Function at 0x40534f
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, ecx
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebx + 0x38]
call esi
cmp eax, dword [ebx + 0x40]
je 0x4053d9
push eax
mov dword [ebx + 0x40], eax
lea eax, [ebp - 8]
push 0x49356c
push eax
call fcn.0044af44
add esp, 0xc
push dword [0x4ad468]
push dword [eax]
push str.DifferMode
push 0x488134
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.0043d912
mov eax, dword [0x4ad2a0]
test eax, eax
je 0x4053d9
mov ecx, dword [ebx + 0x40]
sub ecx, edi
je 0x4053d0
sub ecx, 1
mov ecx, dword [eax]
je 0x4053cb
push 4
push 1
jmp 0x4053d5
push edi
push 5
jmp 0x4053d5
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x20]
push ecx
mov edx, str._shellDismCompact
mov ecx, 0x80000000
call fcn.0044e2cf
pop ecx
push 0
push 0
push 0xf0
push dword [ebx + 0x2c]
mov edi, eax
call esi
mov esi, 0x80000002
cmp edi, eax
je 0x405736
test edi, edi
je 0x40549b
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellUnCompact
mov ecx, esi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress4k
mov ecx, esi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress8k
mov ecx, esi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress16k
mov ecx, esi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofLZX
mov ecx, esi
call fcn.0044e022
lea edi, [esi - 2]
mov edx, str.Directory_shellDismCompact
mov ecx, edi
call fcn.0044e022
mov edx, str._shellDismCompact
mov ecx, edi
call fcn.0044e022
mov edx, str.Dism.esd_shellDismCompact
mov ecx, edi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellESD2ISO
mov ecx, esi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellESD2WIM
mov ecx, esi
call fcn.0044e022
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellDecryptESD
mov ecx, esi
call fcn.0044e022
jmp 0x405736
push 0x488134
mov esi, str.MUIVerb
mov edx, str._shellDismCompact
push esi
mov ecx, 0x80000000
call fcn.0044df3d
push str.UnCompact_WofXpress4k_WofXpress8k_WofXpress16k_WofLZX
mov edi, str.SubCommands
mov edx, str._shellDismCompact
push edi
mov ecx, 0x80000000
call fcn.0044df3d
push 0x488134
push esi
mov esi, str.Directory_shellDismCompact
mov ecx, 0x80000000
mov edx, esi
call fcn.0044df3d
push str.UnCompact_WofXpress4k_WofXpress8k_WofXpress16k_WofLZX
push edi
mov edx, esi
mov ecx, 0x80000000
call fcn.0044df3d
add esp, 0x20
call fcn.0043d5bb
push eax
lea ecx, [ebp - 4]
call fcn.0043bbe8
push 0x105
push 0x104
lea ecx, [ebp - 4]
call fcn.0043d810
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [ebp - 4]
call fcn.0043d882
push 0x490b54
call sym.Dismx86.exe_DismMultiLanguage
push eax
mov edi, 0x4934ec
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellUnCompact
push edi
mov ecx, 0x80000002
call fcn.0044df3d
pop ecx
pop ecx
lea eax, [ebp - 4]
mov esi, 0x490b7c
push str.___U___1_
push eax
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.00431d43
pop ecx
mov edx, eax
lea ecx, [ebp - 8]
call fcn.0043baed
mov edx, 0x490b80
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044df3d
mov ecx, dword [ebp - 8]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push str.Xpress4k
call sym.Dismx86.exe_DismMultiLanguage
push eax
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress4k
mov ecx, 0x80000002
call fcn.0044df3d
pop ecx
pop ecx
push str.___C__exe_xpress4k___1_
lea eax, [ebp - 4]
mov edx, esi
push eax
lea ecx, [ebp - 8]
call fcn.00431d43
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043baed
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress4kcommand
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044df3d
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push str.Xpress8k
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress8k
mov ecx, 0x80000002
call fcn.0044df3d
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, esi
push str.___C__exe_Xpress8k___1_
push eax
lea ecx, [ebp - 8]
call fcn.00431d43
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043baed
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress8kcommand
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044df3d
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push str.Xpress16k
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress16k
mov ecx, 0x80000002
call fcn.0044df3d
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, esi
