Function at 0x419928
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x451220]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0x628], ebx
call fcn.00429ac0
add esp, 0xc
push 0x10
pop ecx
mov esi, str.SOFTWARE360Safe360ScanXDQuery
lea edi, [ebp - 0x418]
rep movsd dword es:[edi], dword [esi]
push 0x1c6
lea eax, [ebp - 0x3d6]
push ebx
push eax
mov dword [ebp - 0x624], ebx
movsw word es:[edi], word [esi]
call fcn.00429ac0
add esp, 0xc
lea esi, [ebp - 0x664]
call fcn.00404d28
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x418]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00409cd3
test eax, eax
jne 0x419c00
mov edi, 0x4478c4
mov ebx, dword [ebp - 0x628]
push 0x3d
pop esi
call fcn.004056bf
push 0x104
test eax, eax
je 0x4199ea
lea ecx, [ebp - 0x210]
push ecx
push dword [ebp - 0x624]
push ebx
call eax
jmp 0x4199fe
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x624]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc dword [ebp - 0x624]
test eax, eax
jne 0x419ba1
and dword [ebp - 0x62c], eax
lea eax, [ebp - 0x210]
push eax
push edi
lea eax, [ebp - 0x418]
push eax
lea esi, [ebp - 0x64c]
call fcn.00406e38
lea ecx, [ebp - 0x644]
call fcn.0041a774
pop ecx
lea ecx, [ebp - 0x638]
call fcn.0041a774
mov eax, dword [eax]
pop ecx
lea ecx, [ebp - 0x62c]
push ecx
push eax
call fcn.004056ec
mov esi, eax
mov eax, dword [ebp - 0x638]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
call fcn.00406e8b
test esi, esi
jne 0x419ba1
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.00429ac0
add esp, 0xc
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x630]
push eax
push 0x44d570
push dword [ebp - 0x62c]
mov dword [ebp - 0x648], 0x208
call fcn.004099bf
push dword [ebp - 0x62c]
mov esi, eax
call fcn.004055a6
test esi, esi
jne 0x419ba1
cmp dword [ebp - 0x630], 1
jne 0x419ba1
lea eax, [ebp - 0x620]
push eax
call fcn.00428d23
pop ecx
push 0
mov esi, eax
mov ebx, edx
call fcn.0042833e
pop ecx
push 0
sub eax, esi
push 0x15180
sbb edx, ebx
push edx
push eax
call fcn.0043fa50
test edx, edx
jl 0x4199c1
jg 0x419b34
cmp eax, 0xf
jbe 0x4199c1
lea eax, [ebp - 0x210]
push eax
push edi
lea eax, [ebp - 0x418]
push eax
lea esi, [ebp - 0x634]
call fcn.00406e38
lea ecx, [ebp - 0x640]
call fcn.0041a774
pop ecx
lea ecx, [ebp - 0x63c]
call fcn.0041a774
pop ecx
push eax
lea eax, [ebp - 0x664]
call fcn.00408c29
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
call fcn.00406e8b
jmp 0x4199c1
push dword [ebp - 0x628]
call fcn.004055a6
mov eax, dword [ebp - 0x654]
sub eax, dword [ebp - 0x658]
xor ebx, ebx
sar eax, 2
test eax, eax
jbe 0x419c00
mov edi, ebx
lea esi, [ebp - 0x664]
call fcn.0040cc70
mov edi, dword [eax]
push 0x39
pop esi
call fcn.004056bf
push edi
push reloc.OLEAUT32.dll_SysReAllocString
test eax, eax
je 0x419be6
call eax
jmp 0x419bec
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x654]
sub eax, dword [ebp - 0x658]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x419bc1
lea esi, [ebp - 0x664]
call fcn.00404eaa
push dword [ebp - 0x664]
call fcn.0042751c
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427527
leave
ret