Function at 0x41d840
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x5c4
lea eax, [esp + 0x58f]
call fcn.00409d90
movsd xmm0, qword [0x53ed88]
movsd qword [esp + 0x5b0], xmm0
movzx esi, word [0x53ed90]
mov word [esp + 0x5b8], si
mov al, byte [0x53ed92]
mov byte [esp + 0x5ba], al
pxor xmm0, xmm0
movaps xmmword [esp + 0x5a0], xmm0
lea eax, [esp + 0x510]
call fcn.004252d0
lea eax, [esp + 0x510]
mov edx, 0x54281c
mov ecx, 1
call fcn.00401c90
lea eax, [esp + 0x510]
lea edx, [esp + 0x5b0]
mov ecx, 0xb
call fcn.00401c90
lea eax, [esp + 0x510]
mov edx, 0x54281c
mov ecx, 1
call fcn.00401c90
lea edx, [esp + 0x58f]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x41d90e
mov eax, edx
add edx, ecx
call fcn.00425520
lea edx, [esp + 0x58f]
mov ecx, eax
lea eax, [esp + 0x510]
call fcn.00401c90
lea eax, [esp + 0x5a0]
lea edx, [esp + 0x510]
call fcn.00408c90
movzx edi, byte [esp + 0x5aa]
movzx esi, byte [esp + 0x5ab]
movzx ebx, byte [esp + 0x5ac]
movzx ecx, byte [esp + 0x5ad]
movzx edx, byte [esp + 0x5ae]
movzx eax, byte [esp + 0x5af]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x5c1]
push eax
movzx edx, byte [esp + 0x5c4]
push edx
movzx ecx, byte [esp + 0x5c7]
push ecx
movzx ebx, byte [esp + 0x5ca]
push ebx
movzx esi, byte [esp + 0x5cd]
push esi
movzx edi, byte [esp + 0x5d0]
push edi
movzx eax, byte [esp + 0x5d3]
push eax
movzx edx, byte [esp + 0x5d6]
push edx
movzx ecx, byte [esp + 0x5d9]
push ecx
movzx ebx, byte [esp + 0x5dc]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x5ac]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea eax, [esp + 0x410]
mov edx, str.cXM3t3L2M_28ujnzcuPhJrZ1A
call fcn.004224a0
lea esi, [esp + 0x490]
lea edx, [esp + 0x568]
push edx
push eax
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
call fcn.00422e10
test eax, eax
je 0x41da1c
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, esi
call fcn.004018d0
lea ebx, [esp + 0x210]
push 0x5428fc
push esi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov edi, eax
test edi, edi
je 0x41da5c
sub edi, esi
push edi
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add ebx, edi
push ebx
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea esi, [edi + esi + 1]
jmp 0x41da23
mov edx, esi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x41da82
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0xf013f
mov ecx, 0xf003f
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x5bc]
push eax
push ecx
push 0
lea ebx, [esp + 0x21c]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41db88
lea esi, [esp + 0x10]
xor edi, edi
push 0x200
push esi
push edi
push dword [esp + 0x5c8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
cmp ebx, 0x103
je 0x41db10
test ebx, ebx
jne 0x41db0a
mov eax, dword [esp + 0x5bc]
mov edx, esi
mov ecx, 1
call fcn.00401710
mov ebx, eax
test ebx, ebx
jl 0x41db10
inc edi
cmp edi, 0x64
jl 0x41dacf
push dword [esp + 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jl 0x41db88
call fcn.00401b70
test eax, eax
je 0x41db75
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RegDeleteKeyEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x41db95
call fcn.00401b70
push 0
mov edx, 0x100
test eax, eax
cmovne eax, edx
push eax
lea eax, [esp + 0x218]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
add esp, 0x5c4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0x5c4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0x5c4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret