Function at 0x40e9d4
Capabilities:
Delete registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xaf4
push ebx
push esi
push edi
call fcn.00411a46
xor esi, esi
push str.SeLoadDriverPrivilege
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
call fcn.0040fe7a
push str.SeUndockPrivilege
lea eax, [esp + 0x18]
call fcn.0040fe7a
push str.SeRestorePrivilege
lea eax, [esp + 0x18]
call fcn.0040fe7a
push 0x8001
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
lea eax, [esp + 0x50]
call fcn.00406cc2
lea ebx, [esp + 0x2f0]
mov dword [esp + 0x78], 0x20
mov dword [esp + 0x70], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x80], esi
call fcn.0040e591
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov dword [esp + 0x700], eax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x6fc], edi
mov dword [esp + 0x6f8], eax
call fcn.004070fd
mov esi, dword [esp + 0x6f0]
push str._savelangfile
call fcn.0040726f
test eax, eax
jl 0x40eacf
mov dword [0x41ae1c], 0x41a694
call fcn.00407ead
lea edi, [esp + 0x2f0]
call fcn.0040e698
lea esi, [esp + 0x50]
call fcn.00406ce4
lea esi, [esp + 0x70]
call fcn.00410158
lea esi, [esp + 0x50]
call fcn.00406ce4
cmp dword [esp + 0x14], 0
jmp 0x40f4b4
call fcn.00407d7c
mov esi, dword [esp + 0x6f0]
push str._deleteregkey
call fcn.0040726f
test eax, eax
jl 0x40eafb
push str.SoftwareNirSoftUSBDeview
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40ea9e
xor ebx, ebx
mov dword [0x41b04c], ebx
call fcn.00405f3f
test eax, eax
je 0x40ebce
mov esi, dword [esp + 0x6f0]
push str._RunAsAdmin
call fcn.0040726f
test eax, eax
jl 0x40ebce
push dword [ebp + 0x10]
lea edi, [esp + 0x30]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], 0x100
mov dword [esp + 0x38], ebx
call fcn.00406e89
push str._RunAsAdmin
mov eax, edi
push eax
call fcn.00406f31
mov ecx, eax
cmp ecx, ebx
jl 0x40ebc5
mov eax, edi
push eax
push 0xb
pop eax
mov ebx, ecx
call fcn.00406fec
xor ebx, ebx
push 0x104
lea eax, [esp + 0x1ed]
push ebx
push eax
mov byte [esp + 0x1f4], bl
call sub.msvcrt.dll_memset
lea eax, [esp + 0x1f4]
add esp, 0xc
push eax
call fcn.00405dcb
mov eax, dword [esp + 0x30]
cmp eax, ebx
pop ecx
jne 0x40eba7
mov eax, 0x416615
push eax
lea eax, [esp + 0x1ec]
push eax
call fcn.0040694e
pop ecx
pop ecx
lea esi, [esp + 0x2c]
call fcn.00406e64
jmp 0x40f489
lea esi, [esp + 0x2c]
call fcn.00406e64
mov eax, dword [esp + 0x6f0]
cmp dword [eax + 0x30], 1
jl 0x40ed52
lea eax, [esp + 0x2f0]
call fcn.0040e8a3
test eax, eax
jne 0x40f489
push ebx
lea eax, [esp + 0x2f4]
call fcn.0040d2cc
lea eax, [esp + 0x2f0]
call fcn.0040e771
mov ecx, dword [esp + 0x6f0]
or eax, 0xffffffff
cmp dword [ecx + 0x30], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], ebx
jle 0x40ed52
mov eax, dword [esp + 0x10]
call fcn.0040725f
mov edi, eax
mov eax, dword [esp + 0x10]
push str._regedit
mov dword [esp + 0x1c], edi
call fcn.00407299
test eax, eax
jne 0x40ee1b
push 5
push str._stop
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40ed9b
push 7
pop esi
push esi
push str._remove
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40edcb
push 0xf
push str._disable_enable
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40edd7
push 8
pop edi
push edi
push str._disable
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40ede4
push esi
push str._enable
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40edf0
push 0xb
push str._reload_hub
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40edfc
push 0xd
push str._is_connected
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40ee09
push 0xc
push str._is_disabled
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40ee12
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x6f0]
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx + 0x30]
jl 0x40ec43
lea esi, [esp + 0x2f0]
call fcn.0040e42c
mov eax, esi
call fcn.0040e4a5
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x67
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ebx
push ebx
push 0x415
push dword [esp + 0x404]
mov dword [esp + 0x420], eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x40f474
push 5
pop eax
mov dword [esp + 0x1c], 1
mov ecx, dword [esp + 0x18]
lea esi, [eax + ecx]
