Function at 0x406a80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bb65c
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4fcc8c]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fcc8c]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x27c]
lea eax, [esp + 0x20]
xor esi, esi
push eax
mov dword [esp + 0x1c], esi
call fcn.004076e0
mov dword [esp + 0x274], esi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
je 0x406c83
cmp esi, edi
jbe 0x406b05
call fcn.004921da
mov ebx, dword [ebp]
mov dword [esp + 0x38], ebx
mov edi, esi
mov edi, edi
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], esi
jbe 0x406b1d
call fcn.004921da
mov eax, dword [ebp]
test ebx, ebx
je 0x406b28
cmp ebx, eax
je 0x406b2d
call fcn.004921da
cmp edi, esi
je 0x406c83
test ebx, ebx
jne 0x406b9c
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406b4a
call fcn.004921da
xor edx, edx
push 0xffffffffffffffff
push edx
lea eax, [edi + 0x1c]
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], dx
call fcn.00401370
mov byte [esp + 0x274], 1
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x406ba0
mov byte [esp + 0x274], al
cmp dword [esp + 0x58], 8
jb 0x406c57
mov eax, dword [esp + 0x44]
push eax
jmp 0x406c4f
mov eax, dword [ebx]
jmp 0x406b40
lea esi, [eax - 1]
cmp esi, eax
jbe 0x406bac
call fcn.004921da
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x406bbb
lea eax, [esp + 0x44]
cmp word [eax + esi*2], 0x5c
je 0x406bd2
push 1
mov eax, 0x4e6d3c
lea ecx, [esp + 0x44]
call fcn.004017a0
test ebx, ebx
jne 0x406c74
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406beb
call fcn.004921da
push 0
push edi
or eax, 0xffffffff
lea esi, [esp + 0x48]
call fcn.00401880
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x406c09
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00491dcd
add esp, 8
test eax, eax
jne 0x406c3b
test ebx, ebx
jne 0x406c7b
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406c2d
call fcn.004921da
push edi
lea ebx, [esp + 0x24]
call fcn.00407880
mov ebx, dword [esp + 0x38]
mov byte [esp + 0x274], 0
cmp dword [esp + 0x58], 8
jb 0x406c57
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004913b3
add esp, 4
test ebx, ebx
jne 0x406c7f
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406c6c
call fcn.004921da
add edi, 0x38
jmp 0x406b10
mov eax, dword [ebx]
jmp 0x406be1
mov eax, dword [ebx]
jmp 0x406c23
mov eax, dword [ebx]
jmp 0x406c62
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x406cad
mov dword [esp + 0x18], eax
jmp 0x406f82
xor ebx, ebx
cmp esi, edi
jbe 0x406cb8
call fcn.004921da
mov ebp, dword [esp + 0x20]
mov edi, esi
mov edi, edi
mov esi, dword [esp + 0x30]
cmp dword [esp + 0x2c], esi
jbe 0x406ccf
call fcn.004921da
test ebp, ebp
je 0x406cd9
cmp ebp, dword [esp + 0x20]
je 0x406cde
call fcn.004921da
cmp edi, esi
je 0x406e4c
test ebp, ebp
jne 0x406d4d
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406cfb
call fcn.004921da
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x48], cx
push ecx
lea eax, [edi + 0x1c]
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
call fcn.00401370
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x406d52
mov byte [esp + 0x274], al
cmp dword [esp + 0x58], 8
jb 0x406e22
mov edx, dword [esp + 0x44]
push edx
jmp 0x406e1a
mov eax, dword [ebp]
jmp 0x406cf1
lea esi, [eax - 1]
cmp esi, eax
jbe 0x406d5e
call fcn.004921da
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x406d6d
lea eax, [esp + 0x44]
cmp word [eax + esi*2], 0x5c
je 0x406d84
push 1
mov eax, 0x4e6d3c
lea ecx, [esp + 0x44]
call fcn.004017a0
test ebp, ebp
jne 0x406e3f
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406d9d
call fcn.004921da
push 0
push edi
or eax, 0xffffffff
lea esi, [esp + 0x48]
call fcn.00401880
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x66]
push ecx
mov word [esp + 0x68], ax
call fcn.004982b0
add esp, 0xc
push ebx
push 0x4e6cbc
push str._s_d
lea edx, [esp + 0x68]
push 0x104
push edx
call fcn.00491e56
mov ecx, dword [esp + 0x58]
add esp, 0x14
cmp dword [esp + 0x58], 8
jae 0x406df2
lea ecx, [esp + 0x44]
lea eax, [esp + 0x5c]
push eax
mov edx, str.SOFTWAREESTsoftALCMDeleteFiles
call fcn.00403f70
test al, al
je 0x406e06
inc ebx
mov byte [esp + 0x274], 0
cmp dword [esp + 0x58], 8
jb 0x406e22
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004913b3
add esp, 4
test ebp, ebp
jne 0x406e47
call fcn.004921da
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406e37
call fcn.004921da
add edi, 0x38
jmp 0x406cc0
mov eax, dword [ebp]
jmp 0x406d93
mov eax, dword [ebp]
jmp 0x406e2d
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jne 0x406f7a
xor esi, esi
mov dword [esp + 0x1c], reloc.WSOCK32.dll_accept
cmp dword [0x5046b4], esi
je 0x406ed4
lea ecx, [esp + 0x1c]
push ecx
call fcn.004ad164
test eax, eax
jge 0x406ed4
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x406eb3
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
push edx
push ecx
call fcn.0040d0f0
mov edx, dword [esp + 0x34]
push edx
call fcn.004913b3
add esp, 0xc
mov eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.004913b3
add esp, 4
or eax, 0xffffffff
jmp 0x406fc5
xor edi, edi
mov dword [esp + 0x3c], esi
lea ecx, [esp + 0x14]
push ecx
push 0x20006
push esi
mov byte [esp + 0x280], 3
mov edx, dword [esp + 0x28]
push str.SOFTWAREESTsoftALCMDeleteFiles
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
jne 0x406f62
mov edi, dword [esp + 0x14]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push esi
push str.UpdateCount
push edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406f59
push ebx
push 0x4e80bc
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], str.ALCMUpdator::CheckDeleteFileInfo
call fcn.004019a0
add esp, 8
mov dword [esp + 0x18], 1
xor esi, esi
cmp edi, esi
je 0x406f62
push edi
call ebp
xor edi, edi
cmp dword [0x5046b4], esi
je 0x406f71
mov ecx, dword [esp + 0x1c]
push ecx
call ebp
cmp edi, esi
je 0x406f84
push edi
call ebp
jmp 0x406f84
mov dword [esp + 0x18], 0xffffffff
xor esi, esi
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x406fa8
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
push edx
push ecx
call fcn.0040d0f0
mov edx, dword [esp + 0x34]
push edx
call fcn.004913b3
add esp, 0xc
mov eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.004913b3
mov eax, dword [esp + 0x1c]
add esp, 4
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.004913be
add esp, 0x264
ret 4