Function at 0x401a70
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x424010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0
push dword [ebp + 0x14]
mov dword [ebp - 0x118], eax
push edi
push esi
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetINFClassA]
test eax, eax
jne 0x401aed
push 0x5c
push str.MirrorSetup.cpp
call fcn.00406f30
add esp, 8
test eax, eax
je 0x401abc
inc eax
jmp 0x401ac1
mov eax, str.MirrorSetup.cpp
push str.get_infclass
push 0
push 0x165
push eax
push str.RsupS
call fcn.00401490
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407810
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x114], 0x4d36e968
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x110], 0x11cee325
mov edx, 0xc
mov dword [ebp - 0x10c], 0x8c1bf
mov dword [ebp - 0x108], 0x1803e12b
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x401b84
add esi, 4
add ecx, 4
sub edx, 4
jae 0x401b20
cmp dword [section..data], 4
ja 0x401b6f
push 0x5c
push str.MirrorSetup.cpp
call fcn.00406f30
add esp, 8
test eax, eax
je 0x401b50
inc eax
jmp 0x401b55
mov eax, str.MirrorSetup.cpp
push str.Display_class
push 0x16b
push eax
push str.RsupS
push 4
call fcn.004024a0
add esp, 0x14
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407810
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlClassFCBEEF3E_F7AA_4F70_A494_A19CFE10FD1E
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401bca
push str.NoInstallClass
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Rsupport
push edi
call fcn.00407c60
add esp, 8
test eax, eax
je 0x401c24
push 0x5c
push str.MirrorSetup.cpp
call fcn.00406f30
add esp, 8
test eax, eax
je 0x401bf2
inc eax
jmp 0x401bf7
mov eax, str.MirrorSetup.cpp
push edi
push str.invalid_class_info:__s
push 0x17d
push eax
push str.RsupS
push 6
call fcn.004024a0
add esp, 0x18
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407810
mov esp, ebp
pop ebp
ret
push 0
push 0x2800200
push dword [ebp - 0x118]
push 0
call dword [sym.imp.SETUPAPI.dll_SetupDiInstallClassA]
mov esi, eax
test esi, esi
jne 0x401c79
push 0x5c
push str.MirrorSetup.cpp
call fcn.00406f30
add esp, 8
test eax, eax
je 0x401c63
push str.install_class
push esi
inc eax
push 0x185
jmp 0x401acd
push str.install_class
push 0
mov eax, str.MirrorSetup.cpp
push 0x185
jmp 0x401acd
call fcn.00406c90
cmp eax, 0x50000
je 0x401d7f
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlClassFCBEEF3E_F7AA_4F70_A494_A19CFE10FD1E
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x401cd4
push str.RegOpen
push esi
push 0x191
push str.MirrorSetup.cpp
call fcn.00401680
add esp, 4
jmp 0x401acd
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004019f0
add esp, 8
test eax, eax
jne 0x401d37
call fcn.00406c90
xor ecx, ecx
cmp eax, 0x60000
jb 0x401d20
lea ebx, [ebx]
movzx eax, word [ecx + str.DispCI.dll_DisplayClassInstaller]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x106], ax
test ax, ax
jne 0x401d00
jmp 0x401d37
movzx eax, word [ecx + str.Desk.Cpl_DisplayClassInstaller]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x106], ax
test ax, ax
jne 0x401d20
lea ecx, [ebp - 0x104]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401d40
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push 0
push str.Installer32
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00407810
mov esp, ebp
pop ebp
ret