Function at 0x40ed70
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d2c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
call fcn.00431490
mov esi, eax
mov eax, dword [ebp + 8]
push eax
push str.AddPCAExclude__d_
call fcn.00409160
xor ebx, ebx
add esp, 8
mov ecx, esi
mov dword [ebp - 0x1c], ebx
call fcn.004312c0
test eax, eax
je 0x40edc7
cmp dword [esi + 0x24], ebx
je 0x40edc7
mov eax, 1
jmp 0x40edc9
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x2001f
lea ecx, [ebp - 0x18]
push ecx
mov esi, eax
push esi
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlags
push 0x80000002
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], ebx
call dword [0x47103c]
cmp eax, ebx
jne 0x40f097
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push esi
push ebx
push ebx
push ebx
push str.Compatibility_Assistant
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
call dword [0x471028]
cmp eax, ebx
jne 0x40f086
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4810d8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov ecx, dword [edi + 0x198]
push ecx
lea edx, [ebp - 0x18]
push str._sSetup.exe
push edx
mov byte [ebp - 4], 3
call fcn.00405d30
add esp, 0xc
push 0x1400
call fcn.004578e2
mov edx, eax
xor eax, eax
mov edi, edx
add esp, 4
mov ecx, 0x500
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push edx
push str.ExecutablesToExclude
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0x1400
call fcn.00408740
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.00452aa0
test esi, esi
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], ebx
jne 0x40ef68
mov ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00449a60
test eax, eax
je 0x40eff9
lea ecx, [ebp - 0x34]
call fcn.00449ad0
mov ecx, dword [ebp + 8]
test ecx, ecx
mov edi, dword [0x47130c]
je 0x40ef1b
test eax, eax
je 0x40eef9
lea ecx, [ebp - 0x34]
call fcn.00407d50
mov edx, dword [ebp - 0x18]
push edx
push eax
call edi
test eax, eax
jne 0x40eeef
mov esi, 1
lea ecx, [ebp - 0x34]
call fcn.00449af0
jmp 0x40eed3
test esi, esi
jne 0x40ef0e
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
call fcn.00449b40
jmp 0x40efa8
test ebx, ebx
jne 0x40efa8
jmp 0x40eff2
mov ebx, dword [0x471314]
test eax, eax
je 0x40ef5c
lea ecx, [ebp - 0x34]
call fcn.00407d50
mov esi, eax
push esi
call ebx
test eax, eax
je 0x40ef52
mov ecx, dword [ebp - 0x18]
push ecx
push esi
call edi
test eax, eax
jne 0x40ef52
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 1
call fcn.00449c70
jmp 0x40ef25
lea ecx, [ebp - 0x34]
call fcn.00449af0
jmp 0x40ef21
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x40efa8
jmp 0x40eff2
cmp esi, 2
je 0x40ef84
cmp esi, 0xd
je 0x40ef84
push esi
push str.Query_Value_Failed__Return:__d
push 1
call fcn.004047c0
add esp, 0xc
jmp 0x40eff9
push str.Value_is_not_found_or_is_not_valid
call fcn.00409160
mov eax, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x40eff2
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x34]
call fcn.00449b40
test eax, eax
je 0x40eff9
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40efcc
lea ecx, [ebp - 0x34]
call fcn.00449b30
test eax, eax
jne 0x40efcc
mov eax, dword [ebp - 0x14]
push str.ExecutablesToExclude
push eax
call dword [0x471044]
jmp 0x40efee
lea ecx, [ebp - 0x34]
call fcn.00449ad0
test eax, eax
je 0x40eff9
lea ecx, [ebp - 0x34]
call fcn.00407d50
push eax
push str.ExecutablesToExclude
lea ecx, [ebp - 0x14]
call fcn.004087c0
test eax, eax
jne 0x40eff9
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40f00e
push eax
call dword [0x471040]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00458775
add esp, 4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.004499e0
mov esi, dword [ebp - 0x18]
mov eax, dword [0x4810dc]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x40f04c
add esi, 0xfffffff4
push esi
call dword [0x471300]
test eax, eax
jg 0x40f04c
push esi
call fcn.004590cf
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x40f0aa
push eax
call dword [0x471040]
mov dword [ebp - 0x20], ebx
jmp 0x40f0aa
push str.Create_Key_Failed_
push 1
call fcn.004047c0
add esp, 8
jmp 0x40f04e
push str.Open_Key_Failed_
push 1
call fcn.004047c0
add esp, 8
jmp 0x40f0aa
mov esi, dword [ebp - 0x1c]
push esi
push str.AddPCAExclude_return:__d
call fcn.00409160
mov eax, dword [ebp - 0x14]
add esp, 8
cmp eax, ebx
je 0x40f0c9
push eax
call dword [0x471040]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x40f0d7
push eax
call dword [0x471040]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4