Function at 0x40a67f
Capabilities:
Delete registry key
Get graphical window text
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
mov ebx, dword [0x4339ac]
push esi
xor esi, esi
cmp dword [ebx + 0x780], esi
push edi
jne 0x40aa08
lea eax, [ebp - 0x334]
push eax
push 0x14
push 0xd
push dword [ebx + 0x778]
mov dword [ebx + 0x780], 1
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x40a6e5
push str.usbx
lea eax, [ebp - 0x334]
push eax
call edi
lea eax, [ebx + 0x140]
push eax
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40ab26
lea eax, [ebp - 0x334]
push eax
lea eax, [ebx + 0x140]
push eax
lea eax, [ebp - 0x230]
push 0x42ca1c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 1
push str.NezuVirtualUSB
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x40a759
lea eax, [ebx + 0x140]
push eax
push esi
push 0xc
push dword [ebx + 0x778]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40ab26
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call edi
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x53c]
push eax
call edi
push str.Control
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebx + 0x254]
push eax
push 0x80000002
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a9fa
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 8], esi
push esi
jmp 0x40a802
inc dword [ebp - 8]
cmp eax, esi
jne 0x40a7ed
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40a81b
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40a7ce
jmp 0x40a822
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], esi
je 0x40a851
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push 0x42c9d8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40aa08
call fcn.00407790
test eax, eax
jne 0x40a864
push 0x42c9a8
jmp 0x40a9ff
lea eax, [ebx + 0x140]
push eax
lea eax, [ebp - 0x230]
push eax
call edi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebx + 0x254]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40a8a2
push 0x42c97c
jmp 0x40a9ff
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 8], esi
push esi
jmp 0x40a990
cmp eax, esi
jne 0x40a978
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40a978
lea eax, [ebp - 0x12c]
push eax
call fcn.00419f24
lea eax, [ebp - 0x12c]
push eax
call fcn.00419f80
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x438]
push eax
call edi
push 0x42c424
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x42c420
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x438]
push eax
call fcn.00419f24
lea eax, [ebp - 0x438]
push eax
call fcn.00419f80
and dword [ebp - 0x10], eax
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmp dword [ebp - 0x10], esi
je 0x40a97b
push esi
call fcn.00409e46
jmp 0x40a97b
inc dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40a8bd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx + 0x140]
push eax
lea eax, [ebp - 0x53c]
push eax
call edi
push str.Control
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebx + 0x154]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40aa4c
push 0x42c958
lea eax, [ebp - 0x230]
push eax
call edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebx + 0x140]
push eax
push esi
push 0xc
push dword [ebx + 0x778]
call edi
push 0x10
push str.NezuVirtualUSB
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebx + 0x140]
push eax
push esi
push 0xc
push dword [ebx + 0x778]
call edi
jmp 0x40ab26
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 8], esi
push esi
jmp 0x40aaaa
cmp eax, esi
jne 0x40aa92
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40aa92
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x40aa95
inc dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40aa64
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx + 0x140]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
lea eax, [ebp - 0x334]
push eax
lea eax, [ebx + 0x140]
push eax
call edi
xor edi, edi
inc edi
push edi
call fcn.0040a1ce
call fcn.0040a54b
test eax, eax
je 0x40ab1a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebx + 0x140]
push eax
call fcn.00409fae
test eax, eax
je 0x40ab1a
push 2
call fcn.0040a246
mov dword [ebx + 0x13c], edi
push dword [ebx + 0x658]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
mov dword [ebx + 0x780], esi
pop esi
pop ebx
leave
ret