Function at 0x40e890
Capabilities:
Delete file
Enumerate files on windows
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d4c1
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x588fc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00420ad8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40e8da
push 0x80004005
call fcn.00401410
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x364], esi
push 0x103
lea ecx, [ebp - 0x113]
push 0
push ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
call fcn.0050f220
add esp, 0xc
lea edx, [ebp - 0x368]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMaxthon2
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ed32
mov edx, dword [ebp - 0x368]
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0
push str.InstallLocation
push edx
mov dword [ebp - 0x36c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x368]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e980
sub eax, edx
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x364]
call fcn.00402fc0
call fcn.00420ad8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40e9b6
push 0x80004005
call fcn.00401410
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x360], eax
mov esi, dword [ebp - 0x364]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 1
call fcn.00402fc0
push 0x1f
push str.SharedAccountConfigConfig.ini
lea ecx, [ebp - 0x360]
call fcn.00402fc0
mov edi, dword [ebp - 0x360]
cmp dword [edi - 4], 1
jle 0x40ea15
mov ecx, dword [edi - 0xc]
push ecx
lea ecx, [ebp - 0x360]
call fcn.00401f00
mov edi, dword [ebp - 0x360]
push edi
push 0x53cab0
push str.Running
push str.settings
call fcn.0040e5e0
add esp, 0x10
cmp dword [edi - 4], 1
jle 0x40ea48
mov edx, dword [edi - 0xc]
push edx
lea ecx, [ebp - 0x360]
call fcn.00401f00
mov edi, dword [ebp - 0x360]
push edi
push 0x53cab0
push str.ConfirmExit
push str.Advanced
call fcn.0040e5e0
add esp, 0x10
cmp dword [edi - 4], 1
jle 0x40ea7b
mov eax, dword [edi - 0xc]
push eax
lea ecx, [ebp - 0x360]
call fcn.00401f00
mov edi, dword [ebp - 0x360]
push edi
push str.home
push str.StartPageType
push str.Startup
call fcn.0040e5e0
add esp, 0x10
cmp dword [edi - 4], 1
jle 0x40eaae
mov ecx, dword [edi - 0xc]
push ecx
lea ecx, [ebp - 0x360]
call fcn.00401f00
mov edi, dword [ebp - 0x360]
mov eax, dword [ebx]
cmp dword [eax - 4], 1
jle 0x40eac1
mov edx, dword [eax - 0xc]
push edx
mov ecx, ebx
call fcn.00401f00
mov eax, dword [ebx]
push edi
push eax
push str.HomePage
push str.Startup
call fcn.0040e5e0
add esp, 0x10
call fcn.00420ad8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40eaf1
push 0x80004005
call fcn.00401410
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x35c], eax
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [ebp - 0x35c]
mov byte [ebp - 4], 2
call fcn.00402fc0
push 0x13
push str.SharedAccountData_
lea ecx, [ebp - 0x35c]
call fcn.00402fc0
mov esi, dword [ebp - 0x35c]
cmp dword [esi - 4], 1
jle 0x40eb4a
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [ebp - 0x35c]
call fcn.00401f00
mov esi, dword [ebp - 0x35c]
push esi
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.0050f091
push str..
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005118aa
add esp, 0x18
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0x370], ebx
cmp ebx, 0xffffffff
jne 0x40ebe3
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ebb5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ebd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x364]
add eax, 0xfffffff0
jmp 0x40ed35
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esp, [esp]
test byte [ebp - 0x358], 0x10
jne 0x40ec80
lea eax, [ebp - 0x32c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ec06
sub eax, edx
cmp eax, 0xa
jne 0x40ec80
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea ecx, [ebp - 0x35c]
call fcn.00402fc0
push 3
lea edx, [ebp - 0x374]
push edx
lea ecx, [ebp - 0x35c]
call fcn.0040b280
mov eax, dword [eax]
push 0x53e4a4
push eax
call fcn.0050f561
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x374]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ec72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x40ed05
mov ebx, dword [ebp - 0x370]
lea ecx, [ebp - 0x358]
push ecx
push ebx
call esi
test eax, eax
jne 0x40ebf0
mov esi, dword [ebp - 0x35c]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ecb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ecd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x364]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ed01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x40ed53
mov esi, dword [ebp - 0x35c]
cmp dword [esi - 4], 1
jle 0x40ed26
mov edx, dword [esi - 0xc]
push edx
lea ecx, [ebp - 0x35c]
call fcn.00401f00
mov esi, dword [ebp - 0x35c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40ec98
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ed51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050e65d
mov esp, ebp
pop ebp
ret