Function at 0x404160
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bbd06
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x4fcc8c]
xor eax, esp
mov dword [esp + 0x2c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fcc8c]
xor eax, esp
push eax
lea eax, [esp + 0x2d8]
mov dword fs:[0], eax
mov edi, 0x4e823c
call fcn.004040c0
xor edi, edi
mov dword [esp + 0x24], reloc.WSOCK32.dll_accept
cmp dword [0x5046b4], edi
je 0x4041c9
lea eax, [esp + 0x24]
push eax
call fcn.004ad164
test eax, eax
jl 0x4043b0
xor esi, esi
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push edi
mov dword [esp + 0x2ec], edi
mov edx, dword [esp + 0x30]
push str.SOFTWAREESTsoftALCMUpdateFiles
push edx
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x404357
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
push str.UpdateCount
mov ebx, 4
push esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x404340
cmp dword [esp + 0x1c], ebx
jne 0x404340
xor ebp, ebp
cmp dword [esp + 0x28], edi
jbe 0x404340
lea eax, [esp + 0x4c]
push eax
call fcn.00407a60
push ebp
push ecx
lea ecx, [esp + 0x54]
push str.File
push ecx
mov byte [esp + 0x2f0], 1
call fcn.0040bd80
add esp, 0xc
push eax
call fcn.004071b0
push 0x206
lea eax, [esp + 0xd2]
xor edx, edx
push edi
push eax
mov word [esp + 0xd8], dx
call fcn.004982b0
add esp, 0xc
lea ecx, [esp + 0x30]
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], 0x104
call fcn.00407b60
cmp dword [eax + 0x18], 8
jb 0x4042bc
mov eax, dword [eax + 4]
jmp 0x4042bf
add eax, 4
push eax
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x24]
lea esi, [esp + 0xd4]
call fcn.0040f5e0
test eax, eax
sete bl
cmp dword [esp + 0x48], 8
jb 0x4042ee
mov edx, dword [esp + 0x34]
push edx
call fcn.004913b3
add esp, 4
test bl, bl
je 0x404300
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x98]
mov byte [esp + 0x2e0], 0
call fcn.00407af0
lea ecx, [esp + 0x98]
push ecx
mov dword [esp + 0x9c], vtable.std::ios_base.0
call fcn.00431fcb
inc ebp
add esp, 4
xor edi, edi
cmp ebp, dword [esp + 0x28]
jb 0x404250
mov esi, dword [esp + 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x404351
push esi
call ebx
mov dword [esp + 0x14], edi
mov esi, dword [esp + 0x14]
jmp 0x40435d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x24]
push str.SOFTWAREESTsoftALCMUpdateFiles
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
call fcn.0040f3b0
push str.SOFTWAREESTsoftALCMUpdateRegInfo
lea ecx, [esp + 0x18]
call fcn.0040f3b0
push str.SOFTWAREESTsoftALCMDeleteFiles
lea ecx, [esp + 0x18]
call fcn.0040f3b0
cmp dword [0x5046b4], edi
je 0x40439e
push esi
call ebx
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x4043a9
push eax
call ebx
cmp esi, edi
je 0x4043b0
push esi
call ebx
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.004913be
add esp, 0x2d0
ret