Function at 0x401150
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x40f050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x440]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x450], 7
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4011b7
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e96
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x444]
push eax
push 0
lea eax, [ebp - 0x450]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x440]
call esi
mov eax, dword [ebp - 0x444]
test eax, eax
jne 0x401208
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e96
mov esp, ebp
pop ebp
ret
push edi
add eax, 0x100
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebp - 0x438], eax
test eax, eax
je 0x40153f
mov eax, dword [ebp - 0x444]
add eax, 0x100
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov edi, dword [ebp - 0x438]
mov ebx, eax
mov dword [ebp - 0x43c], ebx
test ebx, ebx
je 0x401541
lea eax, [ebp - 0x444]
push eax
push edi
lea eax, [ebp - 0x450]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x440]
call esi
test eax, eax
jne 0x401541
push 0x104
lea eax, [ebp - 0x434]
push eax
push dword [0x410e30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
mov eax, edi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x454], ebx
cmp word [eax], si
je 0x4014b7
lea eax, [ebp - 0x22c]
mov esi, edi
mov ecx, eax
xor ebx, ebx
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4012e3
movzx ecx, word [esi + eax]
test cx, cx
je 0x4012e3
mov word [eax], cx
add eax, 2
dec edx
jne 0x4012c5
jmp 0x4012e7
test edx, edx
jne 0x4012ef
sub eax, 2
mov ebx, 0x8007007a
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
js 0x401531
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00402099
add esp, 8
mov esi, eax
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004010f0
test eax, eax
js 0x401531
test esi, esi
jne 0x401428
mov edx, dword [ebp - 0x444]
mov ebx, dword [ebp - 0x454]
lea eax, [ebp - 0x22c]
push eax
shr edx, 1
mov ecx, ebx
call section..text
test eax, eax
js 0x401531
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x44c]
inc ecx
add ecx, eax
lea ebx, [ebx + eax*2]
inc eax
mov dword [ebp - 0x44c], ecx
lea esi, [edi + eax*2]
lea ecx, [ebp - 0x22c]
mov eax, ecx
add ebx, 2
mov dword [ebp - 0x458], esi
xor edi, edi
mov edx, 0x114
sub esi, eax
lea eax, [edx + 0x7ffffeea]
test eax, eax
je 0x4013ae
movzx eax, word [esi + ecx]
test ax, ax
je 0x4013ae
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x401390
jmp 0x4013b2
test edx, edx
jne 0x4013ba
sub ecx, 2
mov edi, 0x8007007a
xor eax, eax
mov word [ecx], ax
test edi, edi
js 0x401531
mov edx, dword [ebp - 0x444]
lea eax, [ebp - 0x22c]
push eax
shr edx, 1
mov ecx, ebx
call section..text
test eax, eax
js 0x401531
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004010f0
test eax, eax
js 0x401531
mov eax, dword [ebp - 0x448]
lea ecx, [eax + 1]
lea esi, [eax + 1]
add esi, dword [ebp - 0x44c]
lea ecx, [ebx + ecx*2]
mov ebx, dword [ebp - 0x458]
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x44c], esi
jmp 0x401482
mov eax, dword [ebp - 0x448]
inc eax
lea ecx, [ebp - 0x22c]
lea ebx, [edi + eax*2]
mov esi, ebx
mov eax, ecx
xor edi, edi
mov edx, 0x114
sub esi, eax
lea eax, [edx + 0x7ffffeea]
test eax, eax
je 0x401463
movzx eax, word [esi + ecx]
test ax, ax
je 0x401463
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x401445
jmp 0x401467
test edx, edx
jne 0x40146f
sub ecx, 2
mov edi, 0x8007007a
xor eax, eax
mov word [ecx], ax
test edi, edi
js 0x401531
mov esi, dword [ebp - 0x44c]
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004010f0
test eax, eax
js 0x401531
mov edi, dword [ebp - 0x448]
inc edi
cmp word [ebx + edi*2], 0
lea edi, [ebx + edi*2]
jne 0x4012b2
mov ebx, dword [ebp - 0x43c]
lea eax, [esi*2 + 2]
push eax
push ebx
push dword [ebp - 0x450]
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
jne 0x4014ee
push str.PendingFileRenameOperations
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x438]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push ebx
push 8
call edi
push eax
call esi
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e96
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x43c]
mov edi, dword [ebp - 0x438]
jmp 0x401541
mov edi, eax
mov eax, dword [ebp - 0x440]
test eax, eax
je 0x401552
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x40156c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call edi
push eax
call esi
jmp 0x401572
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test ebx, ebx
je 0x40157e
push ebx
push 8
call edi
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401e96
mov esp, ebp
pop ebp
ret