Function at 0x40eab0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46be10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
call fcn.00430250
mov esi, eax
mov eax, dword [ebp + 8]
push eax
push str.AddPCAExclude__d_
call fcn.00408ed0
xor ebx, ebx
add esp, 8
mov ecx, esi
mov dword [ebp - 0x1c], ebx
call fcn.00430080
test eax, eax
je 0x40eb07
cmp dword [esi + 0x24], ebx
je 0x40eb07
mov eax, 1
jmp 0x40eb09
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x2001f
lea ecx, [ebp - 0x18]
push ecx
mov esi, eax
push esi
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlags
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40edd7
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push esi
push ebx
push ebx
push ebx
push str.Compatibility_Assistant
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40edc6
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4800d8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov ecx, dword [edi + 0x198]
push ecx
lea edx, [ebp - 0x18]
push str._sSetup.exe
push edx
mov byte [ebp - 4], 3
call fcn.00405ab0
add esp, 0xc
push 0x1400
call fcn.00456452
mov edx, eax
xor eax, eax
mov edi, edx
add esp, 4
mov ecx, 0x500
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push edx
push str.ExecutablesToExclude
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0x1400
call fcn.00408410
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.004486d0
test esi, esi
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], ebx
jne 0x40eca8
mov ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00448760
test eax, eax
je 0x40ed39
lea ecx, [ebp - 0x34]
call fcn.004487d0
mov ecx, dword [ebp + 8]
test ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
je 0x40ec5b
test eax, eax
je 0x40ec39
lea ecx, [ebp - 0x34]
call fcn.00407a20
mov edx, dword [ebp - 0x18]
push edx
push eax
call edi
test eax, eax
jne 0x40ec2f
mov esi, 1
lea ecx, [ebp - 0x34]
call fcn.004487f0
jmp 0x40ec13
test esi, esi
jne 0x40ec4e
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
call fcn.00448830
jmp 0x40ece8
test ebx, ebx
jne 0x40ece8
jmp 0x40ed32
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40ec9c
lea ecx, [ebp - 0x34]
call fcn.00407a20
mov esi, eax
push esi
call ebx
test eax, eax
je 0x40ec92
mov ecx, dword [ebp - 0x18]
push ecx
push esi
call edi
test eax, eax
jne 0x40ec92
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 1
call fcn.00448960
jmp 0x40ec65
lea ecx, [ebp - 0x34]
call fcn.004487f0
jmp 0x40ec61
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x40ece8
jmp 0x40ed32
cmp esi, 2
je 0x40ecc4
cmp esi, 0xd
je 0x40ecc4
push esi
push str.Query_Value_Failed__Return:__d
push 1
call fcn.004047f0
add esp, 0xc
jmp 0x40ed39
push str.Value_is_not_found_or_is_not_valid
call fcn.00408ed0
mov eax, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x40ed32
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x34]
call fcn.00448830
test eax, eax
je 0x40ed39
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40ed0c
lea ecx, [ebp - 0x34]
call fcn.0041db80
test eax, eax
jne 0x40ed0c
mov eax, dword [ebp - 0x14]
push str.ExecutablesToExclude
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40ed2e
lea ecx, [ebp - 0x34]
call fcn.004487d0
test eax, eax
je 0x40ed39
lea ecx, [ebp - 0x34]
call fcn.00407a20
push eax
push str.ExecutablesToExclude
lea ecx, [ebp - 0x14]
call fcn.00408490
test eax, eax
jne 0x40ed39
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40ed4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004572e5
add esp, 4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.004486e0
mov esi, dword [ebp - 0x18]
mov eax, dword [0x4800dc]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x40ed8c
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40ed8c
push esi
call fcn.00457c3f
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x40edea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20], ebx
jmp 0x40edea
push str.Create_Key_Failed_
push 1
call fcn.004047f0
add esp, 8
jmp 0x40ed8e
push str.Open_Key_Failed_
push 1
call fcn.004047f0
add esp, 8
jmp 0x40edea
mov esi, dword [ebp - 0x1c]
push esi
push str.AddPCAExclude_return:__d
call fcn.00408ed0
mov eax, dword [ebp - 0x14]
add esp, 8
cmp eax, ebx
je 0x40ee09
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x40ee17
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4