Function at 0x417b70
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x98], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x418228
mov edi, eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x1c
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], eax
nop
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
cmp eax, 1
jne 0x417d92
mov dword [ebp - 0x64], 0
xor eax, eax
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x64]
mov dword [esp + 8], ebx
mov dword [esp], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
sub esp, 0x14
test eax, eax
jne 0x417c39
mov esi, dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x417cc4
lea esi, [ebp - 0x74]
test ebx, ebx
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x74], 0
mov dword [ebp - 0x7c], esi
je 0x417ca4
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x7c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004cb7a0
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
sub esp, 4
mov ebx, dword [ebp - 0x7c]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x78]
je 0x417e41
cmp ebx, esi
je 0x417cb2
mov dword [esp], ebx
call fcn.004ed8c0
jmp 0x417cb2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x417e62
add dword [ebp - 0x90], 1
mov eax, dword [ebp - 0x8c]
jmp 0x417bd0
test ebx, ebx
je 0x417cd4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
test esi, esi
jne 0x417ce2
mov eax, dword [ebp - 0x64]
xor ebx, ebx
jmp 0x417bfe
mov dword [esp + 4], esi
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x417d20
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004327e0
mov eax, dword [ebp - 0x64]
jmp 0x417bfe
call fcn.0042c430
lea edx, [ebp - 0x4c]
lea esi, [ebp - 0x44]
mov ecx, 0x6570
mov dword [esp + 0x10], 0x4fc2db
mov dword [esp + 0xc], 0xcb
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], 0x63656843
mov dword [ebp - 0x40], 0x7272456b
mov dword [ebp - 0x3c], 0x7954726f
mov word [ebp - 0x38], cx
mov dword [ebp - 0x48], 0xe
mov byte [ebp - 0x36], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, esi
je 0x417d14
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x417d14
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
lea ebx, [ebp - 0x2c]
call fcn.0042c430
mov dword [esp], 0x1a
mov esi, eax
mov dword [ebp - 0x34], ebx
call fcn.004ed900
mov dword [eax], 0x656c6544
mov dword [eax + 4], 0x6e496574
mov dword [eax + 8], 0x6e617473
mov dword [eax + 0xc], 0x6f536563
mov dword [eax + 0x10], 0x61577466
mov dword [eax + 0x14], 0x654b6572
mov byte [eax + 0x18], 0x79
mov byte [eax + 0x19], 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 0x10], str.DeleteInstanceSoftWareKey_return_ERROR_NO_SUCH_DEVICE_leave
mov dword [esp + 0xc], 0x16c
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [ebp - 0x2c], 0x19
mov dword [ebp - 0x30], 0x19
call fcn.0042ce70
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x417e32
mov dword [esp], eax
call fcn.004ed8c0
mov eax, 2
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
test eax, eax
je 0x417e62
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x417c96
call fcn.0042c430
lea edx, [ebp - 0x44]
mov dword [esp], 0x1a
mov dword [ebp - 0x90], eax
mov ebx, dword [ebp - 0x7c]
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x4c], edx
call fcn.004ed900
mov dword [eax], 0x656c6544
mov dword [eax + 4], 0x6e496574
lea ecx, [ebp - 0x4c]
mov dword [eax + 8], 0x6e617473
mov dword [eax + 0xc], 0x6f536563
mov dword [eax + 0x10], 0x61577466
mov dword [eax + 0x14], 0x654b6572
mov byte [eax + 0x18], 0x79
mov byte [eax + 0x19], 0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x90]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], str.Device_instance_id_is__s
mov dword [esp + 0xc], 0x14a
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 0x48], 0x19
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x94]
je 0x417f0e
mov dword [esp], eax
call fcn.004ed8c0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
xor edx, edx
mov dword [ebp - 0x4c], 0
xor eax, eax
jmp 0x417f65
mov ebx, dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x84]
mov ecx, dword [ebp - 0x98]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00414e60
sub esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x84]
je 0x417fa3
mov eax, dword [ebp - 0x80]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x80]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 0x18], ecx
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
je 0x417f30
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x5c]
test edx, edx
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x5c], 0
mov dword [ebp - 0x64], eax
je 0x418027
mov dword [esp], edx
mov dword [ebp - 0x8c], edx
call sub.msvcrt.dll_strlen
cmp eax, 0xf
mov ebx, eax
mov edx, dword [ebp - 0x8c]
ja 0x4183cc
lea eax, [ebp - 0x5c]
add eax, ebx
