Function at 0x411641
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x408], 0
and dword [ebp - 0x410], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x418], edx
xor edi, edi
mov dword [ebp - 0x41c], esi
inc edi
call fcn.00411be7
push 0x3d
pop ecx
call fcn.00411d9a
test eax, eax
je 0x411936
call fcn.00411be7
push 0x100
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x40c], ebx
test ebx, ebx
jne 0x4116ba
mov dword [0x41edf0], 0x84
jmp 0x41193b
push 0x22
pop ecx
call fcn.00411d9a
test eax, eax
je 0x411702
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.0041194a
test eax, eax
je 0x4116ee
call fcn.00411b6b
test eax, eax
jne 0x4116fa
xor edi, edi
mov dword [ebp - 0x408], 1
xor esi, esi
inc esi
jmp 0x41187c
mov ecx, dword [0x402024]
call fcn.00411d9a
test eax, eax
je 0x411783
movzx eax, word [0x402026]
mov esi, 0x402026
test ax, ax
je 0x41174e
mov ecx, eax
call fcn.00411d9a
lea esi, [esi + 2]
test eax, eax
jne 0x41173c
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x411724
test edi, edi
je 0x411926
call fcn.00411be7
mov ecx, ebx
call fcn.00411add
test eax, eax
je 0x411767
call fcn.00411b6b
test eax, eax
jne 0x411773
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x40c]
push 4
pop ebx
mov esi, ebx
jmp 0x41188e
push 0x2d
pop ecx
call fcn.00411d9a
test eax, eax
je 0x4117b9
call fcn.00411b6b
test eax, eax
jne 0x4117a7
mov dword [ebp - 0x408], 1
jmp 0x411926
push dword [ebp - 0x418]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x411926
movzx eax, word [0x40201c]
mov esi, 0x40201c
test ax, ax
je 0x4117f6
mov ecx, eax
call fcn.00411d9a
lea esi, [esi + 2]
test eax, eax
jne 0x4117e4
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4117cc
test edi, edi
je 0x411926
push 0x28
pop ecx
call fcn.00411d9a
test eax, eax
je 0x411831
lea ecx, [ebp - 0x410]
call fcn.00411add
test eax, eax
je 0x41181d
push 0x29
pop ecx
call fcn.00411d9a
test eax, eax
jne 0x411829
xor edi, edi
mov dword [ebp - 0x408], 1
mov esi, dword [ebp - 0x410]
jmp 0x411834
push 3
pop esi
test edi, edi
je 0x411926
push 0x3a
pop ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.00411d9a
test eax, eax
je 0x411870
lea ecx, [ebp - 0x414]
call fcn.0049cf27
test eax, eax
je 0x411870
call fcn.00411b6b
test eax, eax
jne 0x41187c
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x414]
mov ebx, dword [ebp - 0x410]
mov dword [ebp - 0x40c], eax
test edi, edi
je 0x411920
cmp dword [0x41edf4], 0x500
jae 0x411901
cmp esi, 2
je 0x4118ac
cmp esi, 7
jne 0x411901
xor ecx, ecx
lea eax, [ebp - 0x404]
push ecx
push ecx
push 0x400
push eax
push 0xffffffffffffffff
push dword [ebp - 0x418]
mov byte [ebp - 0x404], cl
push ecx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push ebx
push esi
push 0
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x411926
mov dword [0x41edf0], 0x84
jmp 0x411926
push ebx
push eax
push esi
push 0
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp - 0x40c]
jmp 0x4118f1
mov ebx, dword [ebp - 0x40c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x408], 0
je 0x41193b
call fcn.00411c13
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ca70
leave
ret