Function at 0x41bba0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc14
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0xc10], eax
mov eax, dword [str.CLSID_]
mov cx, word [0x46e994]
mov dl, byte [0x46e996]
push esi
mov esi, dword [esp + 0xc1c]
push edi
xor edi, edi
push 0x3f9
mov dword [esp + 0x81c], eax
lea eax, [esp + 0x823]
push edi
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
mov word [esp + 0x828], cx
mov byte [esp + 0x82a], dl
call fcn.0044cf00
push 0x3ff
lea ecx, [esp + 0x429]
push edi
push ecx
mov byte [esp + 0x430], 0
call fcn.0044cf00
mov edx, dword [str.HKEY_CLASSES_ROOT_]
mov eax, dword [0x46e9a4]
mov ecx, dword [0x46e9a8]
mov dword [esp + 0x30], edx
mov edx, dword [0x46e9ac]
push 0x3ed
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], eax
mov ax, word [0x46e9b0]
mov dword [esp + 0x3c], ecx
mov cl, byte [0x46e9b2]
lea edx, [esp + 0x47]
push edi
push edx
mov dword [esp + 0x30], 0x400
mov word [esp + 0x4c], ax
mov byte [esp + 0x4e], cl
call fcn.0044cf00
add esp, 0x24
test esi, esi
je 0x41bdf8
mov eax, esi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41bc82
lea edi, [esp + 0x818]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x41bc97
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, eax
lea eax, [esp + 0xc]
push eax
and ecx, 3
push 0xf003f
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x828]
push ecx
push SysReAllocStringLen
call ebp
test eax, eax
jne 0x41bdcb
push 0x400
push eax
lea edx, [esp + 0x424]
push edx
call fcn.0044cf00
mov edx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x420]
push ecx
push str.ProgID
push edx
mov dword [esp + 0x20], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x41bd7f
lea eax, [esp + 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41bd22
sub eax, edx
cmp eax, 2
jl 0x41bdcb
lea eax, [esp + 0x41c]
mov edx, eax
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41bd40
lea edi, [esp + 0x1c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x41bd52
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x41c]
push eax
and ecx, 3
push SysReAllocStringLen
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41bd96
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push str.CLSID
push SysReAllocStringLen
call ebp
test eax, eax
jne 0x41bdcb
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
mov esi, 1
je 0x41bdcf
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
test eax, eax
pop ebp
je 0x41bddf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc10]
xor ecx, esp
call fcn.0044ce74
add esp, 0xc14
ret
mov ecx, dword [esp + 0xc18]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0044ce74
add esp, 0xc14
ret