push str.___C__exe_Xpress16k___1_
push eax
lea ecx, [ebp - 8]
call fcn.00431d43
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043baed
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofXpress16kcommand
mov ecx, 0x80000002
push dword [eax]
push edi
call fcn.0044df3d
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push 0x490f08
call sym.Dismx86.exe_DismMultiLanguage
push eax
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofLZX
mov ecx, 0x80000002
call fcn.0044df3d
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, esi
push str.___C__exe_LZX___1_
push eax
lea ecx, [ebp - 8]
call fcn.00431d43
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043baed
mov esi, 0x80000002
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerCommandStore_shellWofLZXcommand
mov ecx, esi
push dword [eax]
push edi
call fcn.0044df3d
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push 0x3f0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4058b4
call fcn.0043d5bb
push eax
lea ecx, [ebp - 4]
call fcn.0043bbe8
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push 0x2001f
push dword [0x4ad198]
mov dword [ebp - 8], ecx
push ecx
push ecx
push str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov edx, str.Element
call fcn.0044dd53
mov esi, dword [ebp - 4]
pop ecx
mov eax, dword [esi - 0xc]
test eax, eax
je 0x4057bf
dec eax
lea ecx, [ebp - 4]
push eax
call fcn.0043b8a7
test ax, ax
je 0x4057bf
push 0
lea ecx, [ebp - 4]
call fcn.0043c971
mov esi, dword [ebp - 4]
mov edx, str.4652daff_77a1_4391_9157_aba3f31b3629
mov ecx, esi
call fcn.0044af09
push 0
push 0
push 0xf0
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0xc]
test eax, eax
setne dl
test edi, edi
setne cl
cmp dl, cl
je 0x4058a4
test edi, edi
je 0x40583d
cmp dword [esi - 4], 1
jle 0x40580b
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043d715
mov esi, dword [ebp - 4]
sub edi, esi
lea ecx, [ebp - 4]
push 0x27
sar edi, 1
push edi
call fcn.00432106
mov esi, dword [ebp - 4]
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push esi
push 7
push 0
push str.Element
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4058a4
mov esi, str.4652daff_77a1_4391_9157_aba3f31b3629
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0043c99e
xor esi, esi
lea ecx, [ebp - 4]
push esi
call fcn.0043c971
push 3
pop eax
push eax
lea ecx, [ebp - 0x90]
call fcn.00403200
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x8c], esi
jne 0x405886
mov eax, dword [ebx + 4]
mov dword [ebp - 0x8c], eax
push esi
push esi
push esi
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
lea ecx, [ebp - 0x90]
call fcn.00405c84
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0043b8cb
lea ecx, [esi - 0x10]
call fcn.0043d912
push 0x3ec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_IsWindowEnabled]
mov esi, eax
push esi
call edi
test eax, eax
je 0x40596e
mov eax, dword [ebx + 0x20]
xor ecx, ecx
cmp dword [eax + 0x228], ecx
je 0x40596e
push ecx
push ecx
push 0x147
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x20]
lea edx, [ebp - 8]
and dword [ebp - 8], 0
push 0
push edx
mov eax, dword [eax + 0x228]
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWOF
push 0x80000002
mov eax, dword [eax + 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jne 0x40596e
push eax
push eax
push 0x147
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x405942
push str.ForceAlgorithm
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x405965
push 3
pop ecx
xor edx, edx
div ecx
push 4
lea eax, [ebp - 0xc]
inc edx
push eax
push 4
push 0
push str.ForceAlgorithm
push dword [ebp - 8]
mov dword [ebp - 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebx + 0x28]
call edi
test eax, eax
je 0x405992
push 0
push 0
push 0xf0
push dword [ebx + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x405992
call fcn.004059f6
push 0
push 0
push 0xf0
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x4ac13c]
cmp ecx, eax
jne 0x4059df
xor eax, eax
test ecx, ecx
sete al
mov dword [0x4ac13c], eax
test eax, eax
mov eax, 0x49045c
jne 0x4059c8
mov eax, 0x490458
push dword [0x4ad468]
push eax
push str.Mode
push 0x488134
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
movzx eax, word [ebp + 0xc]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10