Function at 0x413770
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x558
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea ecx, [ebp - 0x546]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x548], ax
call fcn.00405300
push 0x62
lea eax, [ebp - 0x66]
xor edx, edx
push esi
push eax
mov word [ebp - 0x68], dx
call fcn.00405300
push 0x208
lea edx, [ebp - 0x272]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x274], cx
call fcn.00405300
push 0xc6
lea ecx, [ebp - 0x33a]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x554], esi
mov word [ebp - 0x33c], ax
call fcn.00405300
add esp, 0x30
push 0x32
lea edx, [ebp - 0x68]
push edx
push 0x478b08
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x558], esi
call dword [0x4653b0]
test eax, eax
jne 0x413833
push str.RemoveVMwareAdapterDescriptions:_cant_convert_guid_to_string
push 1
call fcn.004343f0
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x68]
push eax
push str.RemoveVMwareAdapterDescriptions:_net_guid_is__S
push 0x20
call fcn.004343f0
lea ecx, [ebp - 0x68]
push ecx
push str.SYSTEMCurrentControlSetControlNetwork_sDescriptions
lea edx, [ebp - 0x548]
push 0x105
push edx
call fcn.00457d45
add esp, 0x1c
lea eax, [ebp - 0x54c]
push eax
push 0x2001b
push esi
lea ecx, [ebp - 0x548]
push ecx
push 0x80000002
call dword [0x4650cc]
cmp eax, esi
je 0x4138a4
push eax
push str.RemoveVMwareAdapterDescriptions:_cant_open_adapter_descriptions_key:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [0x465084]
lea edx, [ebp - 0x550]
push edx
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x558]
push ecx
mov ecx, dword [ebp - 0x54c]
push esi
lea edx, [ebp - 0x554]
push edx
lea eax, [ebp - 0x274]
push eax
push esi
push ecx
mov dword [ebp - 0x554], 0x105
mov dword [ebp - 0x550], 0xc8
call edi
mov esi, 1
test eax, eax
jne 0x4139f4
lea ebx, [ebx]
lea edx, [ebp - 0x274]
push 0x46d554
push edx
call fcn.00457c9a
add esp, 8
test eax, eax
jne 0x413960
lea eax, [ebp - 0x274]
push str.vmware
push eax
call fcn.00457c9a
add esp, 8
test eax, eax
jne 0x413960
lea ecx, [ebp - 0x274]
push str.VMnet
push ecx
call fcn.00457c9a
add esp, 8
test eax, eax
jne 0x413960
lea edx, [ebp - 0x274]
push edx
push str.RemoveVMwareAdapterDescriptions:_no_match:__S
push 0x20
call fcn.004343f0
add esp, 0xc
jmp 0x4139a8
mov ecx, dword [ebp - 0x54c]
lea eax, [ebp - 0x274]
push eax
push ecx
call dword [0x465088]
test eax, eax
je 0x413990
lea edx, [ebp - 0x274]
push edx
push str.RemoveVMwareAdapterDescriptions:_couldnt_delete:__S
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x4139a8
lea eax, [ebp - 0x274]
push eax
push str.RemoveVMwareAdapterDescriptions:_deleted:__S
push 1
call fcn.004343f0
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x550]
push ecx
lea edx, [ebp - 0x33c]
push edx
lea eax, [ebp - 0x558]
push eax
mov eax, dword [ebp - 0x54c]
push 0
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x274]
push edx
push esi
push eax
mov dword [ebp - 0x554], 0x105
mov dword [ebp - 0x550], 0xc8
call edi
inc esi
test eax, eax
je 0x413900
pop edi
cmp eax, 0x103
je 0x413a2a
push eax
push str.RemoveVMwareAdapterDescriptions:_Enumeration_ended_with_code:_0x_08x
push 1
call fcn.004343f0
mov ecx, dword [ebp - 0x54c]
add esp, 0xc
push ecx
call dword [0x4650d0]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push str.RemoveVMwareAdapterDescriptions:_Successfully_scanned_connection_descriptions
push 0x10
call fcn.004343f0
mov edx, dword [ebp - 0x54c]
add esp, 8
push edx
call dword [0x4650d0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040506e
mov esp, ebp
pop ebp
ret