Function at 0x40fd70
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53acb5
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x5ac020]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x5ac020]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov dword [esp + 0x14], edx
mov edi, dword [0x5be310]
test edi, edi
je 0x40fe3d
push 0
lea eax, [esp + 0x1c]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov esi, dword [eax]
test esi, esi
je 0x40fde3
mov esi, dword [esi]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [esi + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x40fe3d
push str.Rerun
push 0
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x40fe37
call fcn.004d3270
test eax, eax
je 0x41075a
mov edi, 1
jmp 0x410761
mov edi, dword [0x5be310]
xor esi, esi
test edi, edi
je 0x41075a
cmp esi, edi
jae 0x40ff99
push esi
lea eax, [esp + 0x28]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov ebx, dword [eax]
test ebx, ebx
je 0x40fe73
mov ebx, dword [ebx]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [ebx + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x40feb9
push str.Mount
push esi
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
je 0x40ffd6
mov edi, dword [0x5be310]
cmp esi, edi
jae 0x40ff99
push esi
lea eax, [esp + 0x34]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov ebx, dword [eax]
test ebx, ebx
je 0x40fee5
mov ebx, dword [ebx]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [ebx + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x40ff2b
push str.Dismount
push esi
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
je 0x4100cd
mov edi, dword [0x5be310]
cmp esi, edi
jae 0x40ff99
push esi
lea eax, [esp + 0x64]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov ebx, dword [eax]
test ebx, ebx
je 0x40ff53
mov ebx, dword [ebx]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [ebx + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x40ff99
push str.DismountAll
push esi
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
je 0x4100f2
mov edi, dword [0x5be310]
inc esi
cmp esi, edi
jb 0x40fe4f
test edi, edi
je 0x41075a
push 0
lea eax, [esp + 0x4c]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov esi, dword [eax]
test esi, esi
jne 0x410107
jmp 0x410109
push 0x5be28c
mov ecx, 0x5be234
call fcn.004b2290
test eax, eax
je 0x41004a
cmp dword [0x5be248], 0
je 0x41004a
mov dword [esp + 0x18], vtable.MasterKey.0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xf8], 0xffffffff
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.MasterKey.0
test edi, edi
je 0x41004a
push 0x200
push edi
call fcn.0051b090
push 0x200
push edi
call fcn.0051b090
push 0x200
push edi
call fcn.0051b090
push dword [esp + 0x34]
call fcn.0051d3d0
add esp, 0x1c
inc esi
mov edi, 1
cmp esi, dword [0x5be310]
jae 0x4100b0
push esi
lea eax, [esp + 0x4c]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov ebx, dword [eax]
test ebx, ebx
je 0x41007c
mov ebx, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, edx
mov eax, dword [ebx + 8]
and edx, 3
dec eax
shr ecx, 2
and ecx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x4100b0
mov ecx, 0x56c344
call fcn.00410bc0
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
jmp 0x410761
push esi
mov ecx, 0x5be2fc
call fcn.00411c00
mov ecx, eax
call fcn.00410bc0
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
jmp 0x410761
lea eax, [esi + 1]
mov ecx, 0x5be2fc
push eax
mov edi, 1
call fcn.00411c00
mov ecx, eax
call fcn.00411150
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
jmp 0x410761
mov edi, 1
call fcn.00411370
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
jmp 0x410761
mov esi, dword [esi]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [esi + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x4103b0
push str.Install
push 0
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x4103aa
call fcn.004d3270
test eax, eax
je 0x4103a0
call fcn.0041d320
mov ecx, dword [esp + 0x14]
push str.AssociatePDV
mov dword [ecx], eax
mov ecx, 0x5be2fc
call fcn.00411d50
test eax, eax
je 0x4103a0
mov eax, dword [0x5be364]
lea ecx, [esp + 0x60]
or dword [0x5be360], 0x80000
mov dword [0x5be364], eax
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
push 0x5bdd4c
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
call fcn.00401c40
mov dword [esp + 0xf8], 1
lea ecx, [esp + 0x60]
push 0xffffffffffffffff
push 0
push 0x5bdd34
call fcn.0040e530
xor eax, eax
mov dword [esp + 0x58], 0
push 0xffffffffffffffff
push eax
mov dword [esp + 0x64], 0
lea ecx, [esp + 0x50]
push 0x5bdd4c
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
call fcn.00401c40
mov byte [esp + 0xf8], 2
lea ecx, [esp + 0x48]
push 7
push 0x56dbd0
call fcn.0040e600
lea ecx, [esp + 0x7c]
call fcn.00410790
mov byte [esp + 0xf8], 3
lea ecx, [esp + 0x7c]
push 0xd
push 0x56dbb0
mov dword [esp + 0xcc], 0
call fcn.00401f10
cmp dword [esp + 0x74], 8
lea edx, [esp + 0x60]
cmovae edx, dword [esp + 0x60]
cmp word [edx], 0
jne 0x41027d
xor ecx, ecx
jmp 0x410291
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410282
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x9c]
call fcn.00401f10
cmp dword [esp + 0x5c], 8
lea edx, [esp + 0x48]
cmovae edx, dword [esp + 0x48]
cmp word [edx], 0
jne 0x4102b7
xor ecx, ecx
jmp 0x4102cf
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4102c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xb4]
call fcn.00401f10
push 0
push 0x56c344
lea ecx, [esp + 0xd0]
call fcn.00401f10
cmp dword [0x5be414], 8
lea edx, [esp + 0x7c]
mov ecx, 0x5be400
cmovae ecx, dword [0x5be400]
push ecx
call fcn.004c4650
add esp, 4
mov ecx, 0x5bdd7c
cmp dword [0x5bdd90], 8
cmovae ecx, dword [0x5bdd7c]
call fcn.004831c0
mov byte [esp + 0xf8], 2
lea ecx, [esp + 0x7c]
call fcn.00410820
mov byte [esp + 0xf8], 1
cmp dword [esp + 0x5c], 8
jb 0x410354
push dword [esp + 0x48]
call fcn.0051d3d0
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov dword [esp + 0xf8], 0xffffffff
cmp dword [esp + 0x74], 8
jb 0x410389
push dword [esp + 0x60]
call fcn.0051d3d0
add esp, 4
xor eax, eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
mov edi, 1
jmp 0x410761
mov edi, dword [0x5be310]
test edi, edi
je 0x41075a
push 0
lea eax, [esp + 0x4c]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov esi, dword [eax]
test esi, esi
je 0x4103dd
mov esi, dword [esi]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [esi + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x410435
push str.StartService
push 0
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x41042f
call fcn.0041d5d0
mov ecx, dword [esp + 0x14]
mov edi, 1
mov dword [ecx], eax
jmp 0x410761
mov edi, dword [0x5be310]
test edi, edi
je 0x41075a
push 0
lea eax, [esp + 0x4c]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov esi, dword [eax]
test esi, esi
je 0x410462
mov esi, dword [esi]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [esi + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x4106ad
push str.Uninstall
push 0
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x4106a7
lea edi, [eax + 1]
call fcn.004d3270
test eax, eax
je 0x410698
call fcn.0041d770
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
lea eax, [esp + 0x14]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4104fd
push 0x56dbb0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x14]
call esi
xor eax, eax
mov dword [esp + 0x58], 0
push 0xffffffffffffffff
push eax
mov dword [esp + 0x64], 0
lea ecx, [esp + 0x50]
push 0x5bdd4c
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
call fcn.00401c40
mov dword [esp + 0xf8], 5
lea ecx, [esp + 0x48]
push 0xffffffffffffffff
push 0
push 0x5bdd34
call fcn.0040e530
cmp dword [0x5be414], 8
mov edx, 0x5be400
push ecx
cmovae edx, dword [0x5be400]
call fcn.004c49b0
xor eax, eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 4
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
mov byte [esp + 0xf8], 6
mov dword [esp + 0x60], vtable.cafx::tstring_ex_wchar_t__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov byte [esp + 0xf8], 7
lea ecx, [esp + 0x60]
call fcn.00476920
test eax, eax
je 0x41061c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x14]
push eax
push str.SoftwareCybertronPrivacy_DriveProtected
push 0x80000002
call ebx
test eax, eax
jne 0x41061c
cmp dword [esp + 0x78], 8
lea edx, [esp + 0x64]
mov ecx, dword [esp + 0x14]
cmovae edx, dword [esp + 0x64]
call fcn.004bffb0
push dword [esp + 0x14]
call esi
lea eax, [esp + 0x14]
push eax
push str.SoftwareCybertronPrivacy_Drive
push 0x80000002
call ebx
test eax, eax
jne 0x41061c
push str.Protected
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x14]
call esi
mov byte [esp + 0xf8], 5
mov dword [esp + 0x60], vtable.cafx::tstring_ex_wchar_t__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov byte [esp + 0xf8], 5
cmp dword [esp + 0x78], 8
jb 0x410647
push dword [esp + 0x64]
call fcn.0051d3d0
add esp, 4
xor eax, eax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
mov dword [esp + 0xf8], 0xffffffff
cmp dword [esp + 0x5c], 8
jb 0x41067c
push dword [esp + 0x48]
call fcn.0051d3d0
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
jmp 0x410761
mov ecx, dword [esp + 0x14]
mov dword [ecx], 0xffffffff
jmp 0x410761
mov edi, dword [0x5be310]
test edi, edi
je 0x41075a
push 0
lea eax, [esp + 0x4c]
mov ecx, 0x5be300
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00412010
mov ecx, eax
call fcn.004122f0
mov esi, dword [eax]
test esi, esi
je 0x4106da
mov esi, dword [esi]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [esi + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + edx*4]
cmp dword [eax], 2
jne 0x41075a
push str.FormatDialog
push 0
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.00500c00
add esp, 8
test eax, eax
jne 0x41075a
cmp dword [0x5be310], 2
jne 0x41075a
call fcn.004d3270
test eax, eax
je 0x410753
push 1
mov ecx, 0x5be2fc
call fcn.00411c00
push eax
call fcn.005012de
add esp, 4
cmp eax, 0x1a
jae 0x410753
push 1
push 0xffff
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHFormatDrive]
mov edi, 1
jmp 0x410761
call fcn.0040fcd0
mov edi, eax
mov eax, edi
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.004ffcef
mov esp, ebp
pop ebp
ret