Function at 0x4089a0
Capabilities:
Delete registry key
Delete registry value
Manipulate safe mode programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, str.SYSTEMCurrentControlSetServicesWin_Win7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalwin_win7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkwin_win7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x41fc68
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x41fce8
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallWiNet7_Client
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x41fdf0
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallWiNet_Client7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallwmcUpdater
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x41ff78
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x420010
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallWiNet7_Client
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x420148
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x4201e0
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallWiNet_Client7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWinMaster7_Server
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWinMaster7_Console
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWinMasterConsole7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallWinMaster7_Server
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallWinMaster7_Console
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeWinMasterConsole7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallwmcUpdater
mov ecx, 0x80000002
call fcn.0040a170
mov dword [ebp - 0x214], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x210]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
rep stosd dword es:[edi], eax
xor eax, eax
movzx ecx, word [eax + str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x408b51
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408b9e
mov edx, dword [ebp - 0x214]
push str.NoControlPanel
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004037e0
mov esi, str..wm7e
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str..wsef
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str._shellSmr7Tools
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str.Folder_shellSmr7Tools
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellSEF7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerCommandStore_shellSEF7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellSMR7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerCommandStore_shellSMR7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellBURN7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerCommandStore_shellBURN7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, 0x420c08
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420c2c
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420c48
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420c74
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420c9c
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420cc0
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420cdc
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420d08
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420d30
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420d68
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420d98
mov ecx, 0x80000000
call fcn.0040a170
mov esi, 0x420dc4
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str._shell_
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str.Folder_shell_
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str..jm7e
mov ecx, 0x80000000
call fcn.0040a170
mov esi, str..jsef
mov ecx, 0x80000000
call fcn.0040a170
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathspcinfo7.exe
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathswmcRMS7.exe
push 0x80000002
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret