Function at 0x407240
Capabilities:
Delete file
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
xor ebp, ebp
push eax
push 0x2001f
push ebp
push 0x43c670
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40743d
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push ebp
push ebp
push ebp
push 0x43c654
push edx
call edi
mov eax, dword [esp + 0x10]
inc eax
push eax
call fcn.0042274c
mov ecx, dword [esp + 0x14]
mov esi, eax
inc ecx
mov dword [esp + 0x28], esi
push ecx
call fcn.0042274c
add esp, 8
lea edx, [esp + 0x10]
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push esi
push ebp
push ebp
push 0x43c654
push eax
mov dword [esp + 0x38], ebx
call edi
test eax, eax
je 0x407302
cmp ebx, ebp
je 0x4072db
push ebx
call fcn.00422775
add esp, 4
cmp esi, ebp
je 0x4072e8
push esi
call fcn.00422775
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
cmp eax, ebp
jbe 0x4073ff
mov edx, dword [esp + 0x130]
push edx
push esi
call dword [0x440944]
test eax, eax
je 0x40744f
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
add ebp, eax
cmp byte [esi], 0
jne 0x40734e
mov eax, dword [esp + 0x10]
cmp ebp, eax
jae 0x40734e
mov cl, byte [esi + 1]
inc esi
inc ebp
test cl, cl
je 0x407341
mov al, byte [0x440950]
mov ecx, 0x40
mov byte [esp + 0x28], al
xor eax, eax
lea edi, [esp + 0x29]
push 0x43c64c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea ecx, [esp + 0x28]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + 0x28]
push 0x43c64c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4073eb
mov eax, dword [esp + 0x1c]
push 0x3a
push eax
call fcn.00413270
add esp, 8
mov edi, eax
dec edi
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
add ebp, eax
cmp byte [esi], 0
mov eax, dword [esp + 0x10]
jne 0x4073d7
cmp ebp, eax
jae 0x4073df
mov cl, byte [esi + 1]
inc esi
inc ebp
test cl, cl
je 0x4073ca
cmp ebp, eax
jb 0x407312
mov eax, dword [esp + 0x14]
mov byte [ebx], 0
inc eax
mov dword [esp + 0x14], eax
cmp ebp, dword [esp + 0x10]
jb 0x407312
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
xor ebp, ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
push ebx
push 7
push ebp
push 0x43c654
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x407430
push esi
call fcn.00422775
add esp, 4
cmp ebx, ebp
je 0x40743d
push ebx
call fcn.00422775
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c
ret 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x14]
add esi, eax
add ebp, eax
mov eax, dword [esp + 0x10]
add edx, edi
cmp ebp, eax
mov dword [esp + 0x14], edx
jae 0x4073f5
cmp byte [esi], 0
jne 0x4073eb
mov edx, dword [esp + 0x14]
mov byte [ebx], 0
mov eax, dword [esp + 0x10]
inc ebx
inc esi
inc edx
inc ebp
mov dword [esp + 0x14], edx
cmp ebp, eax
jae 0x4073f5
jmp 0x407483