push 0x416615
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40ef29
mov eax, dword [esp + 0x10]
jmp 0x40eff5
mov eax, esi
mov dword [esp + 0x1c], 4
jmp 0x40eda6
push 0xf
pop eax
mov dword [esp + 0x1c], 5
jmp 0x40eda6
mov eax, edi
mov dword [esp + 0x1c], 2
jmp 0x40eda6
mov eax, esi
mov dword [esp + 0x1c], 3
jmp 0x40eda6
push 0xb
pop eax
mov dword [esp + 0x1c], 6
jmp 0x40eda6
push 0xd
pop eax
mov dword [esp + 0x1c], esi
jmp 0x40eda6
push 0xc
pop eax
mov dword [esp + 0x1c], edi
jmp 0x40eda6
lea eax, [esp + 0xa0]
call fcn.00412d70
push ebx
push eax
call fcn.00412e36
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x6f0]
inc eax
call fcn.0040725f
xor edi, edi
cmp dword [esp + 0x1d8], ebx
mov dword [esp + 0x24], eax
jle 0x40eea9
mov eax, edi
lea ecx, [esp + 0x1cc]
call fcn.004034e8
push 0x3ff
mov dword [esp + 0x24], eax
lea eax, [esp + 0x705]
push ebx
push eax
mov byte [esp + 0x70c], bl
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0xc
lea esi, [esp + 0x700]
call fcn.00412f5a
push dword [esp + 0x24]
mov eax, esi
push eax
call sub.msvcrt.dll__mbsicmp
test eax, eax
pop ecx
pop ecx
je 0x40ef02
inc edi
cmp edi, dword [esp + 0x1d8]
jl 0x40ee4e
lea esi, [esp + 0x1cc]
call fcn.00410158
lea esi, [esp + 0xa0]
call fcn.00406ce4
lea edi, [esp + 0x2f0]
call fcn.0040e698
lea esi, [esp + 0x50]
call fcn.00406ce4
lea esi, [esp + 0x70]
call fcn.00410158
lea esi, [esp + 0x50]
call fcn.00406ce4
cmp dword [esp + 0x14], ebx
je 0x40eef8
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, 0xffff
jmp 0x40f4c2
mov ecx, dword [esp + 0x20]
push ebx
call fcn.00414030
lea esi, [esp + 0x1cc]
call fcn.00410158
lea esi, [esp + 0xa0]
call fcn.00406ce4
jmp 0x40f489
push str._by_serial
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40ef47
mov eax, dword [esp + 0x10]
mov dword [esp + 0x48], eax
jmp 0x40eff9
push str._by_drive
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40ef65
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
jmp 0x40efff
push str._all
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40ef83
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
jmp 0x40f005
push str._all_connected
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40ef9e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
jmp 0x40f011
push str._all_disconnected
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40efb9
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
jmp 0x40f017
push str._by_class
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40efd4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
jmp 0x40f00b
push str._by_pid
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40ed52
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40f027
cmp dword [esp + 0x48], ebx
je 0x40f027
cmp dword [esp + 0x4c], ebx
je 0x40f027
cmp dword [esp + 0x44], ebx
je 0x40f027
cmp dword [esp + 0x20], ebx
je 0x40f027
cmp dword [esp + 0x40], ebx
je 0x40f027
cmp dword [esp + 0x2c], ebx
je 0x40f027
cmp dword [esp + 0x24], ebx
jne 0x40ed52
mov ecx, dword [esp + 0x6f0]
mov esi, dword [ecx + 0x30]
xor edi, edi
cmp esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
jle 0x40f05a
mov eax, edi
call fcn.0040725f
cmp byte [eax], 0x5c
jne 0x40f055
cmp byte [eax + 1], 0x5c
jne 0x40f055
mov dword [esp + 0x28], eax
inc edi
cmp edi, esi
jl 0x40f03f
lea eax, [esp + 0xa0]
call fcn.00412d70
mov eax, dword [esp + 0x6f8]
mov eax, dword [eax + 0x5c]
push dword [esp + 0x28]
mov dword [esp + 0x1e4], eax
lea eax, [esp + 0xa4]
push eax
call fcn.00412e36
mov esi, dword [esp + 0x6f0]
xor edi, edi
push str._showmsg
mov dword [esp + 0x2c], edi
call fcn.0040726f
test eax, eax
jl 0x40f0af
mov dword [esp + 0x28], 1
mov edi, dword [esp + 0x28]
cmp dword [esp + 0x4c], ebx
jne 0x40f0e0
mov ecx, dword [esp + 0x6f0]
push dword [esp + 0x1c]
mov eax, dword [ecx + 0x30]
push edi
dec eax
call fcn.0040725f
push eax
lea eax, [esp + 0xac]
call fcn.004153e6
mov dword [esp + 0x10], eax
jmp 0x40f316
cmp dword [esp + 0x48], ebx
jne 0x40f10d
mov ecx, dword [esp + 0x6f0]
push dword [esp + 0x1c]
mov eax, dword [ecx + 0x30]
push edi
dec eax
call fcn.0040725f
push eax
lea ebx, [esp + 0xac]
call fcn.00415363
jmp 0x40f310
cmp dword [esp + 0x44], ebx
