Function at 0x40299d
Capabilities:
Delete directory
Delete file
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
push 0x4c
mov eax, 0x4bbdb7
call fcn.00418075
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x44]
push 0x4d45b4
push eax
call fcn.00402461
push str.HprSnap.exe___unregonly
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00401a36
add esp, 0x18
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x1388
push dword [ebp - 0x20]
push dword [ebp - 0x40]
call fcn.00407ff9
push 0x4d4140
mov eax, 0x4d415c
push eax
push eax
push str.Hyperionics
call fcn.004043f8
add esp, 0x1c
lea eax, [ebp - 0x24]
mov ebx, 0xf003f
push eax
push ebx
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402a60
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], esi
push eax
push ebx
push esi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402a60
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], 0
mov edi, 0x51c5d0
mov ebx, 0x511004
je 0x402ba1
mov esi, ebx
mov ebx, dword [ebp - 0x30]
xor eax, eax
and dword [esi], eax
mov word [edi], ax
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push dword [esi - 4]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402b80
cmp dword [0x5205dc], 6
jb 0x402ae9
push str.Progid
push str.UserChoice
push dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push eax
call fcn.0040a5b0
add esp, 0x10
lea ecx, [ebp - 0x34]
push 0
push str.ApplicationsHprSnap.exe
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
test eax, eax
js 0x402adb
mov dword [esi], 1
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x402b77
xor eax, eax
mov dword [ebp - 0x18], 0x400
mov word [0x51fdd0], ax
xor ecx, ecx
lea eax, [ebp - 0x18]
test ebx, ebx
push eax
push 0x51fdd0
push 0
push 0
mov eax, str.Application
cmove eax, ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402b77
cmp word [0x51fdd0], ax
je 0x402b77
push 0x4d4140
push 0x51fdd0
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x402b69
lea eax, [ebp - 0x18]
mov dword [esi], 1
push eax
push 0x51fdd0
push 0
push 0
push str.HprSnapOld
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402b77
push 0x51fdd0
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 8
add edi, 0x400
cmp esi, 0x511074
jl 0x402a79
mov ebx, 0x511004
mov edi, 0x51c5d0
xor esi, esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push esi
push dword [ebx - 4]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402c98
cmp dword [0x5205dc], 6
jb 0x402bf7
cmp dword [ebx], esi
je 0x402be4
push str.UserChoice
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x18], 1
push str.HprSnapOld
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x402c8f
xor eax, eax
mov dword [ebp - 0x34], 0x400
cmp dword [ebp - 0x30], eax
mov esi, str.Application
mov word [0x51fdd0], ax
cmove esi, eax
lea eax, [ebp - 0x34]
push eax
push 0x51fdd0
push 0
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402c8d
push 0x4d4140
push 0x51fdd0
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x402c8d
push edi
mov dword [ebp - 0x18], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x402c75
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x402c7f
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.HprSnapOld
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
add edi, 0x400
cmp ebx, 0x511074
jl 0x402ba4
cmp dword [ebp - 0x18], 0
je 0x402cc1
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 0x4d4ab4
lea ecx, [ebp - 0x34]
push esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004019e2
push dword [eax]
mov byte [ebp - 4], 5
call fcn.004040f0
add esp, 0x10
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov edi, 0x4d4ac0
lea ecx, [ebp - 0x34]
push edi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004019e2
push dword [eax]
mov byte [ebp - 4], 7
call fcn.004040f0
add esp, 0x10
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push esi
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004019e2
mov ebx, dword [ebp + 8]
push 0
push ebx
push dword [eax]
mov byte [ebp - 4], 9
call fcn.00403c9d
add esp, 0x18
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push edi
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004019e2
push 0
push ebx
push dword [eax]
mov byte [ebp - 4], 0xb
call fcn.00403c9d
add esp, 0x18
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d4ad0
push ebx
call fcn.004025c9
pop ecx
pop ecx
push 0x4d3d70
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str.x64
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
push ebx
push eax
call fcn.00402461
add esp, 0xc
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call edi
test eax, eax
jne 0x402e3d
push dword [ebp - 0x1c]
call fcn.004024f9
pop ecx
push str.x32
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xf
push ebx
push eax
call fcn.00402461
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x1c]
call edi
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x402ea7
push 0
push dword [ebp - 0x1c]
call esi
pop ecx
pop ecx
cmp eax, 0xffffffff
jle 0x402ea7
push dword [ebp - 0x1c]
call fcn.004024f9
pop ecx
push ebx
call edi
test eax, eax
jne 0x402ec2
push eax
push dword [ebp - 0x1c]
call esi
pop ecx
pop ecx
cmp eax, 0xffffffff
jle 0x402ec2
push ebx
call fcn.004024f9
pop ecx
push 0x5c
pop esi
push esi
push 0x4d415c
