Function at 0x40d5c6
Capabilities:
Delete registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac4
push ebx
push esi
push edi
call fcn.0041003a
xor esi, esi
push str.SeLoadDriverPrivilege
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
call fcn.0040e9e3
push str.SeUndockPrivilege
lea eax, [esp + 0x18]
call fcn.0040e9e3
push str.SeRestorePrivilege
lea eax, [esp + 0x18]
call fcn.0040e9e3
push 0x8001
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [esp + 0x50]
call fcn.00406516
lea ebx, [esp + 0x2f0]
mov dword [esp + 0x78], 0x20
mov dword [esp + 0x70], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x80], esi
call fcn.0040d1a3
push dword [ebp + 0x10]
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x6d0], edi
mov dword [esp + 0x6cc], eax
call fcn.00406951
mov esi, dword [esp + 0x6c4]
push str._savelangfile
call fcn.00406ac3
test eax, eax
jl 0x40d6b7
mov dword [0x418d6c], 0x4185e0
call fcn.00407701
lea edi, [esp + 0x2f0]
call fcn.0040d295
lea esi, [esp + 0x50]
call fcn.00406538
lea esi, [esp + 0x70]
call fcn.0040320b
lea esi, [esp + 0x50]
call fcn.00406538
cmp dword [esp + 0x14], 0
jmp 0x40e08f
call fcn.004075d0
mov esi, dword [esp + 0x6c4]
push str._deleteregkey
call fcn.00406ac3
test eax, eax
jl 0x40d6e3
push str.SoftwareNirSoftUSBDeview
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40d686
xor ebx, ebx
mov dword [0x418f9c], ebx
call fcn.00405afd
test eax, eax
je 0x40d7b6
mov esi, dword [esp + 0x6c4]
push str._RunAsAdmin
call fcn.00406ac3
test eax, eax
jl 0x40d7b6
push dword [ebp + 0x10]
lea edi, [esp + 0x30]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], 0x100
mov dword [esp + 0x38], ebx
call fcn.004066dd
push str._RunAsAdmin
mov eax, edi
push eax
call fcn.00406785
mov ecx, eax
cmp ecx, ebx
jl 0x40d7ad
mov eax, edi
push eax
push 0xb
pop eax
mov ebx, ecx
call fcn.00406840
xor ebx, ebx
push 0x104
lea eax, [esp + 0x1ed]
push ebx
push eax
mov byte [esp + 0x1f4], bl
call sub.msvcrt.dll_memset
lea eax, [esp + 0x1f4]
add esp, 0xc
push eax
call fcn.004059a7
mov eax, dword [esp + 0x30]
cmp eax, ebx
pop ecx
jne 0x40d78f
mov eax, 0x4144fe
push eax
lea eax, [esp + 0x1ec]
push eax
call fcn.00406428
pop ecx
pop ecx
lea esi, [esp + 0x2c]
call fcn.004066b8
jmp 0x40e064
lea esi, [esp + 0x2c]
call fcn.004066b8
mov eax, dword [esp + 0x6c4]
cmp dword [eax + 0x30], 1
jl 0x40d93a
lea eax, [esp + 0x2f0]
call fcn.0040d495
test eax, eax
jne 0x40e064
push ebx
lea eax, [esp + 0x2f4]
call fcn.0040c163
lea eax, [esp + 0x2f0]
call fcn.0040d363
mov ecx, dword [esp + 0x6c4]
or eax, 0xffffffff
cmp dword [ecx + 0x30], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], ebx
jle 0x40d93a
mov eax, dword [esp + 0x10]
call fcn.00406ab3
mov edi, eax
mov eax, dword [esp + 0x10]
push str._regedit
mov dword [esp + 0x1c], edi
call fcn.00406aed
test eax, eax
jne 0x40da03
push 5
push str._stop
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d983
push 7
pop esi
push esi
push str._remove
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9b3
push 0xf
push str._disable_enable
push edi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9bf
push 8
pop edi
push edi
push str._disable
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9cc
push esi
push str._enable
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9d8
push 0xb
push str._reload_hub
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9e4
push 0xd
push str._is_connected
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9f1
push 0xc
push str._is_disabled
push dword [esp + 0x20]
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x40d9fa
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x6c4]
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx + 0x30]
jl 0x40d82b
lea edi, [esp + 0x2f0]
call fcn.0040d03b
mov eax, edi
call fcn.0040d0b7
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x67
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ebx
push ebx
push 0x415
push dword [esp + 0x404]
mov dword [esp + 0x420], eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x40e04f
push 5
pop eax
mov dword [esp + 0x1c], 1
mov ecx, dword [esp + 0x18]
lea esi, [eax + ecx]
push 0x4144fe
