Function at 0x408980
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x868
push ebx
push ebp
push esi
push edi
push str.SoftwareSystems_InternalsRegmon
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, 0x21
xor eax, eax
lea edi, [esp + 0x5c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x3c
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [0x4140c8]
mov eax, dword [0x4140d0]
mov edx, dword [0x4140cc]
mov dword [esp + 0x3c], ecx
mov cx, word [0x4140d4]
xor ebx, ebx
mov word [esp + 0x48], cx
mov dword [esp + 0x44], eax
mov ecx, 0xf
lea esi, [esp + 0x20]
mov edi, 0x419748
mov dword [esp + 0x30], 0x190
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], ebx
mov dword [esp + 0x40], edx
mov eax, 0x64
rep movsd dword es:[edi], dword [esi]
mov dword [0x419708], eax
mov dword [0x419704], eax
mov al, 1
mov ecx, 0xa0
mov byte [0x419740], al
mov byte [0x419741], al
mov byte [0x419743], al
mov byte [0x419742], al
mov byte [0x419744], al
mov eax, 0x46
mov dword [0x41971c], eax
mov dword [0x419720], eax
mov dword [0x41972c], eax
xor eax, eax
mov edi, 0x42ba00
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0xa0
mov edi, 0x42bd80
rep stosd dword es:[edi], eax
mov ecx, 0xa0
mov edi, 0x42c120
push edx
push str.SoftwareSysinternalsRegmon
rep stosd dword es:[edi], eax
push 0x80000001
mov dword [0x41970c], 0x258
mov dword [0x419710], 0x12c
mov byte [0x419734], bl
mov dword [0x419738], 0xffffff
mov dword [0x41973c], 0xff
mov byte [0x419737], bl
mov dword [0x419714], 0x23
mov dword [0x419718], 0x5a
mov dword [0x419724], 0xc8
mov dword [0x419728], 0x32
mov byte [esp + 0xec], 0x2a
mov byte [esp + 0xed], bl
mov byte [esp + 0xee], bl
mov byte [esp + 0x374], bl
mov byte [esp + 0x5fc], bl
mov dword [0x419730], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ebp, 0x84
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x1c], ebp
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x5c]
push eax
push ecx
push ebx
push ebx
push str.Settings
push edx
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0xe0]
push eax
push ecx
push ebx
push ebx
mov edi, 0x286
push str.InFilters
push edx
mov dword [esp + 0x30], edi
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x368]
push eax
push ecx
push ebx
push ebx
push str.ExFilters
push edx
mov dword [esp + 0x30], edi
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x5f0]
push eax
push ecx
push ebx
push ebx
push str.HiFilters
push edx
mov dword [esp + 0x30], edi
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x5c], 0x1ae
jne 0x408bc3
cmp dword [esp + 0x1c], ebp
jne 0x408bc3
mov ecx, 0x21
lea esi, [esp + 0x5c]
mov edi, 0x419700
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x419730]
mov dl, byte [0x419737]
mov al, byte [0x419735]
mov dword [0x416ce8], ecx
mov cl, byte [0x419736]
mov esi, 0x419748
mov byte [0x4194e4], cl
mov ecx, 0xf
mov edi, 0x42b940
push 0x42b940
rep movsd dword es:[edi], dword [esi]
mov byte [0x4196f4], dl
mov byte [0x4196f5], al
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edx, dword [0x419738]
mov cl, byte [0x419741]
mov dword [0x42a928], eax
mov eax, dword [0x41973c]
mov dword [0x42c3a0], edx
mov dl, byte [0x419740]
mov dword [0x42c3a4], eax
mov al, byte [0x419742]
mov byte [0x42c101], dl
mov dl, byte [0x419744]
mov byte [0x42c102], al
mov al, byte [esp + 0xe0]
mov byte [0x42c100], cl
mov cl, byte [0x419743]
mov byte [0x42c104], dl
cmp al, bl
mov byte [0x42c103], cl
lea edx, [esp + 0xe0]
je 0x408cbc
mov ebp, 0x42bd80
mov dword [esp + 0x14], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x80
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x408c79
mov al, byte [esp + 0x368]
lea edx, [esp + 0x368]
cmp al, bl
je 0x408d16
mov ebp, 0x42ba00
mov dword [esp + 0x14], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x80
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x408cd3
mov al, byte [esp + 0x5f0]
lea edx, [esp + 0x5f0]
cmp al, bl
je 0x408d70
mov ebp, 0x42c120
mov dword [esp + 0x14], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x80
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x408d2d
mov edi, 0x42bd80
or ecx, 0xffffffff
xor eax, eax
push 0x42bd00
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x42bd00
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00410cdc
mov edi, 0x42ba00
or ecx, 0xffffffff
xor eax, eax
push 0x42bc80
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x42bc80
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00410cdc
mov edi, 0x42c120
or ecx, 0xffffffff
xor eax, eax
push 0x42b980
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x42b980
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00410cdc
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x868
ret