Function at 0x612458ab
Capabilities:
Delete registry value
Get disk information
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x61253ebc]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x620], ebx
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 0x628], ebx
je 0x612458ef
mov dword [0x61254088], 1
push ebx
push 0x91a
call fcn.6124d9f5
push esi
call fcn.6124d958
push 0x6124152c
call fcn.6124d958
mov eax, dword [0x612540b4]
cmp eax, ebx
jne 0x61245927
push str.input.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [0x612540b4], eax
je 0x61245946
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x66
push eax
call edi
push 0x67
push dword [0x612540b4]
mov dword [0x612540b8], eax
call edi
mov dword [0x612540bc], eax
or dword [ebp - 0x648], 0xffffffff
jmp 0x61245b78
mov ax, word [esi]
cmp ax, bx
je 0x61245b80
cmp ax, 0x2f
jne 0x61245b70
push 2
pop edi
add esi, edi
movzx eax, word [esi]
cmp eax, 0x66
jg 0x61245a33
je 0x612459cc
sub eax, 0x46
je 0x612459cc
dec eax
je 0x61245b57
sub eax, edi
je 0x61245b3e
sub eax, 9
je 0x61245b2a
dec eax
je 0x61245a55
dec eax
je 0x61245a3b
dec eax
jne 0x61245a45
push ebx
push 0x926
call fcn.6124d9f5
xor eax, eax
inc eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x628], eax
jmp 0x61245b78
push ebx
push 0x924
call fcn.6124d9f5
xor eax, eax
inc eax
add esi, edi
mov dword [0x61254094], eax
cmp word [esi], 0x3a
mov dword [ebp - 0x628], eax
mov word [ebp - 0x61c], bx
jne 0x61245a24
add esi, edi
cmp word [esi], 0x22
jne 0x61245b78
add esi, edi
lea ecx, [ebp - 0x61c]
jmp 0x61245a19
cmp ax, 0x22
je 0x61245a21
mov word [ecx], ax
add ecx, edi
add esi, edi
xor eax, eax
mov ax, word [esi]
cmp ax, bx
jne 0x61245a0a
mov word [ecx], bx
cmp word [esi], 0x22
jne 0x61245b78
jmp 0x61245b6c
sub eax, 0x67
jmp 0x61245981
mov dword [0x61254098], 1
push esi
push 0x927
call fcn.6124d9f5
jmp 0x61245b78
push ebx
push 0x923
call fcn.6124d9f5
or dword [ebp - 0x620], 4
add esi, edi
cmp word [esi], 0x3a
jne 0x61245ae6
add esi, edi
cmp word [esi], 0x22
jne 0x61245aee
add esi, edi
mov edx, 0x61254500
lea eax, [ebp - 0x20c]
jmp 0x61245a9d
cmp cx, 0x22
je 0x61245aa5
mov word [edx], cx
mov cx, word [esi]
mov word [eax], cx
add edx, edi
add eax, edi
add esi, edi
xor ecx, ecx
mov cx, word [esi]
cmp cx, bx
jne 0x61245a86
push 0x61254500
push 0x61254740
mov word [edx], bx
mov word [eax], bx
call dword [sym.imp.ntdll.dll_wcscpy]
push 0x5c
push 0x61254500
mov dword [0x6125407c], 0x61254740
call dword [sym.imp.ntdll.dll_wcsrchr]
add esp, 0x10
cmp eax, ebx
je 0x61245adc
mov word [eax], bx
mov dword [0x61254078], 0x61254500
cmp word [esi], 0x22
jne 0x61245aee
add esi, edi
cmp word [ebp - 0x20c], bx
lea eax, [ebp - 0x20c]
je 0x61245b0e
cmp word [eax], 0x5c
jne 0x61245b07
mov word [eax + 2], bx
add eax, edi
cmp word [eax], bx
jne 0x61245afd
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [0x61254080], eax
jmp 0x61245b78
push ebx
push 0x921
call fcn.6124d9f5
or dword [ebp - 0x620], 1
jmp 0x61245b4f
push ebx
push 0x922
call fcn.6124d9f5
or dword [ebp - 0x620], edi
mov dword [ebp - 0x648], ebx
jmp 0x61245b6c
push ebx
push 0x920
call fcn.6124d9f5
mov dword [0x6125408c], 1
add esi, edi
jmp 0x61245b78
cmp ax, 0x20
jne 0x61245b80
inc esi
inc esi
cmp esi, ebx
jne 0x61245952
call fcn.6124eb39
mov dword [0x61254084], eax
lea eax, [ebp - 0x624]
push eax
push 0x20006
push ebx
push 0x61241688
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jne 0x61245c05
mov edi, 0x61241dbc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push edi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x61245bef
push edi
push dword [ebp - 0x624]
call ebx
mov dword [0x61254054], 1
xor edi, edi
jmp 0x61245bf7
xor edi, edi
mov dword [0x61254054], edi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61245c07
xor edi, edi
cmp dword [0x61254084], edi
je 0x61245c43
lea eax, [ebp - 0x624]
push eax
push 0x61241d48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x61245c43
push 0x61241d24
push dword [ebp - 0x624]
call ebx
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x61254094], edi
je 0x61245c65
lea eax, [ebp - 0x61c]
push eax
call fcn.61249178
call fcn.6124ebe5
test eax, eax
je 0x61245c65
call fcn.6124de22
cmp dword [ebp - 0x62c], edi
je 0x61245c72
call fcn.6124909b
cmp dword [ebp - 0x628], edi
jne 0x61245db1
cmp dword [ebp - 0x648], 0xffffffff
push 3
pop ebx
jne 0x61245cd3
xor eax, eax
cmp esi, edi
mov dword [ebp - 0x648], eax
je 0x61245cd3
xor ecx, ecx
mov cx, word [esi]
cmp cx, di
je 0x61245cd3
cmp cx, 0x30
jb 0x61245cd3
cmp cx, 0x39
ja 0x61245cc9
movzx ecx, cx
inc esi
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x30]
inc esi
xor ecx, ecx
mov cx, word [esi]
cmp cx, 0x30
mov dword [ebp - 0x648], eax
jae 0x61245ca6
cmp eax, ebx
jb 0x61245cd3
mov dword [ebp - 0x648], edi
mov eax, dword [ebp - 0x630]
mov esi, dword [ebp - 0x620]
and esi, 2
mov dword [ebp - 0x65c], eax
mov eax, dword [0x612543d0]
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x670]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x664], 0x34
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x64c], edi
lea eax, [ebp - 0x664]
push ebx
je 0x61245d3d
push 0x65
push dword [0x612540b4]
mov dword [ebp - 0x650], 0x54
push 0x1f4
push eax
call fcn.6124cf20
jmp 0x61245d88
push esi
push 0x61249f7f
push 0x65
push eax
mov dword [ebp - 0x650], 1
call fcn.6124ceb9
push ebx
push esi
push 0x61246cc4
push 0x66
lea eax, [ebp - 0x664]
push eax
call fcn.6124ceb9
cmp dword [0x61254054], 1
jne 0x61245d88
push ebx
push esi
push 0x6124354b
push 0x68
lea eax, [ebp - 0x664]
push eax
call fcn.6124ceb9
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov eax, dword [0x612540b4]
cmp eax, edi
je 0x61245db1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x612540b8], edi
mov dword [0x612540bc], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.6124ff04
leave
ret 8