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40db11
mov eax, dword [esp + 0x10]
jmp 0x40dbdd
mov eax, esi
mov dword [esp + 0x1c], 4
jmp 0x40d98e
push 0xf
pop eax
mov dword [esp + 0x1c], 5
jmp 0x40d98e
mov eax, edi
mov dword [esp + 0x1c], 2
jmp 0x40d98e
mov eax, esi
mov dword [esp + 0x1c], 3
jmp 0x40d98e
push 0xb
pop eax
mov dword [esp + 0x1c], 6
jmp 0x40d98e
push 0xd
pop eax
mov dword [esp + 0x1c], esi
jmp 0x40d98e
push 0xc
pop eax
mov dword [esp + 0x1c], edi
jmp 0x40d98e
lea eax, [esp + 0xa0]
call fcn.00411028
push ebx
mov esi, eax
call fcn.004110c6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x6c4]
inc eax
call fcn.00406ab3
xor edi, edi
cmp dword [esp + 0x1d8], ebx
mov dword [esp + 0x24], eax
jle 0x40da92
mov eax, edi
lea ecx, [esp + 0x1cc]
call fcn.004031f6
push 0x3ff
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6d5]
push ebx
push eax
mov byte [esp + 0x6dc], bl
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0xc
lea esi, [esp + 0x6d0]
call fcn.004111bf
push dword [esp + 0x24]
mov eax, esi
push eax
call sub.msvcrt.dll__mbsicmp
test eax, eax
pop ecx
pop ecx
je 0x40daeb
inc edi
cmp edi, dword [esp + 0x1d8]
jl 0x40da37
lea esi, [esp + 0x1cc]
call fcn.0040320b
lea esi, [esp + 0xa0]
call fcn.00406538
lea edi, [esp + 0x2f0]
call fcn.0040d295
lea esi, [esp + 0x50]
call fcn.00406538
lea esi, [esp + 0x70]
call fcn.0040320b
lea esi, [esp + 0x50]
call fcn.00406538
cmp dword [esp + 0x14], ebx
je 0x40dae1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xffff
jmp 0x40e09d
mov ecx, dword [esp + 0x20]
call fcn.00412069
lea esi, [esp + 0x1cc]
call fcn.0040320b
lea esi, [esp + 0xa0]
call fcn.00406538
jmp 0x40e064
push str._by_serial
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40db2f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x48], eax
jmp 0x40dbe1
push str._by_drive
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40db4d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
jmp 0x40dbe7
push str._all
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40db6b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
jmp 0x40dbed
push str._all_connected
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40db86
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
jmp 0x40dbf9
push str._all_disconnected
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40dba1
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
jmp 0x40dbff
push str._by_class
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40dbbc
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
jmp 0x40dbf3
push str._by_pid
push esi
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x40d93a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40dc0f
cmp dword [esp + 0x48], ebx
je 0x40dc0f
cmp dword [esp + 0x4c], ebx
je 0x40dc0f
cmp dword [esp + 0x44], ebx
je 0x40dc0f
cmp dword [esp + 0x20], ebx
je 0x40dc0f
cmp dword [esp + 0x40], ebx
je 0x40dc0f
cmp dword [esp + 0x2c], ebx
je 0x40dc0f
cmp dword [esp + 0x24], ebx
jne 0x40d93a
mov ecx, dword [esp + 0x6c4]
mov esi, dword [ecx + 0x30]
xor edi, edi
cmp esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
jle 0x40dc42
mov eax, edi
call fcn.00406ab3
cmp byte [eax], 0x5c
jne 0x40dc3d
cmp byte [eax + 1], 0x5c
jne 0x40dc3d
mov dword [esp + 0x28], eax
inc edi
cmp edi, esi
jl 0x40dc27
lea eax, [esp + 0xa0]
call fcn.00411028
mov eax, dword [esp + 0x6cc]
mov eax, dword [eax + 0x58]
push dword [esp + 0x28]
lea esi, [esp + 0xa4]
mov dword [esp + 0x1e4], eax
call fcn.004110c6
mov esi, dword [esp + 0x6c4]
xor edi, edi
push str._showmsg
mov dword [esp + 0x2c], edi
call fcn.00406ac3
test eax, eax
jl 0x40dc96
mov dword [esp + 0x28], 1
mov edi, dword [esp + 0x28]
cmp dword [esp + 0x4c], ebx
jne 0x40dcc7
mov ecx, dword [esp + 0x6c4]
push dword [esp + 0x1c]
mov eax, dword [ecx + 0x30]
push edi
dec eax
call fcn.00406ab3
push eax
lea eax, [esp + 0xac]
call fcn.00413402
mov dword [esp + 0x10], eax
jmp 0x40defd
cmp dword [esp + 0x48], ebx
jne 0x40dcf4
mov ecx, dword [esp + 0x6c4]
push dword [esp + 0x1c]
mov eax, dword [ecx + 0x30]
push edi
dec eax
call fcn.00406ab3
push eax
lea ebx, [esp + 0xac]
call fcn.00413397
jmp 0x40def7
cmp dword [esp + 0x44], ebx
