAllocStringLen
mov edi, 0x12
lea eax, [ebp - 0x230]
lea eax, [eax + edi*2]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.RegDelKey
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0x18
lea eax, [ebp - 0x230]
push ebx
push 0x104
push eax
push 0x58877c
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [ebp - 0x106c]
test eax, eax
jne 0x409485
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00529d59
mov esp, ebp
pop ebp
ret 4