Function at 0x4234da
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
mov edx, 0x4a9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4234e1
call fcn.0045e790
mov edx, dword [esp + 0x12b0]
lea ecx, [esp]
call fcn.0044e000
lea eax, [esp + 4]
lea eax, [esp + 0x1288]
push eax
push 0
push 0x40
push 3
push 0x80000000
mov eax, dword [esp + 0x14]
push eax
call dword [0x473504]
mov dword [esp + 0x128c], eax
cmp dword [esp + 0x128c], 0
je 0x423aa7
mov ebp, dword [0x47356c]
mov eax, dword [ebp + 0x10]
push eax
push dword [esp + 0x1290]
call dword [0x473520]
push dword [esp + 0x12b4]
push dword [esp + 0x1290]
call dword [0x4734d0]
mov dword [esp + 0x1284], eax
cmp dword [esp + 0x1284], 0
je 0x423a9a
lea eax, [esp + 4]
push eax
mov eax, str.WindowsBrandingBasebrd
push eax
push dword [esp + 0x128c]
call dword [0x473528]
mov dword [esp + 0x1290], eax
cmp dword [esp + 0x1290], 0
je 0x42387e
lea ebp, [esp + 4]
push ebp
pop ebp
lea eax, [ebp + 0x2c]
mov dword [esp + 0x1294], eax
lea eax, [esp + 0x1294]
push eax
pop eax
mov dword [esp + 0x1298], eax
lea ebp, [esp + 4]
mov ebx, dword [ebp]
and ebx, 0x10
and ebx, ebx
je 0x423855
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.WinNTSetup_basebrd.dll.mui
push edx
call fcn.0045e6f0
call fcn.0045e850
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str.WindowsBrandingBasebrd_
push edx
call fcn.0045e6f0
mov ebp, dword [esp + 0x12a4]
mov edx, dword [ebp]
push edx
call fcn.0045e6f0
mov edx, str._basebrd.dll.mui
push edx
call fcn.0045e6f0
call fcn.0045e850
push dword [esp + 0x1290]
call fcn.0044e2d2
add dword [esp + 4], edx
call fcn.0044e2d2
add dword [esp + 8], edx
call fcn.0040441e
call fcn.0044e2f0
and eax, eax
je 0x423855
push edx
call fcn.0045e620
pop edx
push eax
push 0x46ba58
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.WinNTSetup_basebrd.dll.mui
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00422512
lea eax, [esp + 0x12a0]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461aa8
push eax
push 1
push dword [esp + 0x12ac]
call fcn.0044fe50
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x20]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461aa8
push eax
push 2
push dword [esp + 0x12ac]
call fcn.0044fe50
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x24]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461aa8
push eax
push 3
push dword [esp + 0x12b0]
call fcn.0044fe50
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f890
call fcn.0044e2f0
push eax
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
pop eax
mov dword [ebp + 0x1c], eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461aa8
push eax
push 4
push dword [esp + 0x12ac]
call fcn.0044fe50
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x28]
push eax
call fcn.0045e660
mov ebp, dword [esp + 0x1298]
mov edx, dword [ebp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x38]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.WinNTSetup_basebrd.dll.mui
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_DeleteFileW
call fcn.0044e2f0
jmp 0x423871
lea eax, [esp + 4]
push eax
push dword [esp + 0x1294]
call dword [0x4734ec]
mov ebx, eax
and ebx, ebx
jne 0x4235cf
push dword [esp + 0x1290]
call dword [0x47350c]
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.WinNTSetup_software
push edx
call fcn.0045e6f0
call fcn.0045e850
mov eax, str.Windows_system32config_software
push eax
push dword [esp + 0x1290]
call fcn.0044e2d2
add dword [esp + 8], edx
call fcn.0040441e
call fcn.0044e2f0
and eax, eax
je 0x423a8d
push edx
call fcn.0045e620
pop edx
push eax
push 0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.WinNTSetup_software
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00434e1c
call fcn.0044e2f0
mov dword [esp + 0x12a0], eax
cmp dword [esp + 0x12a0], 0
je 0x423a51
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.EditionID
push eax
mov eax, str.MicrosoftWindows_NTCurrentVersion
push eax
push dword [esp + 0x12ac]
call fcn.00415330
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x46c4d8
push eax
mov eax, str.MicrosoftWindows_NTCurrentVersion
push eax
push dword [esp + 0x12ac]
call fcn.00415330
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x44]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.InstallationType
push eax
mov eax, str.MicrosoftWindows_NTCurrentVersion
push eax
push dword [esp + 0x12ac]
call fcn.00415330
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x54]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 4
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.SystemRoot
push eax
mov eax, str.MicrosoftWindows_NTCurrentVersion
push eax
push dword [esp + 0x12b8]
call fcn.00415330
call fcn.0044e2d2
add dword [esp], edx
call fcn.00450130
mov ebp, dword [esp + 0x12bc]
push ebp
mov eax, dword [esp + 0x12bc]
shl eax, 6
pop ebp
add ebp, eax
lea eax, [ebp + 0x50]
push eax
call fcn.0045e660
push dword [esp + 0x12a0]
call sub.Toolsx86offreg.dll_ORCloseHive
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.WinNTSetup_software
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_DeleteFileW
call fcn.0044e2f0
push dword [esp + 0x1284]
call dword [0x47350c]
push dword [esp + 0x128c]
call dword [0x47350c]
xor eax, eax
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0x129c]
call fcn.0045e7f0
add esp, 0x12a4
pop ebx
pop ebp
ret 0xc