jne 0x40dd10
push dword [esp + 0x1c]
lea ebx, [esp + 0xa4]
push edi
call fcn.004134ef
jmp 0x40def7
cmp dword [esp + 0x40], ebx
jne 0x40dd2e
push dword [esp + 0x1c]
push edi
push 1
lea ebx, [esp + 0xac]
call fcn.00413483
jmp 0x40def7
cmp dword [esp + 0x2c], ebx
jne 0x40dd3c
push dword [esp + 0x1c]
push edi
push ebx
jmp 0x40dd1d
mov ecx, dword [esp + 0x6c4]
mov eax, dword [ecx + 0x30]
dec eax
cmp dword [esp + 0x24], ebx
jne 0x40ddfe
call fcn.00406ab3
mov esi, 0xff
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1ed]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1f4], bl
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x38], ebx
stosd dword es:[edi], eax
add esp, 0xc
or dword [esp + 0x30], 0xffffffff
mov edi, str._____
jmp 0x40ddb8
cmp dword [esp + 0x18], 2
jge 0x40dddd
lea eax, [esp + 0x1e8]
push eax
call fcn.00405ea1
pop ecx
mov ecx, dword [esp + 0x18]
inc dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x2c], eax
push 1
push 0x4144fe
push edi
push dword [esp + 0x2c]
lea eax, [esp + 0x1f8]
push esi
push eax
lea ebx, [esp + 0x3c]
call fcn.0040629d
add esp, 0x18
test eax, eax
jne 0x40dd97
push dword [esp + 0x1c]
lea ebx, [esp + 0xa4]
push dword [esp + 0x2c]
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.00413245
jmp 0x40def7
cmp dword [esp + 0x20], ebx
jne 0x40dee0
call fcn.00406ab3
mov esi, 0xff
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1ed]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1f4], bl
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov dword [esp + 0x2c], ebx
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
push 0x4144fe
mov edi, str._____
push edi
push dword [esp + 0x2c]
lea eax, [esp + 0x1f8]
push esi
push eax
lea ebx, [esp + 0x3c]
call fcn.0040629d
add esp, 0x18
test eax, eax
je 0x40defb
cmp dword [esp + 0x18], 3
jge 0x40debc
lea eax, [esp + 0x1e8]
push eax
call fcn.00405ea1
pop ecx
mov ecx, dword [esp + 0x18]
inc dword [esp + 0x18]
push 1
push 0x4144fe
push edi
push dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x3c], eax
lea eax, [esp + 0x1f8]
push esi
push eax
lea ebx, [esp + 0x3c]
call fcn.0040629d
add esp, 0x18
test eax, eax
jne 0x40de71
cmp dword [esp + 0x18], 3
jne 0x40defb
push dword [esp + 0x1c]
lea ebx, [esp + 0xa4]
push dword [esp + 0x2c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.004132b8
jmp 0x40def7
push dword [esp + 0x1c]
push edi
call fcn.00406ab3
push eax
lea ebx, [esp + 0xac]
call fcn.00413331
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp dword [esp + 0x1c], 8
je 0x40df0b
cmp dword [esp + 0x1c], 7
jne 0x40df14
mov eax, dword [0x418f9c]
mov dword [esp + 0x10], eax
lea esi, [esp + 0x1cc]
call fcn.0040320b
lea esi, [esp + 0xa0]
call fcn.00406538
push dword [esp + 0x6cc]
mov dword [esp + 0x2f4], 0x4154a0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea esi, [esp + 0x6b0]
call fcn.004066b8
lea esi, [esp + 0x69c]
call fcn.004105a8
lea esi, [esp + 0x48c]
call fcn.004105a8
lea esi, [esp + 0x464]
mov dword [esp + 0x464], 0x415afc
call fcn.00410487
lea esi, [esp + 0x50]
mov dword [esp + fcn.004017f4], 0x41450c
call fcn.00406538
lea esi, [esp + 0x70]
call fcn.0040320b
lea esi, [esp + 0x50]
call fcn.00406538
cmp dword [esp + 0x14], ebx
je 0x40dfb5
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
jmp 0x40e09d
cmp dword [esp + 0x88], 0x100
jne 0x40dfde
lea ecx, [esp + 0x84]
lea edi, [esp + 0x2f0]
call fcn.0040d0ff
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x414]
push dword [esp + 0x400]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x40e04f
mov eax, dword [0x418b7c]
cmp eax, ebx
je 0x40e01a
lea ecx, [esp + 0x84]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40e04f
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x3fc]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40e04f
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
call esi
test eax, eax
jne 0x40dfbe
lea edi, [esp + 0x2f0]
call fcn.0040d295
lea esi, [esp + 0x50]
call fcn.00406538
lea esi, [esp + 0x70]
call fcn.0040320b
lea esi, [esp + 0x50]
call fcn.00406538
cmp dword [esp + 0x14], ebx
je 0x40e09b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10