Function at 0x404f70
Capabilities:
Delete file
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5bb270]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x274]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x274], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4052b1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x270]
push eax
push 0
push 0
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x274]
call esi
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x405411
xor ecx, ecx
lea eax, [eax*2 + 1]
mov edi, 2
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411431
mov ecx, dword [ebp - 0x270]
mov ebx, eax
mov dword [ebp - 0x28c], ebx
lea eax, [ecx*2 + 1]
xor ecx, ecx
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411431
add esp, 8
mov edi, eax
mov dword [ebp - 0x290], edi
test ebx, ebx
je 0x405404
test edi, edi
je 0x405401
lea eax, [ebp - 0x270]
push eax
push ebx
push 0
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x274]
call esi
test eax, eax
je 0x40509e
push ebx
call fcn.0041143a
push edi
call fcn.0041143a
add esp, 8
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053787e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x270]
xor ecx, ecx
mov esi, dword [ebp - 0x28c]
xor ebx, ebx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0x284], edi
lea edx, [eax*2 + 1]
mov dword [ebp - 0x27c], edx
test eax, eax
je 0x405274
nop
push dword [ebp - 0x294]
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
push esi
test eax, eax
je 0x4052d1
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x280], esi
call fcn.00404880
cmp dword [ebp - 0x210], 8
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x288], eax
jb 0x405120
push dword [ebp - 0x224]
call fcn.0041143a
mov eax, dword [ebp - 0x288]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x210], 7
lea esi, [esi + eax*2]
mov dword [ebp - 0x214], 0
mov word [ebp - 0x224], cx
lea ebx, [ebx + eax*2]
cmp word [esi], cx
jne 0x40515f
mov eax, dword [ebp - 0x270]
mov edi, edi
cmp ebx, eax
jae 0x40515f
add esi, 2
add ebx, 2
cmp word [esi], cx
je 0x405150
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537c80
push 6
push str.____
call fcn.005372b7
push eax
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005386a2
add esp, 0x24
lea eax, [ebp - 0x20c]
mov ecx, str.____
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4051cd
test dx, dx
je 0x4051c9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4051cd
add eax, 4
add ecx, 4
test dx, dx
jne 0x4051a7
xor eax, eax
jmp 0x4051d2
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4052c9
push 0x3a
push dword [ebp - 0x280]
call fcn.005385f4
add esp, 8
lea edi, [eax - 2]
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea ecx, [ebp - 0x26c]
call fcn.00404880
mov edi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x26c]
call fcn.00404a60
cmp word [esi + edi*2], 0
lea esi, [esi + edi*2]
mov eax, dword [ebp - 0x270]
lea ebx, [ebx + edi*2]
jne 0x405240
lea ecx, [ecx]
cmp ebx, eax
jae 0x40524e
add esi, 2
add ebx, 2
cmp word [esi], 0
je 0x405230
mov edi, dword [ebp - 0x284]
cmp ebx, eax
jb 0x4050d0
mov edi, dword [ebp - 0x284]
xor eax, eax
mov ecx, dword [ebp - 0x278]
add ecx, 2
mov dword [ebp - 0x278], ecx
mov word [edi], ax
cmp ebx, dword [ebp - 0x270]
jb 0x4050d0
mov esi, dword [ebp - 0x290]
push ecx
push esi
push 7
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x28c]
call fcn.0041143a
push esi
call fcn.0041143a
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053787e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x278]
jmp 0x405268
push dword [ebp - 0x27c]
push edi
call fcn.0053725b
add esp, 0xc
lea ecx, [ebp - 0x23c]
push edi
call fcn.00404880
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x280], eax
jb 0x405315
push dword [ebp - 0x23c]
call fcn.0041143a
mov eax, dword [ebp - 0x280]
add esp, 4
sub dword [ebp - 0x27c], eax
xor ecx, ecx
mov word [ebp - 0x23c], cx
lea ecx, [eax + eax]
add edi, ecx
mov dword [ebp - 0x288], ecx
push esi
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x284], edi
call fcn.00404880
cmp dword [ebp - 0x240], 8
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x280], eax
jb 0x40537e
push dword [ebp - 0x254]
call fcn.0041143a
mov eax, dword [ebp - 0x280]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], cx
lea esi, [esi + eax*2]
mov ecx, dword [ebp - 0x278]
add eax, eax
add ecx, dword [ebp - 0x288]
add ebx, eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x278], ecx
cmp ebx, dword [ebp - 0x270]
jae 0x405274
mov eax, dword [ebp - 0x27c]
cmp word [esi], 0
jne 0x405268
xor edx, edx
add ecx, 2
mov word [edi], dx
add ebx, 2
add edi, 2
mov dword [ebp - 0x278], ecx
dec eax
mov dword [ebp - 0x284], edi
add esi, 2
mov dword [ebp - 0x27c], eax
cmp ebx, dword [ebp - 0x270]
jb 0x4053c6
jmp 0x405274
push ebx
jmp 0x405409
test edi, edi
je 0x405411
push edi
call fcn.0041143a
add esp, 4
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053787e
mov esp, ebp
pop ebp
ret 4