Function at 0x411ab0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value
Terminate process
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x44fc28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
mov eax, dword [0x46c194]
mov ecx, dword [0x46c1ac]
xor ebp, ebp
mov dword [esp + 0x10], ebp
mov eax, dword [eax + edi*4]
mov edx, dword [ecx + edi*4]
and eax, 0xfd
mov dword [esp + 0x1c], eax
mov eax, dword [0x46c1f4]
mov ecx, dword [eax + edi*4]
mov al, byte [ecx]
mov dword [esp + 0x20], edx
mov edx, dword [0x46bb84]
cmp byte [edx + 0x64], al
mov dword [esp + 0x4c], 1
je 0x411b33
push str.Vcb__RootPath_0___fileDirArray_itemNum__0_
push 0x7ba
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x411b33
push eax
call fcn.0041c4fb
mov al, byte [0x46bd79]
test al, al
jne 0x411b5e
push str.DefragInProgress
push 0x7bb
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x411b5e
push eax
call fcn.0041c4fb
mov eax, dword [esp + 0x5c]
mov eax, dword [eax - 8]
cmp eax, 2
jl 0x411bee
push 1
push 0x5c
lea ecx, [esp + 0x20]
call fcn.0042db11
push 1
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x64]
mov byte [esp + 0x54], 2
call fcn.0042dcc2
mov esi, dword [esp + 0x18]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x411bbe
test cl, cl
je 0x411bba
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x411bbe
add eax, 2
add esi, 2
test cl, cl
jne 0x411b96
xor eax, eax
jmp 0x411bc3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x24]
setne bl
call fcn.00434de3
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 1
call fcn.00434de3
test bl, bl
je 0x411bee
push 0x5c
lea ecx, [esp + 0x60]
call fcn.004351e6
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARESoftwareShelf
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
je 0x411c27
push eax
call esi
call fcn.004028e0
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push str.Uinit5
mov ebx, 4
push edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x6c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x411cfc
mov ecx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x58]
push eax
push ebx
push 0
push str.Uinit5
push ecx
mov dword [esp + 0x6c], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x411c9c
push eax
call esi
call fcn.004028e0
push 0
call esi
jmp 0x412218
call fcn.00446e5a
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x1c]
push 0
push str.Notice____Limited_use_demo
push str.This_is_a_limited_use_demo_version.__nThis_program_will_expire_after_2_files_are_recovered_n
call fcn.00432ba1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x411ccf
push eax
call esi
call fcn.004028e0
mov eax, dword [esp + 0x54]
test eax, eax
jmp 0x411d2d
cmp eax, 0xea
jne 0x411d0d
push eax
call esi
call fcn.004028e0
jmp 0x411cb8
test eax, eax
je 0x411cb8
push eax
call esi
call fcn.004028e0
push 0
call esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412218
mov esi, dword [0x46bb84]
mov al, byte [esi + 0x140]
test al, al
je 0x411d59
mov ecx, dword [esp + 0x60]
cmp byte [ecx], 0x3f
jne 0x411d59
push 0x7e
push 0
lea ecx, [esp + 0x68]
call fcn.00435329
mov esi, dword [0x46bb84]
mov edx, dword [0x46c1dc]
mov eax, dword [edx + edi*4]
mov ecx, dword [0x46c1c4]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov edx, dword [ecx + edi*4]
mov dword [esp + 0x3c], edx
mov ecx, dword [esi + 0x2c]
xor edx, edx
lea eax, [ecx + ebx - 1]
div ecx
mov edi, eax
mov al, byte [esi + 0x140]
imul edi, ecx
test al, al
jne 0x411fb8
mov al, byte [esi + 0x141]
test al, al
mov edi, dword [esp + 0x58]
jne 0x411de4
mov edx, dword [0x46b204]
mov eax, edi
shr eax, 5
mov eax, dword [edx + eax*4]
mov ecx, edi
and ecx, 0x1f
shr eax, cl
test al, 1
je 0x411de4
push str._mftbitmapptr_mftNum_
push 0x832
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x411dde
push eax
call fcn.0041c4fb
mov esi, dword [0x46bb84]
mov ecx, dword [esi + 0x60]
push 1
push edi
push ecx
call fcn.004046e0
mov edx, dword [0x46bb84]
push 0
push 0
mov esi, eax
mov eax, dword [edx + 0x60]
push 0x10
push esi
push eax
call fcn.00404100
add esp, 0x20
test eax, eax
jne 0x411e15
xor ecx, ecx
xor edx, edx
jmp 0x411e29
mov cl, byte [eax + 8]
test cl, cl
jne 0x411e23
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x411e29
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 1
push edx
push ecx
mov ecx, dword [0x46c168]
push 0
push 0
push eax
push ecx
call fcn.004037c0
mov edx, dword [0x46bb84]
push 0
push 0
push 0x30
mov edi, eax
mov eax, dword [edx + 0x60]
push esi
push eax
call fcn.00404100
add esp, 0x30
test eax, eax
jne 0x411e63
xor ecx, ecx
xor edx, edx
jmp 0x411e77
mov cl, byte [eax + 8]
test cl, cl
jne 0x411e71
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x411e77
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 1
push edx
push ecx
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
push 0
push 0
push eax
push edx
call fcn.004037c0
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x60]
push 0
push 0
push 0x80
push esi
push ecx
call fcn.00404100
add esp, 0x30
xor ebp, ebp
test ebx, ebx
jle 0x411eeb
test eax, eax
jne 0x411eba
xor ecx, ecx
xor edx, edx
jmp 0x411ece
mov cl, byte [eax + 8]
test cl, cl
jne 0x411ec8
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x411ece
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 0
push edx
mov edx, dword [0x46bb84]
push ecx
push 0
push 0
push eax
mov eax, dword [edx + 0x60]
push eax
call fcn.004037c0
add esp, 0x1c
mov ebp, eax
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
push ecx
push edx
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00434b58
push ecx
lea edx, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x60], 3
call fcn.00434b58
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x60], 1
call fcn.004118a0
add esp, 0x14
test al, al
je 0x412218
mov eax, dword [edi + 0x20]
test ah, 8
je 0x411f77
mov eax, dword [esp + 0x10]
push 0
push 0
push 2
lea ecx, [esp + 0x64]
push ecx
push 0x9c040
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x80], 2
call fcn.00402360
test eax, eax
je 0x411f77
call fcn.004028e0
test ebx, ebx
jle 0x4121f2
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x38]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4121f2
call fcn.004028e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x412218
jmp 0x41220a
test ebx, ebx
jle 0x4121f2
mov esi, dword [esi + 0x68]
mov ax, word [esi + 0xe]
test ax, ax
jne 0x411fd9
mov eax, dword [esi + 0x1c]
xor ecx, ecx
mov cx, word [esi]
imul eax, ecx
jmp 0x411fe6
xor edx, edx
mov dx, word [esi]
and eax, 0xffff
imul eax, edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push eax
push 0
call esi
mov ebp, dword [0x46bb84]
mov dword [0x46bfe8], eax
mov ecx, dword [ebp + 0x68]
xor edx, edx
mov dx, word [ecx + 0xe]
test dx, dx
jne 0x412016
mov edx, dword [ecx + 0x1c]
jmp 0x41201c
and edx, 0xffff
push edx
push eax
xor eax, eax
mov ax, word [ecx + 4]
cdq
push edx
push eax
mov eax, dword [ebp + 0x60]
push eax
call fcn.00405950
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x2c]
add esp, 0x14
push 4
push 0x1000
push edx
push 0
call esi
mov ecx, dword [0x46bb84]
mov ebp, eax
xor edx, edx
mov eax, edi
div dword [ecx + 0x2c]
mov ebx, eax
mov eax, dword [esp + 0x58]
cdq
mov edi, edx
lea edx, [esp + 0x3c]
push edx
mov esi, eax
mov eax, dword [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
mov dword [esp + 0x34], ebx
call fcn.00434b58
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x60], 4
call fcn.00434b58
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x60], 1
call fcn.004118a0
add esp, 0x14
test al, al
je 0x412218
test edi, edi
jg 0x4120de
jl 0x4120bc
cmp esi, 1
ja 0x4120de
push str.cluster_1
push 0x89d
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4120de
push eax
call fcn.0041c4fb
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
add ecx, 1
adc eax, 0
cmp edi, eax
jl 0x41211b
jg 0x4120f9
cmp esi, ecx
jbe 0x41211b
push str.cluster_Vcb__TotalClusters1
push 0x89e
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x41211b
push eax
call fcn.0041c4fb
test ebx, ebx
mov dword [esp + 0x58], 0
jle 0x4121de
mov ebx, dword [esp + 0x20]
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x60]
push 1
push ebp
push edi
push esi
push eax
call fcn.00405b40
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0x2c]
add esp, 0x14
cmp eax, ebx
jbe 0x412155
mov eax, ebx
push 0
lea edx, [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x1c]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411f9b
mov eax, dword [0x46bb84]
sub ebx, dword [eax + 0x2c]
mov ecx, dword [0x46bfe8]
push ecx
add esi, 1
push esi
push eax
adc edi, 0
call fcn.00406340
add esp, 0xc
test eax, eax
je 0x4121c9
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x14]
add esi, 1
adc edi, 0
cmp edi, ecx
jl 0x4121b4
jg 0x4121ad
cmp esi, dword [eax + 0x10]
jbe 0x4121b4
mov esi, 1
xor edi, edi
mov edx, dword [0x46bfe8]
push edx
push esi
push eax
call fcn.00406340
add esp, 0xc
test eax, eax
jne 0x412194
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x24]
inc eax
cmp eax, ecx
mov dword [esp + 0x58], eax
jl 0x41212f
mov ecx, dword [0x46bfe8]
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x41223e
call fcn.004028e0
test ebp, ebp
je 0x412218
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [esp + 0x5c]
mov byte [esp + 0x4c], 0
call fcn.00434de3
lea ecx, [esp + 0x60]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00434de3
xor al, al
jmp 0x412318
test ebp, ebp
je 0x412250
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARESoftwareShelf
dec edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x412294
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call esi
call fcn.004028e0
jmp 0x41229a
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x58]
push edx
push 4
push 0
push str.Uinit5
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4122c1
push eax
call esi
call fcn.004028e0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4122d8
push eax
call esi
call fcn.004028e0
mov eax, dword [esp + 0x54]
test eax, eax
jmp 0x4122f7
lea ecx, [esp + 0x5c]
mov byte [esp + 0x4c], 0
call fcn.00434de3
lea ecx, [esp + 0x60]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00434de3
mov al, 1
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret 0x10