Function at 0x406410
Capabilities:
Delete registry value
Get common file path
Read .ini file
Set registry value

Disassembly:
sub esp, 0x61c
mov eax, dword [0x41a06c]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push 0x23
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [0x41bf80]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406444
lea edi, [esp + 0x20]
sub eax, edx
add edi, 0xfffffffe
jmp 0x406460
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x406460
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x41bf7c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406483
lea edi, [esp + 0x20]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4064a0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4064a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4064c3
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 7
mov esi, str.k7toolsst.rbk
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffffd
push str.Value1
push str.1578
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0xfffffffd
je 0x406593
cmp eax, 0xffffffff
jne 0x406536
lea edx, [esp + 0x14]
push edx
push 2
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call edi
test eax, eax
jne 0x406593
mov eax, dword [esp + 0x14]
push str.LargeSystemCache
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406593
jmp 0x40658b
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406593
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.LargeSystemCache
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40657c
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406593
mov dword [esp + 0x18], 1
lea edx, [esp + 0x20]
push edx
push 0xfffffffffffffffd
push str.Value1
push str.2436
call ebp
cmp eax, 0xfffffffd
je 0x40663f
cmp eax, 0xffffffff
jne 0x4065e2
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call edi
test eax, eax
jne 0x40663f
mov ecx, dword [esp + 0x14]
push str.DisablePagingExecutive
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40663f
jmp 0x406637
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x40663f
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push str.DisablePagingExecutive
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406628
lea esi, [eax + 1]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40663f
mov dword [esp + 0x18], 1
lea eax, [esp + 0x20]
push eax
push 0xfffffffffffffffd
push str.Value1
push 0x417600
call ebp
cmp eax, 0xfffffffd
je 0x4066eb
cmp eax, 0xffffffff
jne 0x40668e
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call edi
test eax, eax
jne 0x4066eb
mov edx, dword [esp + 0x14]
push str.ClearPageFileAtShutdown
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4066eb
jmp 0x4066e3
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4066eb
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.ClearPageFileAtShutdown
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4066d4
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4066eb
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffffd
push str.Value1
push 0x4175fc
call ebp
cmp eax, 0xfffffffd
je 0x406797
cmp eax, 0xffffffff
jne 0x40673a
lea edx, [esp + 0x14]
push edx
push 2
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
push 0x80000002
call edi
test eax, eax
jne 0x406797
mov eax, dword [esp + 0x14]
push str.EnablePrefetch
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406797
jmp 0x40678f
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406797
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.EnablePrefetch
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406780
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406797
mov dword [esp + 0x18], 1
lea edx, [esp + 0x20]
push edx
push 0xfffffffffffffffd
push str.Value1
push 0x417e08
call ebp
cmp eax, 0xfffffffd
je 0x406843
cmp eax, 0xffffffff
jne 0x4067e6
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
push 0x80000002
call edi
test eax, eax
jne 0x406843
mov ecx, dword [esp + 0x14]
push str.EnableSuperfetch
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406843
jmp 0x40683b
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406843
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push str.EnableSuperfetch
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40682c
lea esi, [eax + 1]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406843
mov dword [esp + 0x18], 1
lea eax, [esp + 0x20]
push eax
push 0xfffffffffffffffd
push str.Value1
push 0x417604
call ebp
cmp eax, 0xfffffffd
je 0x4068ef
cmp eax, 0xffffffff
jne 0x406892
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SystemCurrentControlSetControlSession_ManagerExecutive
push 0x80000002
call edi
test eax, eax
jne 0x4068ef
mov edx, dword [esp + 0x14]
push str.AdditionalDelayedWorkerThreads
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4068ef
jmp 0x4068e7
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.SystemCurrentControlSetControlSession_ManagerExecutive
push 0x80000002
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4068ef
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.AdditionalDelayedWorkerThreads
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4068d8
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4068ef
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffffd
push str.Value1
push 0x417e0c
call ebp
cmp eax, 0xfffffffd
je 0x40699b
cmp eax, 0xffffffff
jne 0x40693e
lea edx, [esp + 0x14]
push edx
push 2
push ebx
push str.SystemCurrentControlSetControlSession_ManagerExecutive
push 0x80000002
call edi
test eax, eax
jne 0x40699b
mov eax, dword [esp + 0x14]
push str.AdditionalCriticalWorkerThreads
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40699b
jmp 0x406993
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebx
push str.SystemCurrentControlSetControlSession_ManagerExecutive
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x40699b
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.AdditionalCriticalWorkerThreads
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406984
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40699b
mov dword [esp + 0x18], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x20]
push edx
push 0x200
lea eax, [esp + 0x230]
push eax
push ebx
push str.Value1
push 0x417e10
call ebp
test eax, eax
je 0x406aac
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4069fa
cmp dx, bx
je 0x4069f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4069fa
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4069d4
xor eax, eax
jmp 0x4069ff
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406a35
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x406aac
mov edx, dword [esp + 0x14]
push str.MaxConnectionsPer1_0Server
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406aac
jmp 0x406aa4
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406aac
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406a60
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x22c]
push edx
push 1
push ebx
push str.MaxConnectionsPer1_0Server
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406a95
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406aac
mov dword [esp + 0x18], 1
lea edx, [esp + 0x20]
push edx
push 0x200
lea eax, [esp + 0x230]
push eax
push ebx
push 0x417e14
push 0x417e10
call ebp
test eax, eax
je 0x406bbc
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406b06
cmp dx, bx
je 0x406b02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406b06
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x406ae0
xor eax, eax
jmp 0x406b0b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406b45
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x406bbc
mov edx, dword [esp + 0x14]
push str.MaxConnectionsPerServer
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406bbc
jmp 0x406bb4
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406bbc
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406b70
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x22c]
push edx
push 1
push ebx
push str.MaxConnectionsPerServer
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406ba5
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406bbc
mov dword [esp + 0x18], 1
lea edx, [esp + 0x20]
push edx
push 0xfffffffffffffffd
push str.Value1
push 0x417e24
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x406c70
cmp eax, 0xffffffff
jne 0x406c13
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.SystemCurrentControlSetControlPriorityControl
push 0x80000002
call edi
test eax, eax
jne 0x406c70
mov ecx, dword [esp + 0x14]
push 0x417608
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406c70
jmp 0x406c68
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.SystemCurrentControlSetControlPriorityControl
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406c70
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push 0x417608
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406c59
lea esi, [eax + 1]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406c70
mov dword [esp + 0x18], 1
lea eax, [esp + 0x20]
push eax
push 0xfffffffffffffffd
push str.Value1
push 0x417e28
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x406d24
cmp eax, 0xffffffff
jne 0x406cc7
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x406d24
mov edx, dword [esp + 0x14]
push str.LowLevelHooksTimeout
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406d24
jmp 0x406d1c
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406d24
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.LowLevelHooksTimeout
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406d0d
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406d24
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x230]
push edx
push ebx
push str.Value1
push 0x417e30
call ebp
test eax, eax
je 0x406e3b
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406d7d
cmp dx, bx
je 0x406d79
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406d7d
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x406d57
xor eax, eax
jmp 0x406d82
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406dbf
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x406e3b
mov ecx, dword [esp + 0x14]
push str.HungAppTimeout
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406e3b
jmp 0x406e33
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406e3b
lea eax, [esp + 0x228]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406df0
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x22c]
push ecx
push 1
push ebx
push str.HungAppTimeout
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406e24
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406e3b
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x230]
push edx
push ebx
push str.Value1
push 0x417e38
call ebp
test eax, eax
je 0x406f4e
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406e96
cmp dx, bx
je 0x406e92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406e96
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x406e70
xor eax, eax
jmp 0x406e9b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406ed8
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.SystemCurrentControlSetControl
push 0x80000002
call edi
test eax, eax
jne 0x406f4e
mov ecx, dword [esp + 0x14]
push str.WaitToKillServiceTimeout
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x406f4e
jmp 0x406f46
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.SystemCurrentControlSetControl
push 0x80000002
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x406f4e
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406f03
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x22c]
push ecx
push 1
push ebx
push str.WaitToKillServiceTimeout
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406f37
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x406f4e
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffffd
push str.Value1
push 0x417cf0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x407033
cmp eax, 0xffffffff
jne 0x406fb4
lea edx, [esp + 0x14]
push edx
push 2
push ebx
push str.SystemCurrentControlSetControlFileSystem
push 0x80000002
call edi
test eax, eax
jne 0x407013
mov eax, dword [esp + 0x14]
push str.NtfsDisable8dot3NameCreation
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x407013
mov dword [esp + 0x18], 1
jmp 0x407019
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebx
push str.SystemCurrentControlSetControlFileSystem
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x407013
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.NtfsDisable8dot3NameCreation
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406ffa
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x407013
mov dword [esp + 0x18], 1
jmp 0x407019
cmp dword [esp + 0x18], ebx
je 0x407033
lea edx, [esp + 0x20]
push edx
push 0x417298
push str.Value1
push 0x417cf0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esp + 0x20]
push eax
push 0xfffffffffffffffd
push str.Value1
push 0x417e40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x4070e7
cmp eax, 0xffffffff
jne 0x40708a
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x4070e7
mov edx, dword [esp + 0x14]
push str.FontSmoothingType
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4070e7
jmp 0x4070df
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4070e7
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.FontSmoothingType
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4070d0
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4070e7
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x230]
push edx
push ebx
push str.Value1
push 0x417e48
call ebp
test eax, eax
je 0x4071fe
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407146
cmp dx, bx
je 0x407142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407146
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x407120
xor eax, eax
jmp 0x40714b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x407188
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
call edi
test eax, eax
jne 0x4071fe
mov ecx, dword [esp + 0x14]
push str.Max_Cached_Icons
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4071fe
jmp 0x4071f6
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4071fe
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4071b3
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x22c]
push ecx
push 1
push ebx
push str.Max_Cached_Icons
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4071e7
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4071fe
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x230]
push edx
push ebx
push str.Value1
push 0x417e50
call ebp
test eax, eax
je 0x40731b
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407257
cmp dx, bx
je 0x407253
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407257
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x407231
xor eax, eax
jmp 0x40725c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x407299
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x40731b
mov ecx, dword [esp + 0x14]
push str.MenuShowDelay
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40731b
jmp 0x407313
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x40731b
lea eax, [esp + 0x228]
lea edx, [eax + 2]
jmp 0x4072d0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4072d0
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x22c]
push ecx
push 1
push ebx
push str.MenuShowDelay
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407304
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40731b
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x230]
push edx
push ebx
push str.Value1
push 0x417e58
call ebp
test eax, eax
je 0x407432
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407376
cmp dx, bx
je 0x407372
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407376
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x407350
xor eax, eax
jmp 0x40737b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4073b8
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x407432
mov ecx, dword [esp + 0x14]
push 0x417a44
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x407432
jmp 0x40742a
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x407432
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4073e7
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x22c]
push ecx
push 1
push ebx
push 0x417a44
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40741b
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x407432
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x230]
push edx
push ebx
push 0x417e14
push 0x417e58
call ebp
test eax, eax
je 0x40754b
mov ecx, 0x417cbc
lea eax, [esp + 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40748b
cmp dx, bx
je 0x407487
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40748b
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x407465
xor eax, eax
jmp 0x407490
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4074cd
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.Control_PanelDesktopWindowMetrics
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x40754b
mov ecx, dword [esp + 0x14]
push str.MinAnimate
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40754b
jmp 0x407543
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.Control_PanelDesktopWindowMetrics
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x40754b
lea eax, [esp + 0x228]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x407500
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x22c]
push ecx
push 1
push ebx
push str.MinAnimate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407534
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40754b
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffffd
push str.Value3
push 0x417e58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x407606
cmp eax, 0xffffffff
jne 0x4075ac
lea edx, [esp + 0x14]
push edx
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x407606
mov eax, dword [esp + 0x14]
push str.SmoothScroll
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x407606
lea ebp, [eax + 1]
jmp 0x40760a
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x407606
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.SmoothScroll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4075f2
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 1
cmp esi, ebx
jne 0x40760a
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push 0xfffffffffffffffd
push str.Value4
push 0x417e58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x4076c2
cmp eax, 0xffffffff
jne 0x407668
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x4076c2
mov ecx, dword [esp + 0x14]
push str.WindowArrangementActive
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4076c2
jmp 0x4076bd
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.Control_PanelDesktop
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4076c2
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push str.WindowArrangementActive
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4076ae
lea esi, [eax + 1]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4076c2
mov ebp, 1
lea eax, [esp + 0x20]
push eax
push 0xfffffffffffffffd
push str.Value5
push 0x417e58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x40777a
cmp eax, 0xffffffff
jne 0x407720
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x40777a
mov edx, dword [esp + 0x14]
push str.TaskBarAnimations
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40777a
jmp 0x407775
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x40777a
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.TaskBarAnimations
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407766
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40777a
mov ebp, 1
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffffd
push str.Value6
push 0x417e58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x407832
cmp eax, 0xffffffff
jne 0x4077d8
lea edx, [esp + 0x14]
push edx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x407832
mov eax, dword [esp + 0x14]
push str.DisablePreviewDesktop
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x407832
jmp 0x40782d
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x407832
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push ebx
push str.DisablePreviewDesktop
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40781e
lea esi, [eax + 1]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x407832
mov ebp, 1
lea edx, [esp + 0x20]
push edx
push 0xfffffffffffffffd
push str.Value7
push 0x417e58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x4078ea
cmp eax, 0xffffffff
jne 0x407890
lea eax, [esp + 0x14]
push eax
push 2
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x4078ea
mov ecx, dword [esp + 0x14]
push str.NoWindowMinimizingShortcuts
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4078ea
jmp 0x4078e5
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4078ea
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push str.NoWindowMinimizingShortcuts
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4078d6
lea esi, [eax + 1]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4078ea
mov ebp, 1
lea eax, [esp + 0x20]
push eax
push 0xfffffffffffffffd
push str.Value8
push 0x417e58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xfffffffd
je 0x4079a7
cmp eax, 0xffffffff
jne 0x40794d
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffects
push reloc.K7UI.dll_Ordinal_1
call edi
test eax, eax
jne 0x4079a7
mov edx, dword [esp + 0x14]
push str.VisualFXSetting
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4079a7
mov eax, 1
jmp 0x4079a9
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffects
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], ebx
xor esi, esi
call edi
test eax, eax
jne 0x4079a7
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
push str.VisualFXSetting
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407993
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp esi, ebx
jne 0x4079a9
mov eax, ebp
mov ecx, dword [esp + 0x628]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408425
add esp, 0x61c
ret