Function at 0x41f1ae
Capabilities:
Delete registry value
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
push edi
push 0x4030ec
mov dword [ebp - 0x3e8], eax
xor esi, esi
mov dword [ebp - 0x3dc], eax
inc esi
mov dword [ebp - 0x3e4], eax
mov ebx, esi
lea eax, [ebp - 0x3d8]
mov dword [ebp - 0x3e0], esi
push 0xc7
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x3dc]
push eax
push 0x2001f
xor eax, eax
push eax
lea eax, [ebp - 0x3d8]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f36a
lea eax, [ebp - 0x3e4]
mov dword [ebp - 0x3e4], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x3e0]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f353
cmp dword [ebp - 0x3e0], esi
je 0x41f276
cmp dword [ebp - 0x3e0], 2
jne 0x41f353
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41f353
mov eax, ecx
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea ecx, [ebp - 0x248]
call fcn.0041e3eb
test eax, eax
jne 0x41f2b3
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f460
lea eax, [ebp - 0x3e4]
mov dword [ebp - 0x3e4], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x3e0]
push eax
xor eax, eax
push eax
push 0x4040a4
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f34f
cmp dword [ebp - 0x3e0], esi
je 0x41f2fb
cmp dword [ebp - 0x3e0], 2
jne 0x41f34f
lea ecx, [ebp - 0x248]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3e8]
jne 0x41f304
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x3e0]
xor eax, eax
push eax
push eax
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4040a4
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41f353
xor eax, eax
mov ebx, eax
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x41f36a
mov edx, edi
jmp 0x41f456
push edi
push 0x4040c0
lea eax, [ebp - 0x3d8]
push 0xc7
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x3dc]
xor ebx, ebx
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x3d8]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f460
lea eax, [ebp - 0x3e4]
mov dword [ebp - 0x3e4], 0x244
push eax
lea eax, [ebp - 0x248]
mov edi, 0x4040a4
push eax
lea eax, [ebp - 0x3e0]
push eax
push ebx
push edi
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f43e
cmp dword [ebp - 0x3e0], esi
je 0x41f3f4
cmp dword [ebp - 0x3e0], 2
jne 0x41f43e
push edi
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x248]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41f40a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x3e0]
push ebx
push ebx
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x41f440
mov esi, ebx
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41f460
lea edx, [ebp - 0x3d8]
mov ecx, SysReAllocString
call fcn.00426285
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret