Function at 0x4113e2
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x30
mov eax, 0x553d48
call fcn.00527be2
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], 0x2001f
call fcn.00411604
cmp eax, edi
je 0x411418
neg esi
sbb esi, esi
and esi, 0xffffff00
add esi, 0x2021f
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
push 5
pop eax
mov ecx, str.CLSID
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00409cec
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x411450
mov eax, esi
push edi
push edi
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3c]
push edi
push edi
push eax
push SysReAllocString
call fcn.0041b373
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x411471
lea eax, [ebp + 8]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
push dword [ebp - 0x3c]
call ebx
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
push 0x16
pop eax
mov ecx, str.SoftwareClassesCLSID
lea esi, [ebp - 0x2c]
call fcn.00409cec
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4114a0
mov eax, esi
push edi
push edi
push dword [ebp - 0x30]
mov esi, SysReAllocString
push edi
push edi
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041b373
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4114c2
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x3c]
call ebx
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
push edi
push edi
push dword [ebp - 0x30]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0041b373
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4114f6
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041b213
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
push edi
push edi
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3c]
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push ebx
call fcn.0041b373
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x411528
lea eax, [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push dword [ebp - 0x3c]
call ebx
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
push edi
push edi
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3c]
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace
push esi
call fcn.0041b373
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x41155d
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041b213
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
push edi
push edi
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3c]
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push esi
call fcn.0041b373
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x41158f
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x3c]
call ebx
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00409659
lea ecx, [ebp - 0x3c]
call fcn.0041b3db
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp + 8]
call fcn.00409659
call fcn.00527c65
ret 0x1c