Function at 0x411e2d
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x4242b4]
push ebx
mov dword [ebp - 0x378], ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x380], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x37c], ecx
lea ecx, [ebp - 0x368]
push ecx
push 0x20019
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 0x374], eax
mov byte [ebp - 0x361], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x41206a
cmp esi, ebx
mov dword [ebp - 0x36c], 0x104
je 0x411ef3
cmp byte [esi], bl
je 0x411ef3
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x404fc8
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x411fa0
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
lea eax, [ebp - 0x108]
push eax
jne 0x411f91
push 0x404fa0
call fcn.0040be00
pop ecx
pop ecx
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x404f8c
push dword [ebp - 0x368]
mov dword [ebp - 0x36c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x41203e
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0041af50
cmp eax, ebx
pop ecx
pop ecx
je 0x411f42
inc eax
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
lea eax, [ebp - 0x108]
push 0x404f7c
push eax
call fcn.0041b470
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x108]
je 0x412036
push ebx
push 0x404f74
push eax
push 0x401820
lea eax, [ebp - 0x360]
push 0x258
push eax
call fcn.0041ae94
add esp, 0x18
test eax, eax
jge 0x411fd4
push 0x404f48
jmp 0x412048
push 0x404ef8
call fcn.0040be00
xor ebx, ebx
inc ebx
jmp 0x411fbf
cmp eax, 2
jne 0x411fb4
push 0x404ea8
call fcn.0040be00
xor ebx, ebx
inc ebx
jmp 0x411fc0
push eax
push 0x404e68
call fcn.0040be00
pop ecx
pop ecx
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4121d2
call fcn.0040daba
test eax, eax
jne 0x41202d
lea eax, [ebp - 0x360]
push eax
push 0x404e3c
call fcn.0040be00
pop ecx
pop ecx
mov ecx, dword [ebp - 0x378]
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.0041098f
test eax, eax
je 0x412026
push dword [ebp - 0x370]
push 0x404e1c
call fcn.0040be00
mov byte [ebp - 0x361], 1
jmp 0x41205a
push 0x404df4
jmp 0x412048
mov byte [ebp - 0x361], 1
jmp 0x41205c
push eax
push 0x404dc0
jmp 0x412055
cmp eax, 2
jne 0x41204f
push 0x404d84
call fcn.0040be00
jmp 0x41205b
push eax
push 0x404e68
call fcn.0040be00
pop ecx
pop ecx
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412077
push eax
push 0x404d4c
call fcn.0040be00
pop ecx
pop ecx
call fcn.0040daba
test eax, eax
je 0x412178
cmp byte [ebp - 0x361], bl
je 0x4121cb
push edi
push dword [ebp - 0x374]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmp eax, ebx
jne 0x412165
push 0x404d30
push edi
push 0x404b70
call fcn.0040be00
add esp, 0xc
push edi
push 0x404cfc
call fcn.00411da5
push edi
push 0x404cc8
call fcn.00411da5
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
lea eax, [ebp - 0x108]
push 0x404cb0
push eax
call fcn.0041b470
cmp eax, ebx
pop ecx
pop ecx
je 0x412152
mov byte [eax], bl
lea eax, [ebp - 0x108]
push eax
call fcn.0040c022
test eax, eax
lea eax, [ebp - 0x108]
push eax
jne 0x41214b
push edi
call fcn.0040cc94
test eax, eax
je 0x41213f
lea eax, [ebp - 0x108]
push eax
push 0x404c90
call fcn.0040be00
mov eax, dword [ebp - 0x378]
add eax, 0x178
cmp dword [eax], ebx
pop ecx
pop ecx
jne 0x412178
mov dword [eax], 1
jmp 0x412178
push 0x404c5c
call fcn.0040be00
jmp 0x412177
push 0x404c4c
jmp 0x41215e
lea eax, [ebp - 0x108]
push eax
push 0x404c0c
call fcn.0040be00
jmp 0x412176
push eax
push 0x404bd4
call fcn.0040be00
mov byte [ebp - 0x361], bl
pop ecx
pop ecx
cmp byte [ebp - 0x361], bl
je 0x4121cb
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x370]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x374]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
jne 0x4121be
mov ecx, dword [ebp - 0x380]
mov eax, dword [ecx]
dec eax
cmp dword [ebp - 0x370], eax
jne 0x4121cb
mov dword [ecx], eax
mov eax, dword [ebp - 0x37c]
dec dword [eax]
jmp 0x4121cb
push eax
push 0x404b98
call fcn.0040be00
pop ecx
pop ecx
movzx eax, byte [ebp - 0x361]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041a84f
leave
ret 0x14