Function at 0x40991e
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41390c
mov eax, dword fs:[0]
push eax
sub esp, 0xedc
push esi
push edi
lea edi, [ebp - 0xee8]
mov ecx, 0x3b7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
call fcn.004105bd
movzx eax, al
test eax, eax
je 0x409979
mov al, byte [ebp - 0x11]
jmp 0x409ee1
cmp dword [ebp + 8], 0
je 0x40998b
cmp dword [ebp + 0xc], 0
je 0x40998b
cmp dword [ebp + 0x10], 0
jne 0x409993
mov al, byte [ebp - 0x11]
jmp 0x409ee1
and dword [ebp - 0x1c], 0
and dword [ebp - 0x28], 0
and dword [ebp - 0x34], 0
push 0x423de0
lea ecx, [ebp - 0x54]
call fcn.00404a88
and dword [ebp - 4], 0
push 0x400
lea eax, [ebp - 0x85c]
push eax
call fcn.00407be8
pop ecx
pop ecx
mov dword [ebp - 0x864], eax
push 0x423de4
lea ecx, [ebp - 0x880]
call fcn.00404a88
mov byte [ebp - 4], 1
cmp dword [ebp - 0x864], 0
je 0x409a1e
mov dword [ebp - 0x888], MsiConfigureFeatureFromDescriptorA
push str.USERS_
lea ecx, [ebp - 0x880]
call fcn.0040b252
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040b252
push 0x423df8
lea ecx, [ebp - 0x54]
call fcn.0040b252
jmp 0x409a38
mov dword [ebp - 0x888], MsiConfigureFeatureFromDescriptorA
push 0x423dfc
lea ecx, [ebp - 0x880]
call fcn.0040b252
push 0x423e18
lea ecx, [ebp - 0x54]
call fcn.0040b252
push dword [ebp + 8]
lea ecx, [ebp - 0x54]
call fcn.0040b252
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x880]
call fcn.0040b21f
push 0x423e94
lea ecx, [ebp - 0x880]
call fcn.0040b252
call fcn.004088b5
movzx eax, al
test eax, eax
jne 0x409c74
mov esi, esp
lea eax, [ebp - 0x34]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x54]
call fcn.0040b469
push eax
push dword [ebp - 0x888]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jne 0x409b53
and dword [ebp - 0x890], 0
mov esi, esp
lea eax, [ebp - 0x890]
push eax
push 0x20019
push 0
push 0x423eac
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jne 0x409b41
mov esi, esp
push dword [ebp - 0x890]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
push 4
lea ecx, [ebp - 0x880]
call fcn.0040b469
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x423ec4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x409b41
mov byte [ebp - 0x12], 1
mov esi, esp
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411bb8
movzx eax, byte [ebp - 0x12]
test eax, eax
jne 0x409c72
and dword [ebp - 0x89c], 0
push 0x423edc
lea ecx, [ebp - 0x54]
call fcn.0040b252
mov esi, esp
push 0
lea eax, [ebp - 0x89c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x54]
call fcn.0040b469
push eax
push dword [ebp - 0x888]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jne 0x409c72
cmp dword [ebp - 0x1c], 0
je 0x409bdf
mov esi, esp
push 0
push dword [ebp - 0x1c]
push 0
push 0
push 4
push 4
push 0
lea ecx, [ebp - 0x880]
call fcn.004055dd
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411bb8
lea eax, [eax + eax + 2]
mov esi, esp
push eax
push dword [ebp + 0xc]
push 1
push 0
push str.Progid
push dword [ebp - 0x89c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jne 0x409c5d
mov esi, esp
push dword [ebp + 0x10]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411bb8
lea eax, [eax + eax + 2]
mov esi, esp
push eax
push dword [ebp + 0x10]
push 1
push 0
push str.Hash
push dword [ebp - 0x89c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jne 0x409c5d
mov byte [ebp - 0x11], 1
mov esi, esp
push dword [ebp - 0x89c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411bb8
jmp 0x409c81
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004015cd
pop ecx
pop ecx
mov esi, esp
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp esi, esp
call fcn.00411bb8
call fcn.004088b5
movzx eax, al
test eax, eax
je 0x409e9f
mov esi, esp
push 0x423f10
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
jne 0x409e9f
lea ecx, [ebp - 0x8b0]
call fcn.00411016
mov byte [ebp - 4], 2
push 0x208
push 0
lea eax, [ebp - 0xac0]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x423f1c
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x409d29
mov esi, esp
push str.HKEY_LOCAL_MACHINESOFTWAREAdobeAcrobat_Reader
push 0x104
lea eax, [ebp - 0xac0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
jmp 0x409d5f
push 0x423f44
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x409d5f
mov esi, esp
push str.HKEY_LOCAL_MACHINESOFTWAREAdobeAdobe_Acrobat
push 0x104
lea eax, [ebp - 0xac0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xac0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x409e90
push 0
push str.iSuppressToastMessage
lea eax, [ebp - 0xac0]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.0041138f
test eax, eax
jne 0x409e90
mov esi, esp
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00411bb8
push 0x208
push 0
lea eax, [ebp - 0xcd0]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xee0]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push str.HKEY_
push 0x104
lea eax, [ebp - 0xee0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea ecx, [ebp - 0x880]
call fcn.0040b469
mov esi, esp
push eax
push 0x104
lea eax, [ebp - 0xee0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0xcd0]
push eax
push 0x424064
lea eax, [ebp - 0xee0]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0xcd0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x409e90
mov esi, esp
push dword [ebp + 0xc]
lea eax, [ebp - 0xcd0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x409e90
call fcn.00408517
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8b0]
call fcn.00411040
cmp dword [ebp - 0x28], 0
je 0x409eb7
mov esi, esp
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, esp
call fcn.00411bb8
mov al, byte [ebp - 0x11]
mov byte [ebp - 0xee5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x880]
call fcn.0040531b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040531b
mov al, byte [ebp - 0xee5]
push edx
mov ecx, ebp
push eax
lea edx, [0x409f1a]
call fcn.00411b62
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411bf0
add esp, 0xee8
cmp ebp, esp
call fcn.00411bb8
leave
ret