Function at 0x401330
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path
Get installed programs
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1754
call fcn.00402d10
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
push esi
push edi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x650]
push 0x104
push ecx
call dword [sym.imp.MSVCR80.dll_strncpy_s]
add esp, 0x10
push 0x104
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebx + 4]
mov edi, str._delete
mov esi, eax
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4013ba
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SOFTWAREComputerAssociatesAccessControl
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall822BFADC_E040_4F5C_A00A_B8E558A2D616
push 0x80000002
call esi
push str.SOFTWAREClassesInstallerProductsCDAFB228040EC5F40AA08B5E852A6D61
push 0x80000002
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._deletekey
mov esi, eax
mov ecx, 0xb
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4013e4
mov eax, dword [ebx + 8]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._deleteregval
mov esi, eax
mov ecx, 0xe
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401412
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._exportonly
mov esi, eax
mov ecx, 0xc
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401464
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x12c]
push str._s_regedit.exe__e___s____s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x134]
add esp, 0x14
push ecx
lea edx, [esp + 0x1c]
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._importonly
mov esi, eax
mov ecx, 0xc
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4014af
mov eax, dword [ebx + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x128]
push str._s_regedit.exe__s___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x130]
push eax
lea edx, [esp + 0x2c]
call fcn.00401000
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._updateservicelist
mov esi, eax
mov ecx, 0x13
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4015b5
xor ebx, ebx
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push str.eTrustAccessControl_Services
push str.AccessControl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call fcn.00401a20
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.MSVCR80.dll_calloc]
push 1
push edx
call edi
mov esi, eax
add esp, 0x20
cmp esi, ebx
je 0x4019eb
mov eax, dword [esp + 0x14]
push 4
push eax
call edi
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x40152f
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x14]
push edx
push esi
push str.eTrustAccessControl_Services
push str.AccessControl
call fcn.00401a20
mov eax, dword [esp + 0x24]
push eax
push esi
push str.AccessControl_Services
push str.AccessControl
call fcn.00401a50
push edi
mov edi, dword [sym.imp.MSVCR80.dll_free]
call edi
add esp, 0x2c
push esi
call edi
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 2
push ebx
push str.SOFTWAREComputerAssociatesAccessControl_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019eb
mov edx, dword [esp + 0x10]
push str.eTrustAccessControl_Services
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._updatetransform
mov esi, eax
mov ecx, 0x11
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401753
lea eax, [esp + 0xc]
push eax
push 3
xor ebx, ebx
push ebx
push str.SOFTWAREClassesInstallerProductsCDAFB228040EC5F40AA08B5E852A6D61
push 0x80000002
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019eb
push 0x807
lea ecx, [esp + 0x755]
push ebx
push ecx
mov byte [esp + 0x75c], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x807
lea edx, [esp + 0xf5d]
push ebx
push edx
mov dword [esp + 0x1c], 0x808
mov dword [esp + 0x20], ebx
mov byte [esp + 0xf64], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x754]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.Transforms
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40173f
mov cl, byte [esp + 0x750]
cmp cl, bl
mov edx, dword [esp + 0x10]
je 0x401688
cmp cl, 0x40
jne 0x401688
cmp eax, edx
jae 0x401688
mov cl, byte [esp + eax + 0x751]
add eax, 1
cmp cl, bl
jne 0x401671
lea ecx, [esp + eax + 0x750]
push ecx
push edx
lea edx, [esp + 0xf60]
push edx
call dword [sym.imp.MSVCR80.dll_strcpy_s]
lea eax, [esp + 0xf64]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4016b0
mov ecx, dword [esp + 0x14]
sub eax, edx
mov edx, dword [esp + 0xc]
add eax, 1
push eax
lea eax, [esp + 0xf5c]
push eax
push ecx
push ebx
push str.Transforms
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.AccessControlTransformsData.txt
lea eax, [esp + 0x1c]
push eax
push str._s_s
lea ecx, [esp + 0x234]
push 0x104
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x14
lea edx, [esp + 0x228]
push 0x403518
push edx
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40173f
lea eax, [esp + 0x750]
push eax
push 0x40351c
push esi
call dword [sym.imp.MSVCR80.dll_fprintf]
add esp, 0xc
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str._restoretransform
mov esi, eax
mov ecx, 0x12
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4018a9
push str.AccessControlTransformsData.txt
lea eax, [esp + 0x1c]
push eax
push str._s_s
lea ecx, [esp + 0x234]
push 0x104
xor ebx, ebx
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 3
push ebx
push str.SOFTWAREClassesInstallerProductsCDAFB228040EC5F40AA08B5E852A6D61
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401892
push 0x807
lea eax, [esp + 0x755]
push ebx
push eax
mov byte [esp + 0x75c], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x754]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push str.Transforms
push ecx
mov dword [esp + 0x2c], 0x808
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401887
lea edx, [esp + 0x228]
push 0x403534
push edx
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x401887
push esi
lea eax, [esp + 0x754]
push 0x808
push eax
call dword [sym.imp.MSVCR80.dll_fgets]
add esp, 0xc
test eax, eax
je 0x40187d
lea eax, [esp + 0x750]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x401850
sub eax, edx
mov edx, dword [esp + 0x10]
add eax, 1
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x754]
push ecx
push edx
push ebx
push str.Transforms
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x12c]
push str._s_regedit.exe__e___s_temp.reg____s_
push eax
call esi
lea ecx, [esp + 0x134]
add esp, 0x14
push ecx
lea edx, [esp + 0x1c]
call fcn.00401000
add esp, 4
xor ebx, ebx
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x330], cl
add eax, 1
cmp cl, bl
jne 0x4018f0
lea eax, [esp + 0x330]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x401910
mov edx, dword [str._temp.reg]
mov ecx, dword [0x403564]
mov dword [eax], edx
mov dx, word [0x403568]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
xor eax, eax
jmp 0x401940
mov cl, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x438], cl
add eax, 1
cmp cl, bl
jne 0x401940
lea eax, [esp + 0x438]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x401960
mov ecx, dword [str._new_temp.reg]
mov edx, dword [0x403570]
mov dword [eax], ecx
mov ecx, dword [0x403574]
mov dword [eax + 4], edx
mov dx, word [0x403578]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x438]
push eax
lea eax, [esp + 0x334]
call fcn.00401080
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x548]
push str._s_regedit.exe__s___s_new_temp.reg_
push eax
call esi
lea ecx, [esp + 0x550]
push ecx
lea edx, [esp + 0x2c]
call fcn.00401000
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x14
lea edx, [esp + 0x330]
push edx
call esi
lea eax, [esp + 0x438]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret