Function at 0x408560
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x438070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x48], 8
lea esi, [edi + 0x34]
jb 0x408582
mov eax, dword [esi]
jmp 0x408584
mov eax, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x4085e3
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x4085dd
push 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 3
push eax
push 4
push 0
push str.Status
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [edi + 0x7c]
inc eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x28], eax
jb 0x4085f4
mov eax, dword [esi]
jmp 0x4085f6
mov eax, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x24], 0
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x408648
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x408648
mov eax, dword [ebp - 0x28]
push 4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.AlreadyRunCount
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call fcn.00408790
test al, al
je 0x40866c
mov ecx, edi
call fcn.004087f0
test al, al
je 0x40866c
mov ecx, esi
call fcn.004071d0
mov bl, al
test bl, bl
jne 0x4086e9
mov ecx, edi
call fcn.00408930
mov ecx, esi
call fcn.004071d0
mov bl, al
test bl, bl
jne 0x4086e9
cmp dword [esi + 0x14], 8
jb 0x408688
mov esi, dword [esi]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40875c
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x40875c
push 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 1
push eax
push 4
push 0
push str.Status
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40875c
lea eax, [edi + 0x80]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040a340
add esp, 4
lea edx, [edi + 0x64]
mov ecx, eax
call fcn.00407270
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x408744
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x408771
add eax, eax
cmp eax, 0x1000
jb 0x40873b
test cl, 0x1f
jne 0x408776
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40877b
sub ecx, eax
cmp ecx, 4
jb 0x408780
cmp ecx, 0x23
ja 0x408785
mov ecx, eax
push ecx
call fcn.0040fea4
add esp, 4
cmp dword [edi + 0x2c], 0
je 0x40875c
cmp dword [edi + 0x30], 8
lea eax, [edi + 0x1c]
jb 0x408755
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 4
call fcn.00418f5c
call fcn.00418f5c
call fcn.00418f5c
call fcn.00418f5c
call fcn.00418f5c
int3