call sub.VCRUNTIME140.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x402f8c
push ebx
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
mov byte [ebp - 4], 0x11
jmp 0x402f17
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x12
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
push esi
push eax
call fcn.0040243b
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
mov bl, al
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
test bl, bl
jne 0x402eea
push esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x13
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x402f7f
push dword [ebp - 0x18]
call fcn.004024f9
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push ecx
push esp
call fcn.00403455
pop ecx
call fcn.004027f1
pop ecx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x14
push 0x18
push eax
call fcn.0040a110
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x10]
mov esi, 0x4d415c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [eax - 0xc], 4
jle 0x40304b
push esi
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
mov ebx, 0x4d3d70
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.00402461
push str..lnk
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x17
push eax
call fcn.00401a36
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x18
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator_3]
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x10]
call edi
jmp 0x403050
mov ebx, 0x4d3d70
lea eax, [ebp - 0x44]
push 0x19
push eax
call fcn.0040a110
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x19
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 4
jle 0x4030e2
push esi
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x1a
push ebx
push eax
call fcn.00402461
push str..lnk
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x1b
push eax
call fcn.00401a36
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1c
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator_3]
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0x44]
push 0x17
push eax
call fcn.0040a110
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1d
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 4
jle 0x403183
push esi
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x1e
push ebx
push eax
call fcn.00402461
push ebx
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x1f
push eax
call fcn.00401a36
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x20
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator_3]
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d4b10
push dword [ebp - 0x10]
call fcn.004025c9
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0x200
push 0x51fdd0
xor esi, esi
mov dword [ebp - 0x28], 0x208
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x40340c
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea eax, [ebp - 0x3c]
inc esi
push eax
push 0xf003f
push 0
push 0x51fdd0
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4033ee
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4033e5
mov word [0x51fdd0], ax
lea eax, [ebp - 0x28]
push eax
push 0x51fdd0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x28], 0x400
push eax
push 0
push str.Startup
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [0x51fdd0], 0
je 0x40328f
push 0x4d415c
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x21
push 0x4d3d70
push eax
call fcn.00402461
push str..lnk
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x22
push eax
call fcn.00401a36
push dword [eax]
push 0x51fdd0
call ebx
add esp, 0x20
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x51fdd0
call edi
xor eax, eax
mov dword [ebp - 0x28], 0x400
mov word [0x51fdd0], ax
lea eax, [ebp - 0x28]
push eax
push 0x51fdd0
lea eax, [ebp - 0x38]
push eax
push 0
push str.Desktop
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [0x51fdd0], 0
je 0x40332b
push 0x4d415c
lea ecx, [ebp - 0x4c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x23
push 0x4d3d70
push eax
call fcn.00402461
push str..lnk
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x24
push eax
call fcn.00401a36
push dword [eax]
push 0x51fdd0
call ebx
add esp, 0x20
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x48]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x51fdd0
call edi
xor eax, eax
mov dword [ebp - 0x28], 0x400
mov word [0x51fdd0], ax
lea eax, [ebp - 0x28]
push eax
push 0x51fdd0
lea eax, [ebp - 0x38]
push eax
push 0
push str.Programs
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [0x51fdd0], 0
je 0x4033e5
push 0x4d415c
lea ecx, [ebp - 0x58]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x25
push 0x4d3d70
push eax
call fcn.00402461
push 0x4d3d70
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x26
push eax
call fcn.00401a36
push dword [eax]
push 0x51fdd0
call ebx
add esp, 0x20
lea ecx, [ebp - 0x50]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x54]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d4b10
push 0x51fdd0
call fcn.004025c9
pop ecx
pop ecx
push 0x51fdd0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x200
push 0x51fdd0
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4031b0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x40]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
call fcn.00418043
ret