Function at 0x419a23
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x414], 1
mov esi, ecx
mov dword [ebp - 0x40c], edi
call fcn.0041e14e
test eax, eax
jne 0x419e5b
test esi, esi
mov ecx, esi
setne al
mov dword [ebp - 0x414], eax
call fcn.00419737
push edi
lea eax, [ebp - 0x40c]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401e18
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
pop ebx
test eax, eax
jne 0x419aba
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
push edi
push 0x401e88
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x40c]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401ea8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419b12
cmp dword [ebp - 0x414], eax
push ebx
sete al
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x410]
push eax
push ebx
push edi
push 0x401f1c
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x40c]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401f30
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419b5b
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
push edi
push 0x401fc4
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x40c]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401fd8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419e5b
push ebx
lea eax, [ebp - 0x414]
mov dword [ebp - 0x414], 2
push eax
push ebx
push edi
push 0x402094
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x208]
call fcn.00425768
test eax, eax
je 0x419cf1
mov dword [ebp - 0x410], edi
jmp 0x419bc7
push 0x2c
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x208]
push 0x401718
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x419bc1
lea ecx, [ebp - 0x208]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x419be8
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x4020a4
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
jne 0x419ce1
push edi
lea eax, [ebp - 0x410]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401fd8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419cfb
lea ecx, [ebp - 0x208]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x419c51
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x4020a4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4020b4
mov edx, 0x100
lea ecx, [ebp - 0x208]
call fcn.00418392
lea ecx, [ebp - 0x208]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x419ca1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x4020b8
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x419cfb
push 0x401fd8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x414], edi
test esi, esi
jne 0x419d05
mov dword [ebp - 0x414], 1
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
push edi
push 0x4020c8
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0xff
lea ecx, [ebp - 0x208]
call fcn.00424ce1
test eax, eax
je 0x419e09
push ecx
test esi, esi
lea eax, [ebp - 0x410]
mov esi, 0x100
lea ecx, [ebp - 0x208]
push eax
mov edx, esi
je 0x419d62
call fcn.00418514
test eax, eax
js 0x419d8a
push ecx
push 0x4020e0
jmp 0x419d71
call fcn.00418514
test eax, eax
js 0x419d8a
push ecx
push 0x4020f4
mov eax, dword [ebp - 0x410]
mov edx, esi
push ecx
lea ecx, [ebp - 0x208]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.00418577
push esi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnExpandEnvStringsW]
test eax, eax
je 0x419dce
lea ecx, [ebp - 0x408]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x419dac
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x408]
push eax
push 2
jmp 0x419df7
lea ecx, [ebp - 0x208]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x419dd7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push 0x402108
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x40c]
push ebx
push 0x4020b4
push ecx
push ecx
push 0x4020b8
call fcn.00426347
mov edx, dword [ebp - 0x40c]
push 0x14
push 0x40211c
push ecx
push ecx
push 0x402130
call fcn.00426347
mov edx, dword [ebp - 0x40c]
push 0x2a
push 0x402148
push ecx
push ecx
push edi
call fcn.00426347
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret