Function at 0x4405d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465b08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4826d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareAutoOff
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x440886
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
cmp byte [edi], al
je 0x4407cb
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push 0x469778
push ebx
call esi
mov eax, dword [edi + 8]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x469780
push ebx
call esi
mov eax, dword [edi + 0xc]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x469788
push ebx
call esi
call fcn.00403330
mov ecx, eax
test ecx, ecx
je 0x440898
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov eax, edi
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov edi, dword [eax + 0x14]
test edi, edi
je 0x44075c
nop dword [eax + eax]
cmp ecx, dword [eax + 0x14]
jae 0x4408a2
mov eax, dword [eax + 0x10]
push ecx
push str.cu_d
lea edi, [eax + ecx*8]
lea eax, [ebp - 0x10]
push eax
call fcn.00408f60
mov esi, dword [edi]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str.cp_d
push eax
call fcn.00408f60
mov esi, dword [edi + 4]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [ebp - 0x10]
push 1
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
mov edi, dword [eax + 0x14]
cmp ecx, edi
jb 0x4406d0
cmp edi, dword [eax + 0x20]
jge 0x4407a3
push edi
lea eax, [ebp - 0x10]
push str.cu_d
push eax
call fcn.00408f60
add esp, 0xc
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
lea eax, [ebp - 0x10]
push str.cp_d
push eax
call fcn.00408f60
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, dword [eax + 0x20]
jl 0x440761
mov edi, dword [eax + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push str.aicu
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x44085f
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x469778
push ebx
call esi
push 0x469780
push ebx
call esi
push 0x469788
push ebx
call esi
call fcn.00403330
mov ecx, eax
test ecx, ecx
je 0x4408ac
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x14]
xor edi, edi
mov byte [ebp - 4], 2
cmp dword [eax + 0x20], edi
jle 0x440853
push edi
lea eax, [ebp - 0x10]
push str.cu_d
push eax
call fcn.00408f60
add esp, 0xc
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
lea eax, [ebp - 0x10]
push str.cp_d
push eax
call fcn.00408f60
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, dword [eax + 0x20]
jl 0x440811
push str.aicu
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44087b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x440886
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004024f0
push 0x80070057
call fcn.004024f0
push 0x80004005
call fcn.004024f0
int3