Function at 0x40e864
Capabilities:
Delete registry value
Enumerate process modules

Disassembly:
mov eax, 0x420271
call fcn.0041f700
mov eax, 0x188c
call fcn.0041f6b0
push ebx
push esi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x24], ebx
cmp dword [ebx + 4], esi
je 0x40ed9b
cmp dword [ebx + 8], esi
je 0x40ed9b
push edi
call fcn.0040cdc4
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [ebp - 0x10], ecx
call fcn.0040cdc4
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [ebp - 0x20], ecx
call fcn.0040cdc4
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 2
push 0x1f
sete cl
mov dword [ebp - 0x14], ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0xb2]
mov word [ebp - 0xb4], si
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov al, byte [ebp - 0x15]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
cmp dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
je 0x40e990
lea eax, [ebx + 0x10]
push eax
push 0x4260b8
lea eax, [ebp - 0xb4]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebx + 0x190]
add esp, 0x10
cmp word [eax], si
je 0x40e92f
lea ecx, [ebp - 0x34]
push ecx
push esi
jmp 0x40ea0a
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x43a]
mov word [ebp - 0x43c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x43c]
push 0x103
push eax
call fcn.004062cd
pop ecx
test eax, eax
pop ecx
je 0x40ea13
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x43c]
push esi
push eax
call fcn.00403642
add esp, 0xc
push 0x4279d4
push 0x42799c
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40ea13
lea eax, [ebp - 0xb4]
push 0x3f
push eax
mov ecx, ebx
call fcn.00410064
test eax, eax
jne 0x40e9d0
call fcn.00410999
add eax, 0x38
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x40e9b8
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push 0x4260b8
lea eax, [ebp - 0xb4]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x43a]
mov word [ebp - 0x43c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x43c]
push 0x103
push eax
call fcn.004062cd
pop ecx
test eax, eax
pop ecx
je 0x40ea13
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x43c]
push eax
call fcn.00403642
add esp, 0xc
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x232]
mov word [ebp - 0x234], si
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00404974
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x132]
mov word [ebp - 0x134], si
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00404a28
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x84e]
mov word [ebp - 0x850], si
rep stosd dword es:[edi], eax
add esp, 0x18
mov ebx, 0x104
stosw word es:[edi], ax
lea eax, [ebp - 0x850]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b2]
mov word [ebp - 0x1b4], si
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.00401120
add esp, 0xc
cmp dword [ebp - 0x10], esi
jne 0x40eba2
cmp dword [ebp - 0x20], esi
jne 0x40eba2
cmp dword [ebp - 0x14], esi
je 0x40ed8b
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1896]
mov word [ebp - 0x1898], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x30]
cmp edi, esi
jne 0x40eb06
mov edi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
call fcn.00404c59
mov ecx, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x1b4]
push eax
push edi
call fcn.00410303
movzx eax, al
push eax
lea eax, [ebp - 0x134]
push eax
push 0x428650
lea eax, [ebp - 0x1898]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
mov edi, 0x1388
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x30
test eax, eax
jne 0x40ed8b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
test eax, eax
jne 0x40ed8b
push 0xbb8
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
jmp 0x40ed8b
call fcn.00410999
mov eax, dword [eax + 0x10]
cmp eax, esi
je 0x40ec3c
push eax
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x40ec3c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
push ecx
lea ecx, [ebp - 0x10]
push 4
push ecx
push eax
mov dword [ebp - 0x1c], esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40ec33
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x646]
mov word [ebp - 0x648], si
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x648]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x427eb8
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x40ec33
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], esi
je 0x40ec4a
mov dword [ebp - 0x10], 1
jmp 0x40ec5d
call fcn.0040cdc4
mov eax, dword [eax + 0x10]
neg eax
sbb eax, eax
and al, 0xfe
inc eax
inc eax
mov dword [ebp - 0x10], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x43a]
mov word [ebp - 0x43c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x43c]
push 0x103
push eax
xor ebx, ebx
call fcn.0040383d
pop ecx
test eax, eax
pop ecx
je 0x40ecb0
lea eax, [ebp - 0x43c]
push 0x427eb8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
mov ebx, eax
pop ecx
neg ebx
sbb ebx, ebx
pop ecx
inc ebx
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1896]
mov word [ebp - 0x1898], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x30]
cmp edi, esi
jne 0x40ecd5
mov edi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
call fcn.00404c59
mov ecx, dword [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x1b4]
push dword [ebp - 0x10]
push eax
push edi
call fcn.00410303
movzx eax, al
push eax
lea eax, [ebp - 0x134]
push eax
push 0x428528
lea eax, [ebp - 0x1898]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
mov edi, 0x1388
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x38
test eax, eax
jne 0x40ed8b
mov eax, dword [ebp - 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
neg eax
sbb eax, eax
and ax, 0xf830
add eax, 0xbb8
push eax
mov dword [ebp - 0x1c], eax
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
test eax, eax
jne 0x40ed8b
push dword [ebp - 0x1c]
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
test eax, eax
jne 0x40ed8b
push esi
lea eax, [ebp - 0x1898]
push 0x14
push eax
call fcn.00413a1b
add esp, 0xc
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret