Function at 0x407480
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x408
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov qword [r11 - 0x10], r13
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
xor r13d, r13d
mov qword [rsp + 0x78], r13
mov byte [r11 - 0x348], r13b
xor edx, edx
mov r8d, 0xfe
lea rcx, [r11 - 0x347]
call fcn.004255a0
mov byte [rsp + 0x2d0], r13b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2d1]
call fcn.004255a0
mov dword [rsp + 0x8c], 0x104
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x70], 0x104
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlusbflags
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407c4f
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x407941
lea rdx, str.CleanRegUsbFlagInfo
lea rcx, str._s_Number_of_subkeys:__d_n
call fcn.00404a90
mov r12d, r13d
cmp dword [rsp + 0x60], r13d
jbe 0x407941
nop
nop
nop
mov dword [rsp + 0x88], 0xff
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xc0]
mov edx, r12d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4078e8
call fcn.00418c7c
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x407936
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xc0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x4076ed
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x40776a
cmp dword [rdx + 0x10], eax
jge 0x4076bf
cmp dword [rbx - 0xc], eax
jl 0x4078f8
mov dword [rbx - 0x10], r13d
mov byte [rbx], al
jmp 0x40776a
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4076d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x40776a
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xc0]
sub rbp, rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x40771d
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.00401fa0
mov rbx, qword [rsp + 0x68]
cmp rbp, rsi
ja 0x407739
movsxd rsi, edi
lea r8, [rbx + rbp]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.00426320
jmp 0x407752
movsxd rsi, edi
mov r9, rsi
lea r8, [rsp + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.00426220
test edi, edi
js 0x40792b
cmp edi, dword [rbx - 0xc]
jg 0x40792b
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x407790
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.00401fa0
mov rbx, qword [rsp + 0x68]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.00425f20
test eax, eax
je 0x4077c6
cmp eax, 0xc
je 0x40790f
cmp eax, 0x16
je 0x407909
cmp eax, 0x22
je 0x407909
cmp eax, 0x50
jne 0x407903
test edi, edi
js 0x407920
cmp edi, dword [rbx - 0xc]
jg 0x407920
mov dword [rbx - 0x10], edi
mov byte [rdi + rbx], 0
lea rdx, str.12d1
mov rcx, rbx
call fcn.00424e10
test rax, rax
jne 0x40781e
lea rdx, str.18d1
mov rcx, rbx
call fcn.00424e10
test rax, rax
jne 0x40781e
lea rdx, str.05c6
mov rcx, rbx
call fcn.00424e10
test rax, rax
je 0x4078ca
call fcn.00418c7c
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x407915
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0xc0]
lea rdx, str.SYSTEMCurrentControlSetControlusbflags_s
lea rcx, [rsp + 0x90]
call fcn.004038f0
mov rdi, qword [rsp + 0x90]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
jne 0x4078a0
mov r8, rdi
lea rdx, str.CleanRegUsbFlagInfo
lea rcx, str._s_Found__s_in_UsbFlag_Delete_OK_n
call fcn.00404a90
add r12d, 0xffffffff
add dword [rsp + 0x60], 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4078c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x68]
jmp 0x4078ca
mov rbx, qword [rsp + 0x68]
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4078e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r12d, 1
cmp r12d, dword [rsp + 0x60]
jae 0x407941
jmp 0x407600
mov ecx, 0x80070057
call fcn.00401000
int3
call fcn.00418860
int3
call fcn.00418860
int3
call fcn.0041883c
int3
mov ecx, 0x80004005
call fcn.00401000
int3
mov ecx, 0x80070057
call fcn.00401000
int3
mov ecx, 0x80070057
call fcn.00401000
nop
mov ecx, 0x80004005
call fcn.00401000
int3
mov edx, dword [rsp + 0x64]
test edx, edx
je 0x407c44
lea rcx, str._nNumber_of_values:__d_n
call fcn.00404a90
mov r12d, r13d
cmp dword [rsp + 0x64], r13d
jbe 0x407c44
nop
nop
nop
mov dword [rsp + 0x70], 0x104
mov byte [rsp + 0x1c0], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x1c0]
mov edx, r12d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x407bf6
call fcn.00418c7c
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x407c39
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1c0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x407a60
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x407ae3
cmp dword [rdx + 0x10], eax
jge 0x407a2c
cmp dword [rbx - 0xc], eax
jl 0x407c06
mov dword [rbx - 0x10], r13d
mov byte [rbx], al
jmp 0x407ae3
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x407a46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
jmp 0x407ae3
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0x1c0]
sub rbp, rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x407a96
mov edx, edi
lea rcx, [rsp + 0x80]
call fcn.00401fa0
mov rbx, qword [rsp + 0x80]
cmp rbp, rsi
ja 0x407ab2
movsxd rsi, edi
lea r8, [rbx + rbp]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.00426320
jmp 0x407acb
movsxd rsi, edi
mov r9, rsi
lea r8, [rsp + 0x1c0]
mov rdx, rsi
mov rcx, rbx
call fcn.00426220
test edi, edi
js 0x407c2e
cmp edi, dword [rbx - 0xc]
jg 0x407c2e
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x407b0f
mov edx, edi
lea rcx, [rsp + 0x80]
call fcn.00401fa0
mov rbx, qword [rsp + 0x80]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.00425f20
test eax, eax
je 0x407b45
cmp eax, 0xc
je 0x407c1d
cmp eax, 0x16
je 0x407c17
cmp eax, 0x22
je 0x407c17
cmp eax, 0x50
jne 0x407c11
test edi, edi
js 0x407c23
cmp edi, dword [rbx - 0xc]
jg 0x407c23
mov dword [rbx - 0x10], edi
mov byte [rdi + rbx], 0
lea rdx, str.ignorehwsernum12d1
mov rcx, rbx
call fcn.00424e10
test rax, rax
jne 0x407b99
lea rdx, str.ignorehwsernum05c6
mov rcx, rbx
call fcn.00424e10
test rax, rax
jne 0x407b99
lea rdx, str.ignorehwsernum18d1
mov rcx, rbx
call fcn.00424e10
test rax, rax
je 0x407bd8
lea r8, [rsp + 0x1c0]
lea rdx, str.SYSTEMCurrentControlSetControlusbflags
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
jne 0x407bd8
lea r8, [rsp + 0x1c0]
lea rdx, str.CleanRegUsbFlagInfo
lea rcx, str._s_Found_Value:_s_in_UsbFlag_Delete_it_OK_n
call fcn.00404a90
add r12d, 0xffffffff
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x407bf6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r12d, 1
cmp r12d, dword [rsp + 0x64]
jae 0x407c44
jmp 0x407970
mov ecx, 0x80070057
call fcn.00401000
int3
call fcn.00418860
int3
call fcn.00418860
int3
call fcn.0041883c
int3
mov ecx, 0x80070057
call fcn.00401000
int3
mov ecx, 0x80070057
call fcn.00401000
nop
mov ecx, 0x80004005
call fcn.00401000
int3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x410]
mov rbp, qword [rsp + 0x418]
mov rsi, qword [rsp + 0x420]
mov rdi, qword [rsp + 0x428]
mov r12, qword [rsp + 0x400]
mov r13, qword [rsp + 0x3f8]
add rsp, 0x408
ret