jne 0x40f129
push dword [esp + 0x1c]
lea ebx, [esp + 0xa4]
push edi
call fcn.004154d3
jmp 0x40f310
cmp dword [esp + 0x40], ebx
jne 0x40f147
push dword [esp + 0x1c]
push edi
push 1
lea ebx, [esp + 0xac]
call fcn.00415467
jmp 0x40f310
cmp dword [esp + 0x2c], ebx
jne 0x40f155
push dword [esp + 0x1c]
push edi
push ebx
jmp 0x40f136
mov ecx, dword [esp + 0x6f0]
mov eax, dword [ecx + 0x30]
dec eax
cmp dword [esp + 0x24], ebx
jne 0x40f217
call fcn.0040725f
mov esi, 0xff
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1ed]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1f4], bl
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x38], ebx
stosd dword es:[edi], eax
add esp, 0xc
or dword [esp + 0x30], 0xffffffff
mov edi, str._____
jmp 0x40f1d1
cmp dword [esp + 0x18], 2
jge 0x40f1f6
lea eax, [esp + 0x1e8]
push eax
call fcn.0040639a
pop ecx
mov ecx, dword [esp + 0x18]
inc dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x2c], eax
push 1
push 0x416615
push edi
push dword [esp + 0x2c]
lea eax, [esp + 0x1f8]
push esi
push eax
lea ebx, [esp + 0x3c]
call fcn.004067c3
add esp, 0x18
test eax, eax
jne 0x40f1b0
push dword [esp + 0x1c]
lea ebx, [esp + 0xa4]
push dword [esp + 0x2c]
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.00415211
jmp 0x40f310
cmp dword [esp + 0x20], ebx
jne 0x40f2f9
call fcn.0040725f
mov esi, 0xff
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1ed]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1f4], bl
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov dword [esp + 0x2c], ebx
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
push 0x416615
mov edi, str._____
push edi
push dword [esp + 0x2c]
lea eax, [esp + 0x1f8]
push esi
push eax
lea ebx, [esp + 0x3c]
call fcn.004067c3
add esp, 0x18
test eax, eax
je 0x40f314
cmp dword [esp + 0x18], 3
jge 0x40f2d5
lea eax, [esp + 0x1e8]
push eax
call fcn.0040639a
pop ecx
mov ecx, dword [esp + 0x18]
inc dword [esp + 0x18]
push 1
push 0x416615
push edi
push dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x3c], eax
lea eax, [esp + 0x1f8]
push esi
push eax
lea ebx, [esp + 0x3c]
call fcn.004067c3
add esp, 0x18
test eax, eax
jne 0x40f28a
cmp dword [esp + 0x18], 3
jne 0x40f314
push dword [esp + 0x1c]
lea ebx, [esp + 0xa4]
push dword [esp + 0x2c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.00415284
jmp 0x40f310
push dword [esp + 0x1c]
push edi
call fcn.0040725f
push eax
lea ebx, [esp + 0xac]
call fcn.004152fd
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp dword [esp + 0x1c], 8
je 0x40f324
cmp dword [esp + 0x1c], 7
jne 0x40f32d
mov eax, dword [0x41b04c]
mov dword [esp + 0x10], eax
lea esi, [esp + 0x1cc]
call fcn.00410158
lea esi, [esp + 0xa0]
call fcn.00406ce4
push dword [esp + 0x6f8]
mov dword [esp + 0x2f4], 0x4176a0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea esi, [esp + 0x6dc]
call fcn.00410158
lea esi, [esp + 0x6c8]
call fcn.00406e64
lea esi, [esp + 0x69c]
call fcn.00412067
lea esi, [esp + 0x48c]
call fcn.00412067
lea esi, [esp + 0x464]
mov dword [esp + 0x464], 0x417dc4
call fcn.00411f46
lea esi, [esp + 0x50]
mov dword [esp + fcn.00401856], 0x416624
call fcn.00406ce4
lea esi, [esp + 0x70]
call fcn.00410158
lea esi, [esp + 0x50]
call fcn.00406ce4
cmp dword [esp + 0x14], ebx
je 0x40f3da
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [esp + 0x10]
jmp 0x40f4c2
cmp dword [esp + 0x88], 0x100
jne 0x40f403
lea ecx, [esp + 0x84]
lea edi, [esp + 0x2f0]
call fcn.0040e4ed
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x414]
push dword [esp + 0x400]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x40f474
mov eax, dword [0x41ac2c]
cmp eax, ebx
je 0x40f43f
lea ecx, [esp + 0x84]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40f474
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x3fc]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40f474
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
call esi
test eax, eax
jne 0x40f3e3
lea edi, [esp + 0x2f0]
call fcn.0040e698
lea esi, [esp + 0x50]
call fcn.00406ce4
lea esi, [esp + 0x70]
call fcn.00410158
lea esi, [esp + 0x50]
call fcn.00406ce4
cmp dword [esp + 0x14], ebx
je 0x40f4c0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10