Function at 0x409610
Capabilities:
Delete registry key
Delete registry value
Get common file path
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x61e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x620], ax
call fcn.0041d650
add esp, 0xc
push ebx
push 0x23
lea edx, [ebp - 0x620]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x409c5a
push str.AtherosAtherosServiceConfig.ini
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.00415b25
add esp, 0xc
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x83c], ebx
mov word [ebp - 0x210], cx
call fcn.0041d650
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 2
lea ecx, [ebp - 0x83c]
push ecx
push ebx
push str.regOpType
push str.AthService
call esi
lea edx, [ebp - 0x620]
push edx
push 0x104
mov edi, eax
lea eax, [ebp - 0x210]
push eax
push ebx
push str.regPath
push str.AthService
call esi
test eax, eax
je 0x409c5a
cmp edi, ebx
je 0x409c5a
lea ecx, [ebp - 0x83c]
push ecx
call fcn.0041628a
add esp, 4
push 0x11
lea edx, [ebp - 0x210]
push str.HKEY_CLASSES_ROOT
push edx
mov dword [ebp - 0x83c], eax
call fcn.004163f2
add esp, 0xc
test eax, eax
jne 0x40974e
push 0xf2
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x210]
push 0x104
mov edi, 0x80000000
push ecx
mov dword [ebp - 0x830], edi
call fcn.00416556
jmp 0x4097fb
push 0x11
lea edx, [ebp - 0x210]
push str.HKEY_CURRENT_USER
push edx
call fcn.004163f2
add esp, 0xc
test eax, eax
jne 0x40977f
mov dword [ebp - 0x830], 0x80000001
push 0xf2
lea eax, [ebp - 0x1ec]
jmp 0x4097e3
push 0x12
lea edx, [ebp - 0x210]
push str.HKEY_LOCAL_MACHINE
push edx
call fcn.004163f2
add esp, 0xc
test eax, eax
jne 0x4097b0
mov dword [ebp - 0x830], 0x80000002
push 0xf1
lea eax, [ebp - 0x1ea]
jmp 0x4097e3
push 0xa
lea edx, [ebp - 0x210]
push str.HKEY_USERS
push edx
call fcn.004163f2
add esp, 0xc
test eax, eax
jne 0x409c41
mov dword [ebp - 0x830], 0x80000003
push 0xf9
lea eax, [ebp - 0x1fa]
push eax
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call fcn.00416556
mov edi, dword [ebp - 0x830]
mov eax, dword [ebp - 0x83c]
add esp, 0x10
cmp eax, 3
ja case.default.0x40980d
jmp dword [eax*4 + 0x409c70]
push 0x206
lea eax, [ebp - 0x416]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x418], dx
call fcn.0041d650
add esp, 0xc
lea ecx, [ebp - 0x210]
push 0x5c
push ecx
call fcn.00416032
add esp, 8
cmp eax, ebx
jne 0x409871
push ebx
push 0x300
lea edx, [ebp - 0x210]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push 0x5c
push eax
mov esi, eax
call fcn.00416032
add esp, 8
cmp eax, ebx
je 0x409894
lea esi, [eax + 2]
push 0x5c
push esi
call fcn.00416032
add esp, 8
cmp eax, ebx
jne 0x409882
lea edx, [ebp - 0x418]
mov eax, esi
sub edx, esi
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4098a0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x409c23
lea ecx, [ebp - 0x834]
push ecx
lea edx, [ebp - 0x82c]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409c23
mov edx, dword [ebp - 0x82c]
push ebx
push 0x300
lea ecx, [ebp - 0x418]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov eax, dword [ebp - 0x82c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push 0x206
lea edx, [ebp - 0x416]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x418], cx
call fcn.0041d650
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
push ebx
push str.regValue
push str.AthService
call esi
test eax, eax
je 0x409c23
lea edx, [ebp - 0x834]
push edx
lea eax, [ebp - 0x82c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x210]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409c23
mov eax, dword [ebp - 0x82c]
lea edx, [ebp - 0x418]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x82c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x834]
push edx
lea eax, [ebp - 0x82c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x210]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409c23
mov edx, dword [ebp - 0x82c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push 0x206
lea ecx, [ebp - 0x826]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x828], ax
call fcn.0041d650
add esp, 0xc
push 0x206
lea eax, [ebp - 0x416]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x418], dx
call fcn.0041d650
add esp, 0xc
lea ecx, [ebp - 0x620]
push ecx
push 0x104
lea edx, [ebp - 0x828]
push edx
push ebx
push str.regValue
push str.AthService
mov dword [ebp - 0x838], ebx
call esi
test eax, eax
jne 0x409ab1
push str.Unknown_registry_value
lea ecx, [eax + 2]
call fcn.00415320
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x620]
push eax
push 2
lea ecx, [ebp - 0x838]
push ecx
push ebx
push str.regType
push str.AthService
call esi
test eax, eax
jne 0x409af5
push str.Unknown_registry_type
lea ecx, [eax + 2]
call fcn.00415320
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x838]
push edx
call fcn.0041628a
add esp, 4
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x620]
push eax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
push ebx
push str.regData
push str.AthService
call esi
mov edi, eax
cmp edi, ebx
je 0x409c23
lea edx, [ebp - 0x840]
push edx
mov edx, dword [ebp - 0x830]
lea eax, [ebp - 0x82c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x210]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409c23
mov eax, dword [ebp - 0x838]
dec eax
je 0x409bed
sub eax, 2
je 0x409b98
dec eax
jne 0x409bf2
lea eax, [ebp - 0x418]
push eax
call fcn.0041628a
add esp, 4
mov dword [ebp - 0x418], eax
mov edi, 4
jmp 0x409bf2
xor esi, esi
cmp edi, ebx
jbe 0x409bf2
mov edi, edi
mov dx, word [ebp + esi*2 - 0x418]
xor ecx, ecx
lea eax, [ebp - 0x834]
push eax
mov word [ebp - 0x82e], cx
lea ecx, [ebp - 0x830]
push 0x42c5ec
push ecx
mov dword [ebp - 0x834], ebx
mov word [ebp - 0x830], dx
call fcn.00416252
mov dl, byte [ebp - 0x834]
mov byte [ebp + esi - 0x418], dl
inc esi
add esp, 0xc
cmp esi, edi
jb 0x409ba0
jmp 0x409bf2
mov edi, 0x104
mov ecx, dword [ebp - 0x838]
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x82c]
push ecx
push ebx
lea edx, [ebp - 0x828]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x82c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push eax
push str.Unknown_operation_type__0x_x
jmp 0x409c4d
lea edx, [ebp - 0x210]
push edx
push str.Unknown_registry_path___s
mov ecx, 2
call fcn.00415320
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret