Function at 0x4098d0
Capabilities:
Delete directory
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e1c
call fcn.00416680
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xc06]
xor bl, bl
push ecx
mov byte [ebp - 0x1e09], bl
mov word [ebp - 0xc08], ax
call fcn.00414930
add esp, 0xc
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x206]
push eax
mov dword [ebp - 0x1e14], 0
mov word [ebp - 0x208], dx
call fcn.00414930
add esp, 0xc
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x406]
push edx
mov dword [ebp - 0x1e18], 1
mov word [ebp - 0x408], cx
call fcn.00414930
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1606]
mov esi, 0x200
push ecx
mov dword [ebp - 0x1e10], esi
mov word [ebp - 0x1608], ax
call fcn.00414930
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1e06]
push eax
mov word [ebp - 0x1e08], dx
call fcn.00414930
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0xe08]
add esp, 0xc
rep stosd dword es:[edi], eax
xor eax, eax
jmp 0x4099d0
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders]
mov word [ebp + eax - 0xe08], cx
add eax, 2
test cx, cx
jne 0x4099d0
lea eax, [ebp - 0x1e14]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0xe08]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409b6f
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x408]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1e10], esi
xor eax, eax
jmp 0x409a50
movzx ecx, word [eax + str.Common_Programs]
mov word [ebp + eax - 0x208], cx
add eax, 2
test cx, cx
jne 0x409a50
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1e10]
push eax
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp - 0x1e14]
lea edx, [ebp - 0x1e18]
push edx
push 0
lea eax, [ebp - 0x208]
push eax
push ecx
call esi
test eax, eax
jne 0x409aba
jmp 0x409aa0
movzx ecx, word [ebp + eax - 0x408]
mov word [ebp + eax - 0x1608], cx
add eax, 2
test cx, cx
jne 0x409aa0
mov bl, 1
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x408]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1e10], 0x200
xor eax, eax
jmp 0x409b00
movzx ecx, word [eax + str.Common_Desktop]
mov word [ebp + eax - 0x208], cx
add eax, 2
test cx, cx
jne 0x409b00
lea eax, [ebp - 0x1e10]
push eax
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp - 0x1e14]
lea edx, [ebp - 0x1e18]
push edx
push 0
lea eax, [ebp - 0x208]
push eax
push ecx
call esi
test eax, eax
jne 0x409b6f
jmp 0x409b50
movzx ecx, word [ebp + eax - 0x408]
mov word [ebp + eax - 0x1e08], cx
add eax, 2
test cx, cx
jne 0x409b50
mov byte [ebp - 0x1e09], 1
mov edx, dword [ebp - 0x1e14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp bl, 1
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jne 0x409d38
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc08]
rep stosd dword es:[edi], eax
push str.WinMaster7_Console
lea eax, [ebp - 0x1608]
push eax
lea ecx, [ebp - 0xc08]
push 0x4218ec
push ecx
call ebx
push 0
lea edx, [ebp - 0xc08]
push 0
push edx
call fcn.0040a5a0
add esp, 0x1c
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc08]
rep stosd dword es:[edi], eax
push str.WinMaster7_Console
lea eax, [ebp - 0x1608]
push eax
lea ecx, [ebp - 0xc08]
push 0x4218ec
push ecx
call ebx
push 0
lea edx, [ebp - 0xc08]
push 0
push edx
call fcn.0040a5a0
add esp, 0x1c
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x200
lea edi, [ebp - 0xc08]
or eax, edx
rep stosd dword es:[edi], eax
push str.WinMaster7_Console
lea eax, [ebp - 0x1608]
push eax
lea ecx, [ebp - 0xc08]
push 0x4218ec
push ecx
call ebx
push 0
lea edx, [ebp - 0xc08]
push 0
push edx
call fcn.0040a5a0
add esp, 0x1c
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
mov esi, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsWinMaster7_Console
mov ecx, 0x80000001
call fcn.0040a170
cmp byte [ebp - 0x1e09], 1
jne 0x409dc3
push 0x400
lea ecx, [ebp - 0xc08]
push 0
push ecx
call fcn.00414930
add esp, 0xc
push str.WinMaster7_Console.lnk
lea edx, [ebp - 0x1e08]
push edx
lea eax, [ebp - 0xc08]
push 0x4218ec
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
lea ecx, [ebp - 0xc08]
push ecx
call esi
push 0x400
lea edx, [ebp - 0xc08]
push 0
push edx
call fcn.00414930
add esp, 0xc
push str.WinMaster7
lea eax, [ebp - 0x1e08]
push eax
lea ecx, [ebp - 0xc08]
push 0x4218ec
push ecx
call ebx
add esp, 0x10
lea edx, [ebp - 0xc08]
push edx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret