Function at 0x401136
Capabilities:
Delete file
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
jmp 0x4042c0
sub esp, 0xb04
mov eax, dword [0x43b10c]
xor eax, esp
mov dword [esp + 0xb00], eax
push esi
push edi
xor edi, edi
push 0xfb
lea eax, [esp + 0x410]
push edi
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0xff
mov dword [esp + 0x2c], 1
mov dword [esp + 0x414], 0x666e70
call fcn.00407af0
add esp, 0xc
push 0xff
lea ecx, [esp + 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x808]
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x404330
mov edx, dword [str.INF]
mov cl, byte [0x435fe8]
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [esp + 0xb10]
lea edx, [esp + 0xa08]
sub edx, eax
jmp 0x404360
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x404360
push 0x9c
lea edx, [esp + 0x30]
push edi
push edx
call fcn.00407af0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x9c
call esi
test eax, eax
jne 0x4043c2
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0x94
call esi
test eax, eax
jne 0x4043c2
pop edi
pop esi
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.00407adf
add esp, 0xb04
ret
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push edx
push str.PlatformId__0x_x
push 0x43cf88
call fcn.00401041
mov eax, dword [esp + 0x44]
push eax
push str.MajorVersion___d
push 0x43cf88
call fcn.00401041
mov ecx, dword [esp + 0x54]
push ecx
push str.MinorVersion____d
push 0x43cf88
call fcn.00401041
mov eax, dword [esp + 0x68]
add esp, 0x24
sub eax, 1
je 0x404cf7
sub eax, 1
jne 0x405139
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push edi
push str.SYSTEM
push 0x80000002
call ebx
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x404888
mov dword [esp + 0x18], edi
jmp 0x404450
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push 0xff
lea eax, [esp + 0x614]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
test edi, edi
mov dword [esp + 0x2c], edi
jne 0x404866
lea eax, [esp + 0x610]
push eax
call fcn.004079c2
push eax
call fcn.0040818d
push str.ControlSet
mov esi, eax
call fcn.004079c2
push eax
call fcn.0040818d
push eax
push esi
call fcn.004072e0
add esp, 0x18
test eax, eax
je 0x404866
push 0xff
lea ecx, [esp + 0x314]
push edi
push ecx
mov dword [esp + 0x1c], edi
call fcn.00407af0
mov edx, dword [str.SYSTEM]
mov ax, word [0x435f98]
mov cl, byte [0x435f9a]
lea edi, [esp + 0x31c]
add esp, 0xc
mov dword [esp + 0x310], edx
mov word [esp + 0x314], ax
mov byte [esp + 0x316], cl
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404500
mov dx, word [0x435f80]
lea eax, [esp + 0x610]
mov word [edi], dx
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404520
lea edi, [esp + 0x310]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404535
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x310]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404560
mov ecx, 0xd
mov esi, str.ControlClass4D36E96C_E325_11CE_BFC1_08002BE10318
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x31c]
push ecx
push 0x80000002
movsw word es:[edi], word [esi]
call ebx
test eax, eax
jne 0x404849
mov dword [esp + 0x24], eax
nop
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
push 0xff
lea edx, [esp + 0x914]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
test ebx, ebx
jne 0x40483c
push 0xff
push eax
lea edx, [esp + 0x418]
push edx
mov dword [esp + 0x2c], eax
call fcn.00407af0
add esp, 0xc
xor eax, eax
jmp 0x4045f0
mov cl, byte [esp + eax + 0x310]
mov byte [esp + eax + 0x410], cl
add eax, 1
test cl, cl
jne 0x4045f0
lea edi, [esp + 0x410]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404610
mov ax, word [0x435f80]
mov word [edi], ax
lea eax, [esp + 0x910]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404630
lea edi, [esp + 0x410]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404645
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x41c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x714]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push str.MatchingDeviceId
push eax
call ebp
test eax, eax
mov dword [esp + 0x14], 0xff
jne 0x404831
lea ecx, [esp + 0x710]
push ecx
call fcn.004079c2
push eax
call fcn.0040818d
lea edx, [esp + 0xa18]
push edx
mov esi, eax
call fcn.004079c2
push eax
call fcn.0040818d
push eax
push esi
call fcn.004072e0
add esp, 0x18
test eax, eax
je 0x404831
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x514]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push str.InfPath
push eax
call ebp
test eax, eax
mov dword [esp + 0x14], 0xff
jne 0x404831
lea eax, [esp + 0x510]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404720
sub eax, edx
mov ebp, eax
xor eax, eax
nop
mov cl, byte [esp + eax + 0x810]
mov byte [esp + eax + 0x210], cl
add eax, 1
test cl, cl
jne 0x404730
lea edi, [esp + 0x210]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404750
mov cx, word [0x435f80]
lea eax, [esp + 0x210]
mov word [edi], cx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404770
sub eax, edx
mov esi, eax
xor eax, eax
test ebp, ebp
jle 0x40479e
push ebp
lea edx, [esp + 0x514]
lea eax, [esp + esi + 0x214]
push edx
push eax
call fcn.00408380
add esp, 0xc
mov eax, ebp
add ebp, esi
cmp ebp, 0xff
jg 0x4047b2
add eax, esi
mov byte [esp + eax + 0x210], 0
lea eax, [esp + 0x210]
push eax
push str.Find_OEM_file___s
push 0x43cf88
call fcn.00401041
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404824
push 0x20
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x404824
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x214]
push edx
call fcn.004010e1
add esp, 8
push 0
push 1
lea eax, [esp + 0x518]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0x24], 1
test ebx, ebx
je 0x4045a0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], 0
add dword [esp + 0x18], 1
test edi, edi
je 0x404450
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], 0
xor edi, edi
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push edi
push str.SYSTEM
push 0x80000002
call ebx
test eax, eax
jne 0x405139
mov dword [esp + 0x18], edi
jmp 0x4048b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 0xff
lea edx, [esp + 0x614]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
test edi, edi
mov dword [esp + 0x2c], edi
jne 0x404ce0
lea edx, [esp + 0x610]
push edx
call fcn.004079c2
push eax
call fcn.0040818d
push str.ControlSet
mov esi, eax
call fcn.004079c2
push eax
call fcn.0040818d
push eax
push esi
call fcn.004072e0
add esp, 0x18
test eax, eax
je 0x404ce0
push 0xff
lea eax, [esp + 0x314]
push edi
push eax
mov dword [esp + 0x2c], edi
call fcn.00407af0
mov ecx, dword [str.SYSTEM]
mov dx, word [0x435f98]
mov al, byte [0x435f9a]
lea edi, [esp + 0x31c]
add esp, 0xc
mov dword [esp + 0x310], ecx
mov word [esp + 0x314], dx
mov byte [esp + 0x316], al
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404960
mov cx, word [0x435f80]
lea eax, [esp + 0x610]
mov word [edi], cx
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404980
lea edi, [esp + 0x310]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404995
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x310]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4049c0
mov ecx, 0xd
mov esi, str.ControlClass6BDD1FC6_810F_11D0_BEC7_08002BE2092F
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x20]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x31c]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call ebx
test eax, eax
jne 0x404cc9
mov dword [esp + 0x24], eax
nop
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push 0xff
lea ecx, [esp + 0x914]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
mov dword [esp + 0x30], eax
jne 0x404cbc
push 0xff
push eax
lea ecx, [esp + 0x418]
push ecx
mov dword [esp + 0x1c], eax
call fcn.00407af0
add esp, 0xc
xor eax, eax
jmp 0x404a50
mov cl, byte [esp + eax + 0x310]
mov byte [esp + eax + 0x410], cl
add eax, 1
test cl, cl
jne 0x404a50
lea edi, [esp + 0x410]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404a70
mov dx, word [0x435f80]
lea eax, [esp + 0x910]
mov word [edi], dx
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404a90
lea edi, [esp + 0x410]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404aa5
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
push eax
and ecx, 3
push 0xf003f
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x41c]
push ecx
push 0x80000002
call ebx
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x714]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push str.MatchingDeviceId
push edx
call ebp
test eax, eax
mov dword [esp + 0x14], 0xff
jne 0x404cad
lea eax, [esp + 0x710]
push eax
call fcn.004079c2
push eax
call fcn.0040818d
lea ecx, [esp + 0xa18]
push ecx
mov esi, eax
call fcn.004079c2
push eax
call fcn.0040818d
push eax
push esi
call fcn.004072e0
add esp, 0x18
test eax, eax
je 0x404cad
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x514]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push str.InfPath
push edx
call ebp
test eax, eax
mov dword [esp + 0x14], 0xff
jne 0x404cad
lea eax, [esp + 0x510]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404b80
sub eax, edx
mov ebp, eax
xor eax, eax
nop
mov cl, byte [esp + eax + 0x810]
mov byte [esp + eax + 0x210], cl
add eax, 1
test cl, cl
jne 0x404b90
lea edi, [esp + 0x210]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404bb0
mov ax, word [0x435f80]
mov word [edi], ax
lea eax, [esp + 0x210]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404bd0
sub eax, edx
mov esi, eax
xor eax, eax
test ebp, ebp
jle 0x404bfe
push ebp
lea ecx, [esp + 0x514]
lea eax, [esp + esi + 0x214]
push ecx
push eax
call fcn.00408380
add esp, 0xc
mov eax, ebp
add ebp, esi
cmp ebp, 0xff
jg 0x404c12
add eax, esi
mov byte [esp + eax + 0x210], 0
lea edx, [esp + 0x210]
push edx
push str.Find_OEM_file___s
push 0x43cf88
call fcn.00401041
add esp, 0xc
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c9a
push 0x20
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x404c9a
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x214]
push ecx
call fcn.004010e1
add esp, 8
push 0
push 1
lea edx, [esp + 0x518]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
test eax, eax
jne 0x404c9a
push eax
push str.SetupUninstallOEMInf
push str.SetupUninstallOEMInf_fail
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x30]
add dword [esp + 0x24], 1
test eax, eax
je 0x404a00
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0
add dword [esp + 0x18], 1
test edi, edi
je 0x4048b0
mov edx, dword [esp + 0x1c]
push edx
jmp 0x405133
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push edi
push str.SystemCurrentControlSetServicesClassImage
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x18], edi
lea esp, [esp]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0xff
lea ecx, [esp + 0x614]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x2c], ebx
jne 0x405121
mov ecx, 0xb
mov esi, str.SystemCurrentControlSetServicesClassImage
lea edi, [esp + 0x310]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x310]
mov dword [esp + 0x10], eax
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404d70
mov cx, word [0x435f80]
lea eax, [esp + 0x610]
mov word [edi], cx
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404d90
lea edi, [esp + 0x310]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404da5
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
push 0xf003f
mov ecx, eax
push 0
lea eax, [esp + 0x31c]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x714]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push str.MatchingDeviceId
push ecx
call ebp
test eax, eax
mov dword [esp + 0x14], 0xff
jne 0x405116
lea edx, [esp + 0xa10]
push edx
call fcn.0040818d
push eax
lea eax, [esp + 0x718]
push eax
call fcn.00407538
add esp, 0xc
test eax, eax
je 0x405116
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x514]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push str.InfPath
push ecx
call ebp
test eax, eax
mov dword [esp + 0x14], 0xff
jne 0x405116
lea eax, [esp + 0x510]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404e70
sub eax, edx
mov ebp, eax
xor eax, eax
nop
mov cl, byte [esp + eax + 0x810]
mov byte [esp + eax + 0x210], cl
add eax, 1
test cl, cl
jne 0x404e80
lea edi, [esp + 0x210]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404ea0
mov dx, word [0x435f80]
lea eax, [esp + 0x210]
mov word [edi], dx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404ec0
sub eax, edx
mov esi, eax
xor eax, eax
test ebp, ebp
jle 0x404eee
push ebp
lea ecx, [esp + 0x514]
lea eax, [esp + esi + 0x214]
push ecx
push eax
call fcn.00408380
add esp, 0xc
mov eax, ebp
lea ecx, [esi + ebp]
cmp ecx, 0xff
jg 0x404f03
add esi, eax
mov byte [esp + esi + 0x210], 0
lea esi, [esp + 0x210]
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x404f10
lea edx, [esp + 0xd0]
push edx
lea eax, [esp + 0x214]
push eax
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404f5b
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x214]
push edx
call fcn.004010e1
add esp, 8
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x410]
mov cl, byte [esp + 0x412]
lea ebp, [esp + 0x210]
lea ebx, [esp + 0x210]
mov byte [esi + ebp - 3], al
mov byte [esi + ebx - 2], ah
sub ebp, 3
sub ebx, 2
lea eax, [esp + 0x210]
sub eax, 1
lea edx, [esp + 0xd0]
mov dword [esp + 0x30], eax
mov byte [eax + esi], cl
push edx
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404fc8
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x510]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404fe0
sub eax, edx
mov edi, eax
xor eax, eax
nop
mov cl, byte [esp + eax + 0x810]
mov byte [esp + eax + 0x210], cl
add eax, 1
test cl, cl
jne 0x404ff0
lea eax, [esp + 0x210]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x405010
mov edx, dword [str.OTHER_]
mov ecx, dword [0x435e4c]
mov dword [eax], edx
mov dword [eax + 4], ecx
lea eax, [esp + 0x210]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405035
sub eax, edx
mov esi, eax
xor eax, eax
test edi, edi
jle 0x405063
push edi
lea edx, [esp + 0x514]
lea eax, [esp + esi + 0x214]
push edx
push eax
call fcn.00408380
add esp, 0xc
mov eax, edi
lea ecx, [esi + edi]
cmp ecx, 0xff
jg 0x405078
add esi, eax
mov byte [esp + esi + 0x210], 0
lea esi, [esp + 0x210]
lea ecx, [esi + 1]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x405082
lea eax, [esp + 0xd0]
sub esi, ecx
push eax
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4050b8
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x410]
mov ecx, dword [esp + 0x30]
mov byte [esi + ebp], al
mov al, byte [esp + 0x412]
lea edx, [esp + 0xd0]
mov byte [esi + ebx], ah
mov byte [ecx + esi], al
push edx
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405105
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0x18], 1
test ebx, ebx
je 0x404d20
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xb10]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00407adf
add esp, 0xb04
ret