Function at 0x41fd50
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x21c], 4
xor eax, eax
mov word [ebp - 0x220], ax
lea ecx, [ebp - 0x214]
push ecx
push 0x4344d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41febe
mov dword [ebp - 0x21c], 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.Type
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fde2
cmp dword [ebp - 4], 1
je 0x41fde0
movzx eax, word [ebp - 0x220]
or eax, 1
mov word [ebp - 0x220], ax
jmp 0x41fdf3
movzx ecx, word [ebp - 0x220]
or ecx, 2
mov word [ebp - 0x220], cx
mov dword [ebp - 0x21c], 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.ErrorControl
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fe40
cmp dword [ebp - 4], 1
je 0x41fe3e
movzx eax, word [ebp - 0x220]
or eax, 4
mov word [ebp - 0x220], ax
jmp 0x41fe51
movzx ecx, word [ebp - 0x220]
or ecx, 8
mov word [ebp - 0x220], cx
mov dword [ebp - 0x21c], 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.Start
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fe9e
cmp dword [ebp - 4], 3
je 0x41fe9c
movzx eax, word [ebp - 0x220]
or eax, 0x10
mov word [ebp - 0x220], ax
jmp 0x41feaf
movzx ecx, word [ebp - 0x220]
or ecx, 0x20
mov word [ebp - 0x220], cx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41fecf
movzx eax, word [ebp - 0x220]
or eax, 0x40
mov word [ebp - 0x220], ax
lea ecx, [ebp - 0x214]
push ecx
push 0x434570
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41ff82
mov dword [ebp - 0x21c], 0x100
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x43460c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ff60
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0041f6c0
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffff
jne 0x41ff5e
movzx edx, word [ebp - 0x220]
or edx, 0x80
mov word [ebp - 0x220], dx
jmp 0x41ff73
movzx eax, word [ebp - 0x220]
or eax, 0x100
mov word [ebp - 0x220], ax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41ff96
movzx edx, word [ebp - 0x220]
or edx, 0x200
mov word [ebp - 0x220], dx
lea eax, [ebp - 0x214]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_CompatibilityE787FD25_8D7C_4693_AE67_9406BC6E22DF
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41ffd0
push 0x4346ec
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_CompatibilityBAEA0695_03A4_43BB_8495_C7025E1A8F42
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42000a
push 0x4347b4
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [ebp - 0x220]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret