Function at 0x410ef2
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call fcn.00415a44
push eax
push dword [ebp + 0x14]
call fcn.00415a44
push eax
push dword [ebp + 0x10]
call fcn.004160fc
push eax
push dword [edi + 0x50]
push 0x20000173
push 2
call fcn.004072c6
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004480aa
cmp dword [ebp - 0x10], 5
jge 0x410f5a
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x410fa2
push dword [ebp + 0x10]
push str.Resume
push ebx
call fcn.00405d42
mov esi, eax
test esi, esi
jns 0x410f7f
push str.Failed_to_write_Resume_value.
jmp 0x411103
cmp dword [ebp + 0x10], 3
jne 0x410fa2
push 1
push str.Installed
push ebx
call fcn.00405d42
mov esi, eax
test esi, esi
jns 0x410fa8
push str.Failed_to_write_Installed_value.
jmp 0x411103
cmp dword [ebp + 0x10], 1
je 0x410fb2
cmp dword [ebp + 0x14], 0
je 0x411049
cmp dword [edi + 8], 0
jne 0x411049
push str.burn.runonce
push dword [edi + 0x54]
lea eax, [ebp - 8]
push str.__ls____ls
push eax
call fcn.004029f6
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x410fe5
push str.Failed_to_format_resume_command_line_for_RunOnce.
jmp 0x411103
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0xc]
push dword [edi + 0x4c]
call fcn.00405461
mov esi, eax
test esi, esi
jns 0x411009
push str.Failed_to_create_run_key.
jmp 0x411103
push dword [ebp - 8]
push dword [edi + 0x10]
push dword [ebp - 4]
call fcn.00405d90
mov esi, eax
test esi, esi
jns 0x411027
push str.Failed_to_write_run_key_value.
jmp 0x411103
push dword [edi + 0x58]
push str.BundleResumeCommandLine
push ebx
call fcn.00405d90
mov esi, eax
test esi, esi
jns 0x41110b
push str.Failed_to_write_resume_command_line_value.
jmp 0x411103
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [ebp - 0xc]
push dword [edi + 0x4c]
call fcn.0040582c
mov esi, eax
cmp esi, 0x80070002
je 0x4110b7
cmp esi, 0x80070003
je 0x4110b7
push dword [edi + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [eax - 2]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x4110b9
test ecx, ecx
jg 0x41108e
mov esi, ecx
jmp 0x411097
movzx esi, cx
or esi, 0x80070000
test esi, esi
js 0x4110a0
mov esi, 0x80004005
push esi
push 0x4e7
push str.c:_agent_work35_swix_src_burnengine_registration.cpp
call fcn.004013b3
push str.Failed_to_delete_run_key_value.
jmp 0x411103
xor esi, esi
test ebx, ebx
je 0x41110b
push str.BundleResumeCommandLine
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [eax - 2]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x41110b
test ecx, ecx
jg 0x4110dc
mov esi, ecx
jmp 0x4110e5
movzx esi, cx
or esi, 0x80070000
test esi, esi
js 0x4110ee
mov esi, 0x80004005
push esi
push 0x4f1
push str.c:_agent_work35_swix_src_burnengine_registration.cpp
call fcn.004013b3
push str.Failed_to_delete_resume_command_line_value.
push esi
call fcn.0044534a
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x411119
push dword [ebp - 8]
call fcn.00403136
cmp dword [ebp - 4], 0
je 0x411128
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10