Function at 0x417020
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5d51c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x210], 0x412
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov esi, ecx
lea eax, [ebp - 0x20a]
push eax
call fcn.0054cbf0
add esp, 0xc
mov dword [ebp - 0x214], 0x412
test byte [ebp + 8], 0x17
je 0x417129
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x21c]
push eax
push str.SoftwareHNCGlobal_Settings9.6User_Locales
push SysReAllocString
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x4170aa
lea eax, [ebp - 0x21c]
push eax
push str.SoftwareHNCGlobal_Settings9.6User_Locales
push SysReAllocString
call edi
lea eax, [ebp - 0x218]
push eax
push str..docxShellNew
push SysReAllocString
call ebx
test eax, eax
je 0x4170d4
lea eax, [ebp - 0x218]
push eax
push str..docxShellNew
push SysReAllocString
call edi
lea eax, [ebp - 0x224]
push eax
push str.SOFTWAREHNCSharedExecuteOption96
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x4170fe
lea eax, [ebp - 0x224]
push eax
push str.SOFTWAREHNCSharedExecuteOption96
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea eax, [ebp - 0x220]
push eax
push str.SoftwareHNCGlobal_Settings9.6User_LocalesHWP
push SysReAllocString
call ebx
pop ebx
test eax, eax
je 0x417129
lea eax, [ebp - 0x220]
push eax
push str.SoftwareHNCGlobal_Settings9.6User_LocalesHWP
push SysReAllocString
call edi
mov eax, dword [esi + 0x264]
dec eax
je 0x417645
dec eax
je 0x4173f6
dec eax
jne case.default.0x417170
push eax
push eax
push 0x147
push dword [esi + 0xb8]
mov dword [ebp - 0x214], 0x409
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x10c], eax
cmp eax, 0x10
ja case.default.0x417170
jmp dword [eax*4 + 0x417748]
mov dword [ebp - 0x210], 0x409
push str.NoName_enu.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_kor.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x412
push 0x104
push eax
call fcn.0054b04d
mov dword [ebp - 0x214], 0x412
jmp 0x41769c
push str.NoName_ara.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x401
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_chs.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x804
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_cht.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x404
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_deu.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x407
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_jpn.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x411
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_ptb.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x416
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_rus.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x419
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_spa.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x40a
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_far.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x429
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_nld.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x413
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_fra.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x40c
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_eng.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x809
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_esp.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0xc0a
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_ita.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x410
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_pol.hwdt
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x415
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x188
push dword [esi + 0x1ec]
call edi
test eax, eax
jns 0x417453
mov eax, 0x409
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], 0x409
cmp eax, 0x804
ja 0x417603
je 0x4175e8
add eax, 0xfffffbff
cmp eax, 0x28
ja case.0x41744c.1026
movzx eax, byte [eax + 0x4177c8]
jmp dword [eax*4 + 0x41778c]
push 0
push 0
push 0x188
push dword [esi + 0x1ec]
call edi
push 0
push eax
push 0x199
push dword [esi + 0x1ec]
call edi
mov dword [ebp - 0x210], eax
cmp eax, 0x412
jne 0x41741c
mov dword [ebp - 0x214], eax
jmp 0x417437
push str.NoName_kor.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_ara.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_cht.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_deu.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_jpn.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_ptb.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_rus.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_spa.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_far.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_nld.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_fra.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_ita.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_pol.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_chs.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
cmp eax, 0x809
je 0x41762d
cmp eax, 0xc0a
jne case.0x41744c.1026
push str.NoName_esp.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push str.NoName_eng.hwdt
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054b04d
jmp 0x41769c
push 0
push 0
push 0x147
push dword [esi + 0xb8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x10c], eax
sub eax, 0
je 0x417672
dec eax
jne case.default.0x417170
push str.NoName_kor.docx
jmp 0x4171a1
push str.NoName_enu.docx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x409
push 0x104
push eax
call fcn.0054b04d
mov dword [ebp - 0x214], 0x409
add esp, 0xc
cmp dword [ebp - 0x210], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jbe 0x4176c8
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push 0
push str.LCID
push dword [ebp - 0x21c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.FileName
push dword [ebp - 0x218]
call edi
call fcn.0041e820
test al, al
je 0x417708
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push 0
push str.LCID
push dword [ebp - 0x220]
call edi
cmp byte [esi + 0x110], 1
jne 0x417721
push str.SoftwareHNCGlobal_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call fcn.0041e980
cmp al, 1
jne 0x417731
mov ecx, esi
call fcn.00417a40
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0054a22c
mov esp, ebp
pop ebp
ret 4