Function at 0x412980
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60cb77
push eax
mov dword fs:[0], esp
sub esp, 0x82c
push ebx
call fcn.00445c70
neg eax
mov edx, dword [esp + 0x840]
lea ecx, [esp + 4]
sbb eax, eax
push ecx
and eax, 0x100
xor ebx, ebx
add eax, 0xf003f
push eax
push ebx
push 0x6bd6c4
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412d51
mov eax, dword [0x6ec748]
mov dword [esp + 0x14], 0x800
cmp eax, ebx
jne 0x4129e9
mov eax, 0x6ec74c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x30]
push ecx
push edx
push ebx
push ebx
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412a6b
lea ecx, [esp + 0x30]
push ecx
call fcn.005e0bcf
lea edx, [esp + 0x34]
push 0x6bd6bc
push edx
call fcn.005de985
add esp, 0xc
test eax, eax
jne 0x412a51
lea eax, [esp + 0x30]
push 0x6bd6b0
push eax
call fcn.005de985
add esp, 8
test eax, eax
jne 0x412a51
lea ecx, [esp + 0x30]
push 0x6bd6a4
push ecx
call fcn.005de985
add esp, 8
test eax, eax
je 0x412a6b
mov eax, dword [0x6ec748]
cmp eax, ebx
jne 0x412a5f
mov eax, 0x6ec74c
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ecx
mov word [esp + 0xc], bx
mov eax, dword [0x6ec738]
mov dword [esp + 0x838], ebx
cmp eax, ebx
jne 0x412a8f
mov eax, 0x6ec73c
mov edx, 0x6bd694
push ebp
push esi
push edi
test edx, edx
je 0x412b7c
cmp eax, ebx
je 0x412b7c
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov word [esp + 0x2c], bx
call fcn.004023e0
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x844], bl
call fcn.00401070
push 0x6bd694
lea ecx, [esp + 0x34]
call fcn.00402350
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x24]
mov byte [esp + 0x844], 2
call fcn.004023d0
push eax
call fcn.005de123
lea esi, [eax + esi + 2]
lea ebp, [esi + esi]
push ebp
call fcn.005f6c5c
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
je 0x412b55
mov ecx, ebp
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x24]
call fcn.004023d0
push eax
lea ecx, [esp + 0x34]
call fcn.004023d0
push eax
mov eax, dword [esp + 0x1c]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005de123
add esp, 0x14
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x844], bl
call fcn.00401070
lea ecx, [esp + 0x24]
mov byte [esp + 0x844], 0
call fcn.00401070
mov ecx, dword [esp + 0x14]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x20], 0x800
mov eax, ecx
jne 0x412b8e
lea eax, [esp + 0x18]
lea edx, [esp + 0x20]
lea ecx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x14]
push ecx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412be2
lea eax, [esp + 0x3c]
push eax
call fcn.005e0bcf
lea ecx, [esp + 0x40]
push 0x6bd6bc
push ecx
call fcn.005de985
add esp, 0xc
test eax, eax
je 0x412be2
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x412bd6
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [0x6ec738]
cmp eax, ebx
jne 0x412bf0
mov eax, 0x6ec73c
mov ecx, 0x6bd684
test ecx, ecx
je 0x412cc7
cmp eax, ebx
je 0x412cc7
push eax
lea ecx, [esp + 0x28]
call fcn.0040e020
lea ecx, [esp + 0x14]
mov byte [esp + 0x844], 3
call fcn.00401070
push 0x6bd684
lea ecx, [esp + 0x34]
call fcn.00402350
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x24]
mov byte [esp + 0x844], 4
call fcn.004023d0
push eax
call fcn.005de123
lea esi, [eax + esi + 2]
lea ebp, [esi + esi]
push ebp
call fcn.005f6c5c
mov edi, eax
add esp, 8
cmp edi, ebx
mov dword [esp + 0x14], edi
je 0x412ca5
mov ecx, ebp
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x24]
call fcn.004023d0
push eax
lea ecx, [esp + 0x34]
call fcn.004023d0
push eax
mov eax, dword [esp + 0x1c]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005de123
add esp, 0x14
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x844], 3
call fcn.00401070
lea ecx, [esp + 0x24]
mov byte [esp + 0x844], 0
call fcn.00401070
mov eax, dword [esp + 0x14]
pop edi
pop esi
cmp eax, ebx
mov dword [esp + 0x18], 0x800
pop ebp
jne 0x412cde
lea eax, [esp + 0xc]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x30]
push edx
mov edx, dword [esp + 8]
push ecx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412d32
lea eax, [esp + 0x30]
push eax
call fcn.005e0bcf
lea ecx, [esp + 0x34]
push 0x6bd6bc
push ecx
call fcn.005de985
add esp, 0xc
test eax, eax
je 0x412d32
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x412d26
lea eax, [esp + 0xc]
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x838], 0xffffffff
call fcn.00401070
mov ecx, dword [esp + 0x830]
pop ebx
mov dword fs:[0], ecx
add esp, 0x838
ret