Function at 0x40ecd6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40ecdd
call fcn.0045e790
mov edx, dword [esp + 0x3c]
lea ecx, [esp]
call fcn.0044e000
mov eax, dword [esp]
push eax
call sub.shlwapi.dll_PathIsRelativeW
and eax, eax
je 0x40ed59
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.ToolsDiskPart_
push edx
call fcn.0045e6f0
mov edx, dword [esp + 8]
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00415d6a
call fcn.0044e2f0
and eax, eax
je 0x40ed59
mov eax, 1
jmp 0x40ed5b
xor eax, eax
and eax, eax
je 0x40ed95
mov ebp, dword [0x47356c]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.ToolsDiskPart_
push edx
call fcn.0045e6f0
mov edx, dword [esp + 4]
push edx
call fcn.0045e6f0
lea eax, [esp + 4]
push eax
call fcn.0045e660
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlers
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x40ee1c
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
mov eax, 0x4612b4
push eax
push dword [esp + 0x3c]
call sub.advapi32.dll_RegQueryValueExW
mov dword [esp + 0x24], 1
push 4
lea eax, [esp + 0x28]
push eax
push 4
push 0
mov eax, 0x4612b4
push eax
push dword [esp + 0x3c]
call sub.advapi32.dll_RegSetValueExW
push edx
call fcn.0045e620
pop edx
push eax
push 4
mov eax, 0x46105e
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str._s__
push edx
call fcn.0045e6f0
mov edx, dword [esp + 0x10]
push edx
call fcn.0045e6f0
mov edx, 0x461740
push edx
call fcn.0045e6f0
call fcn.0045e850
mov eax, str.diskpart.exe
push eax
call fcn.0044e2d2
add dword [esp + 4], edx
call fcn.004505c2
call fcn.0044e2f0
mov dword [esp + 0x1c], eax
push dword [esp + 0x1c]
call fcn.00450b09
and eax, eax
je 0x40eeac
push dword [esp + 0x1c]
call fcn.00450b40
and eax, eax
je 0x40ee9f
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x40ee86
push dword [esp + 0x1c]
call fcn.00450b87
mov dword [esp + 0x18], eax
push dword [esp]
push 0xffffffff
call fcn.0045ba10
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40f053
push dword [esp + 4]
call fcn.0045bdb0
mov ebx, eax
and ebx, ebx
jne 0x40f04a
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 0x14]
call fcn.0045bd90
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f5b0
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x14
push dword [esp + 0x1c]
call fcn.0044f540
call fcn.0045e850
mov edx, str.rem_winntsetup_boot
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x40efad
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push 0x15
push dword [esp + 0x28]
call fcn.004500a0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044ff80
lea eax, [esp + 0xc]
push eax
call fcn.0045e660
mov ebx, dword [esp + 0x14]
or ebx, 1
mov dword [esp + 0x14], ebx
jmp 0x40f03a
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x17
push dword [esp + 0x1c]
call fcn.0044f540
call fcn.0045e850
mov edx, str.rem_winntsetup_install
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x40f03a
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push 0x18
push dword [esp + 0x28]
call fcn.004500a0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044ff80
lea eax, [esp + 0x10]
push eax
call fcn.0045e660
mov ebx, dword [esp + 0x14]
or ebx, 2
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x14]
cmp ebx, 3
jne 0x40f045
jmp 0x40f04a
jmp 0x40eec8
push dword [esp + 4]
call fcn.0045b500
cmp dword [esp + 0x18], 0
je 0x40f0ec
push edx
call fcn.0045e620
pop edx
push eax
push 0
call fcn.004584dd
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str.Diskpart_Error_r_n_r_n0x
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 5
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0044f460
pop eax
mov edx, 0x46bf06
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 0x28]
call fcn.0040219e
pop eax
call fcn.0045e850
mov ebp, dword [0x893880]
push dword [ebp + 0x100]
push 0x40
call fcn.0044e2d2
add dword [esp + 8], edx
call fcn.0040e5f6
call fcn.0044e2f0
mov ebx, dword [esp + 0x14]
cmp ebx, 3
jne 0x40f104
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40f104
mov eax, 1
jmp 0x40f106
xor eax, eax
and eax, eax
je 0x40f154
mov ebp, dword [0x473558]
mov ebx, dword [ebp + 0x64]
cmp ebx, 1
jne 0x40f136
push dword [esp + 8]
push 0xa
call fcn.0040b6d3
push dword [esp + 0xc]
push 0xb
call fcn.0040b6d3
jmp 0x40f152
push dword [esp + 8]
push 0x3b
call fcn.0040b6d3
push dword [esp + 0xc]
push 0x3c
call fcn.0040b6d3
jmp 0x40f194
mov eax, 0x46105e
push eax
push 0xa
call fcn.0040b6d3
mov eax, 0x46105e
push eax
push 0xb
call fcn.0040b6d3
mov eax, 0x46105e
push eax
push 0x3b
call fcn.0040b6d3
mov eax, 0x46105e
push eax
push 0x3c
call fcn.0040b6d3
mov ebx, dword [esp + 0x20]
cmp ebx, 1
je 0x40f202
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlers
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x40f202
push 4
lea eax, [esp + 0x24]
push eax
push 4
push 0
mov eax, 0x4612b4
push eax
push dword [esp + 0x3c]
call sub.advapi32.dll_RegSetValueExW
push dword [esp + 0x28]
call sub.advapi32.dll_RegCloseKey
xor eax, eax
push dword [esp + 8]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0x10]
call fcn.0045e7f0
push dword [esp + 0xc]
call fcn.0045e7f0
add esp, 0x30
pop ebx
pop ebp
ret 4