Function at 0x4159d0
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe10
mov eax, dword [0x441044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xc02]
push ecx
mov word [ebp - 0xc04], ax
call fcn.004238b0
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x402]
push eax
mov dword [ebp - 0xe08], 0
mov word [ebp - 0x404], dx
call fcn.004238b0
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x202]
push edx
mov dword [ebp - 0xe10], 1
mov word [ebp - 0x204], cx
call fcn.004238b0
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0xe04]
mov esi, 0x200
add esp, 0x24
rep stosd dword es:[edi], eax
mov dword [ebp - 0xe0c], esi
xor eax, eax
jmp 0x415a80
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders]
mov word [ebp + eax - 0xe04], cx
add eax, 2
test cx, cx
jne 0x415a80
lea eax, [ebp - 0xe08]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0xe04]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415b42
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xe0c], esi
xor eax, eax
jmp 0x415b00
movzx ecx, word [eax + str.Common_Start_Menu]
mov word [ebp + eax - 0x404], cx
add eax, 2
test cx, cx
jne 0x415b00
lea eax, [ebp - 0xe0c]
push eax
lea ecx, [ebp - 0x204]
push ecx
mov ecx, dword [ebp - 0xe08]
lea edx, [ebp - 0xe10]
push edx
push 0
lea eax, [ebp - 0x404]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0xe08]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push 0x436a64
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push 0x436a8c
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push str.WiNet7
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push 0x436a40
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push 0x436a7c
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bcde
mov esp, ebp
pop ebp
ret