Function at 0x40dcb7
Capabilities:
Delete file
Query or enumerate registry value
Read .ini file
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1630
call fcn.00412030
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x15ec], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0x15f8], esi
mov dword [ebp - 0x160c], edi
call fcn.0040fa55
xor ebx, ebx
lea eax, [ebp - 0x1298]
and dword [ebp - 0x15fc], ebx
push 0x20a
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x20a
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x848]
push 0x20a
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0xc68], ax
push 0x208
push eax
lea eax, [ebp - 0xc66]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc68]
push 0x104
push eax
push 0xd2
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x401068
push 0x402870
push 0x4010d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x40dda2
mov eax, 0x80004005
jmp 0x40e41a
mov ecx, esi
call fcn.004081b2
test eax, eax
js 0x40e40a
jne 0x40dde8
push 0x900
push ecx
push ecx
mov edi, 0x105
lea ecx, [ebp - 0xe78]
push 0x4041c8
mov edx, edi
call fcn.00410ebe
and dword [ebp - 0x15f4], ebx
mov esi, 0x80000001
mov dword [ebp - 0x1608], 0x10
jmp 0x40de44
call fcn.0040916c
test eax, eax
jne 0x40de08
push 0x4041e8
push dword [0x4130e8]
call fcn.0040e818
pop ecx
pop ecx
jmp 0x40e40a
push 0x900
push ecx
push ecx
mov edi, 0x105
lea ecx, [ebp - 0xe78]
push 0x403858
mov edx, edi
call fcn.00410ebe
xor eax, eax
mov dword [ebp - 0x1608], 0x19
inc eax
mov esi, 0x80000002
mov dword [ebp - 0x15fc], eax
mov dword [ebp - 0x15f4], eax
push dword [ebp - 0x15f8]
lea eax, [ebp - 0x638]
push 0x104
push eax
push 0x401068
push 0x402888
push 0x4010d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x638]
je 0x40e40a
lea eax, [ebp - 0x638]
push eax
push 0x404240
push 0x900
push 0
push 0
lea eax, [ebp - 0xa58]
push edi
push eax
call fcn.00410f98
add esp, 0x1c
lea eax, [ebp - 0x1610]
xor ecx, ecx
mov dword [ebp - 0x1610], ecx
push eax
lea eax, [ebp - 0x15f0]
push eax
mov eax, dword [ebp - 0x15fc]
neg eax
push ecx
sbb eax, eax
and eax, 0xfffffffa
add eax, 0x2001f
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0xa58]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e40a
lea eax, [ebp - 0x1600]
push eax
push 0x20019
push 0
push 0x401588
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e3fe
lea eax, [ebp - 0x1604]
mov dword [ebp - 0x1604], 0x208
push eax
lea eax, [ebp - 0x1088]
push eax
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x1600]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e3f2
mov eax, dword [ebp - 0x1604]
and eax, 0xfffffffe
cmp eax, 0x20a
jae 0x40e42d
xor ecx, ecx
lea edx, [ebp - 0x428]
mov word [ebp + eax - 0x1088], cx
push ecx
lea ecx, [ebp - 0x1088]
call fcn.0040dbfa
push dword [ebp - 0x1600]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x15fc]
test ecx, ecx
je 0x40dfb2
mov eax, dword [0x4136c0]
lea edx, [ebp - 0x428]
push edx
push 0x4042b0
lea edx, [ebp - 0xa58]
mov esi, dword [eax]
push edx
push ecx
push eax
mov ecx, dword [esi + 0x28]
call dword [0x414220]
call dword [esi + 0x28]
test eax, eax
jns 0x40dff1
jmp 0x40e3fe
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
mov dword [ebp - 0x1604], eax
lea eax, [ebp - 0x428]
push eax
push 1
push 0
push 0x4042b0
push dword [ebp - 0x15f0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40e3fe
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x40344c
push 0x900
push 0
push 0
lea eax, [ebp - 0x848]
push edi
push eax
call fcn.00410f98
add esp, 0x20
push dword [ebp - 0x15f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x848]
push eax
push 0x4042cc
push 0x900
push 0
push 0
lea eax, [ebp - 0x1298]
push edi
push eax
call fcn.00410f98
add esp, 0x20
test eax, eax
js 0x40e40a
xor eax, eax
cmp ax, word [ebp - 0x218]
je 0x40e143
lea ecx, [ebp - 0x15e8]
call fcn.0040fa90
test eax, eax
je 0x40e0ec
lea edx, [ebp - 0x15ec]
lea ecx, [ebp - 0x428]
call fcn.00406e0f
test eax, eax
je 0x40e0c4
lea ecx, [ebp - 0x15e8]
call fcn.0040fa90
mov ecx, dword [0x4136c0]
lea edx, [ebp - 0x218]
neg eax
sbb eax, eax
inc eax
push eax
push dword [ebp - 0x15ec]
call fcn.00407202
push dword [ebp - 0x15ec]
call dword [sym.imp.cmutil.dll_CmFree]
mov esi, dword [ebp - 0x15f4]
test esi, esi
je 0x40e0f2
push dword [ebp - 0x160c]
xor eax, eax
lea ecx, [ebp - 0x428]
mov edx, edi
mov word [ebp - 0x428], ax
call fcn.00406b17
jmp 0x40e0f2
mov esi, dword [ebp - 0x15f4]
mov ecx, dword [0x4136c0]
lea eax, [ebp - 0x15ec]
push esi
push eax
lea edx, [ebp - 0x428]
call fcn.004068c4
test eax, eax
je 0x40e137
lea ecx, [ebp - 0x15e8]
call fcn.0040fa90
mov ecx, dword [0x4136c0]
lea edx, [ebp - 0x218]
neg eax
sbb eax, eax
inc eax
push eax
push dword [ebp - 0x15ec]
call fcn.00407202
push dword [ebp - 0x15ec]
call dword [sym.imp.cmutil.dll_CmFree]
lea eax, [ebp - 0x1298]
push eax
push 0
push 0x402860
push 0x4028d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jg 0x40e16c
mov ecx, dword [ebp - 0x15f8]
call fcn.00406fb8
mov edx, dword [ebp - 0x15f8]
lea eax, [ebp - 0xc68]
mov ecx, dword [0x4136c0]
push 0
push eax
lea eax, [ebp - 0xe78]
push eax
call fcn.00410068
xor ebx, ebx
lea ecx, [ebp - 0x15e8]
test eax, eax
setns bl
call fcn.0040fa90
test eax, eax
je 0x40e1d9
mov ecx, dword [ebp - 0x1608]
lea edx, [ebp - 0x14a8]
mov esi, dword [0x4136c4]
call fcn.00408137
test eax, eax
js 0x40e1d9
mov edx, dword [ebp - 0x160c]
lea eax, [ebp - 0x14a8]
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407604
xor eax, eax
cmp ax, word [ebp - 0x848]
je 0x40e23b
push 0x80
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40e23b
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1630]
rep stosd dword es:[edi], eax
push 0x14
stosw word es:[edi], ax
lea eax, [ebp - 0x848]
mov dword [ebp - 0x1628], eax
pop eax
mov word [ebp - 0x1620], ax
lea eax, [ebp - 0x1630]
push eax
mov dword [ebp - 0x162c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, 0x105
push 0x4042e0
push dword [0x4130e8]
call fcn.0040e818
lea eax, [ebp - 0x638]
push eax
push 0x404364
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x14
cmp dword [ebp - 0x15f4], 0
je 0x40e2db
lea ecx, [ebp - 0x15e8]
call fcn.0040fa90
test eax, eax
je 0x40e2cd
mov ecx, dword [0x4136c0]
test ecx, ecx
je 0x40e2a5
mov eax, dword [ecx]
lea edx, [ebp - 0x638]
push edx
push ecx
mov esi, dword [eax + 0x44]
mov ecx, esi
call dword [0x414220]
call esi
and eax, 0xffff
jmp 0x40e2b0
lea ecx, [ebp - 0x638]
call fcn.00408a5e
test eax, eax
je 0x40e2bb
push 0x404390
jmp 0x40e2c0
push 0x4043d0
push dword [0x4130e8]
call fcn.0040e818
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
push 0x403fb8
jmp 0x40e2e7
lea eax, [ebp - 0x218]
push eax
push 0x404018
push 0x401f98
push 0x900
push 0
push 0
lea eax, [ebp - 0xa58]
push edi
push eax
call fcn.00410f98
xor edi, edi
add esp, 0x20
inc edi
cmp dword [ebp + 8], 0
je 0x40e33b
mov esi, 0x80000001
lea edx, [ebp - 0xa58]
push edi
mov ecx, esi
call fcn.0040d8c9
push edi
mov edx, 0x403fb8
mov ecx, esi
call fcn.0040d8c9
push edi
mov edx, 0x404018
mov ecx, esi
call fcn.0040d8c9
mov eax, dword [0x4136c0]
push 0
test eax, eax
je 0x40e35d
mov esi, dword [eax]
push 0x401588
push edi
push eax
mov ecx, dword [esi + 0x30]
call dword [0x414220]
call dword [esi + 0x30]
jmp 0x40e36c
mov edx, 0x401588
mov ecx, 0x80000002
call fcn.0040d8c9
push 0
mov edx, 0x401588
mov ecx, 0x80000001
call fcn.0040d8c9
mov ecx, dword [0x4136c0]
test ecx, ecx
je 0x40e39f
mov eax, dword [ecx]
push 0x404160
push edi
push ecx
mov esi, dword [eax + 0x34]
mov ecx, esi
call dword [0x414220]
call esi
jmp 0x40e3ae
mov edx, 0x404160
mov ecx, 0x80000002
call fcn.004070ef
mov eax, dword [0x4136c0]
push edi
mov edi, 0x4028f8
test eax, eax
je 0x40e3d1
mov esi, dword [eax]
push edi
push 1
push eax
mov ecx, dword [esi + 0x30]
call dword [0x414220]
call dword [esi + 0x30]
jmp 0x40e3dd
mov edx, edi
mov ecx, 0x80000002
call fcn.0040d8c9
push 1
mov edx, edi
mov ecx, 0x80000001
call fcn.0040d8c9
call fcn.00408277
jmp 0x40e40a
push dword [ebp - 0x1600]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x15f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
sbb ebx, ebx
and ebx, 0x7fffbffb
lea eax, [ebx - 0x7fffbffb]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
call fcn.00411ad9
int3