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x5c]
cmp edx, eax
je 0x4183fe
test ebx, ebx
je 0x418009
cmp ebx, 1
jne 0x418440
movzx eax, byte [edx]
mov byte [ebp - 0x5c], al
lea eax, [ebp - 0x5b]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60], ebx
mov byte [eax], 0
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
call fcn.0042c430
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x94]
mov dword [esp], 0x1a
mov ebx, dword [ebp - 0x64]
mov dword [ebp - 0x4c], eax
call fcn.004ed900
mov dword [eax], 0x656c6544
mov dword [eax + 4], 0x6e496574
mov dword [eax + 8], 0x6e617473
mov dword [eax + 0xc], 0x6f536563
mov dword [eax + 0x10], 0x61577466
mov dword [eax + 0x14], 0x654b6572
mov byte [eax + 0x18], 0x79
mov byte [eax + 0x19], 0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], str.Soft_key_is__s
mov dword [esp + 0xc], 0x14c
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], 0
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 0x48], 0x19
mov dword [esp], eax
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x94]
je 0x4180d0
mov dword [esp], eax
call fcn.004ed8c0
mov edx, dword [ebp - 0x60]
test edx, edx
je 0x4181d0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlClass_
mov dword [esp + 0x10], eax
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
mov ebx, eax
call fcn.0042c430
mov edx, dword [ebp - 0x94]
mov dword [esp], 0x1a
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x4c], edx
call fcn.004ed900
mov dword [eax], 0x656c6544
mov dword [eax + 4], 0x6e496574
lea ecx, [ebp - 0x4c]
mov dword [eax + 8], 0x6e617473
mov dword [eax + 0xc], 0x6f536563
mov dword [eax + 0x10], 0x61577466
mov dword [eax + 0x14], 0x654b6572
mov byte [eax + 0x18], 0x79
mov byte [eax + 0x19], 0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], str.Open_Key_return:__d
mov dword [esp + 0xc], 0x155
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 0x48], 0x19
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x94]
je 0x4181b9
mov dword [esp], eax
call fcn.004ed8c0
test ebx, ebx
je 0x418236
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
mov eax, 5
jmp 0x4181e1
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
mov eax, 3
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x5c]
cmp edx, ecx
je 0x4181ff
mov dword [esp], edx
mov dword [ebp - 0x8c], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x7c]
cmp edx, esi
je 0x417e37
mov dword [esp], edx
mov dword [ebp - 0x8c], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x8c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea eax, [ebp - 0x34]
mov dword [ebp - 0x8c], eax
jmp 0x417d9e
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
sub esp, 8
mov ebx, eax
call fcn.0042c430
mov edx, dword [ebp - 0x94]
mov dword [esp], 0x1a
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x4c], edx
call fcn.004ed900
mov dword [eax], 0x656c6544
mov dword [eax + 4], 0x6e496574
lea ecx, [ebp - 0x4c]
mov dword [eax + 8], 0x6e617473
mov dword [eax + 0xc], 0x6f536563
mov dword [eax + 0x10], 0x61577466
mov dword [eax + 0x14], 0x654b6572
mov byte [eax + 0x18], 0x79
mov byte [eax + 0x19], 0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], str.delete_Key_ret:__d
mov dword [esp + 0xc], 0x15c
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 0x48], 0x19
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x94]
je 0x4182f4
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
test ebx, ebx
jne 0x4183b6
call fcn.0042c430
mov ebx, eax
mov eax, dword [ebp - 0x94]
mov dword [esp], 0x1a
mov dword [ebp - 0x4c], eax
call fcn.004ed900
lea ecx, [ebp - 0x4c]
mov dword [eax], 0x656c6544
mov dword [eax + 4], 0x6e496574
mov dword [eax + 8], 0x6e617473
mov dword [eax + 0xc], 0x6f536563
mov dword [eax + 0x10], 0x61577466
mov dword [eax + 0x14], 0x654b6572
mov byte [eax + 0x18], 0x79
mov byte [eax + 0x19], 0
mov dword [esp + 0x10], str.Delete_software_key_success
mov dword [esp + 0xc], 0x163
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 0x48], 0x19
call fcn.0042ce70
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x94]
je 0x4183a3
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
xor eax, eax
jmp 0x4181e1
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
sub esp, 4
mov eax, 6
jmp 0x4181e1
lea ecx, [ebp - 0x64]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004ce110
mov eax, dword [ebp - 0x64]
sub esp, 0x10
add eax, ebx
mov dword [ebp - 0x8c], eax
jmp 0x418009
test ebx, ebx
je 0x418009
lea edx, [ebp - 0x5c]
cmp dword [ebp - 0x8c], edx
jbe 0x418009
cmp ebx, 1
je 0x418458
mov eax, dword [ebp - 0x8c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x418009
lea eax, [ebp - 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x418009
movzx eax, byte [ebp - 0x5b]
mov byte [ebp - 0x5c], al
lea eax, [ebp - 0x5b]
mov dword [ebp - 0x8c], eax
jmp 0x418009