Function at 0x419b73
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.0043f3bf
push 4
pop esi
or word [ebp - 0x14], si
lea ecx, [ebp - 0x1c]
call fcn.0041999e
mov ebx, 0x4035e4
test eax, eax
js 0x419be0
lea eax, [ebp - 4]
push eax
push 3
push edi
push dword [ebp - 0x1c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419be0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x403600
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401690
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419d9d
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x403600
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x40357c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [0x443f48]
neg eax
mov dword [ebp - 0x10], esi
sbb eax, eax
and dword [0x443f5c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x40359c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419c6d
cmp dword [ebp - 8], esi
jne 0x419c6d
mov eax, dword [ebp - 0xc]
mov dword [0x443f78], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x4036b8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419ca9
cmp dword [ebp - 8], esi
jne 0x419c9b
mov al, byte [ebp - 0xc]
and al, 1
jmp 0x419ca4
cmp dword [ebp - 8], 3
jne 0x419ca9
mov al, byte [ebp - 0xc]
mov byte [0x443f88], al
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x4035c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419cd8
cmp dword [ebp - 8], esi
jne 0x419cd8
mov eax, dword [ebp - 0xc]
mov dword [0x443f80], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403628
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d07
cmp dword [ebp - 8], esi
jne 0x419d07
mov eax, dword [ebp - 0xc]
mov dword [0x443f4c], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403648
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d36
cmp dword [ebp - 8], esi
jne 0x419d36
mov eax, dword [ebp - 0xc]
mov dword [0x443f84], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403670
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d65
cmp dword [ebp - 8], esi
jne 0x419d65
mov eax, dword [ebp - 0xc]
mov dword [0x443f60], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403690
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d94
cmp dword [ebp - 8], esi
jne 0x419d94
mov eax, dword [ebp - 0xc]
mov dword [0x443f64], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00420610
lea ecx, [ebp - 0x1c]
call fcn.0043f743
pop edi
pop esi
pop ebx
leave
ret