Function at 0x414f02
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x47d949
call fcn.00402847
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x18]
push eax
push 0x4148c8
push 0x17
push edi
push 0x4149a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x41a51e
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
cmp dword [ebp - 0x18], edi
je 0x414fa6
lea eax, [ebp - 0x44]
push eax
call ebx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 4
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x41a533
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edi, edi
cmp dword [ebp - 0x10], edi
jl 0x415123
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x18], edi
je 0x414feb
push 0x4152a0
lea ecx, [ebp - 0x24]
call fcn.00414ecf
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
call dword [ecx + 0x1c]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x41a548
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x10], edi
jl 0x415123
cmp dword [ebp - 0x20], edi
je 0x41502a
push 0x415294
lea ecx, [ebp - 0x24]
call fcn.00414ecf
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x24]
mov byte [ebp - 4], 6
push eax
call dword [ecx + 0x34]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x41a55d
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x10], edi
jl 0x415123
cmp dword [ebp - 0x1c], edi
je 0x415072
lea eax, [ebp - 0x44]
push eax
call ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 7
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x30]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x41a572
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edi, edi
cmp dword [ebp - 0x10], edi
jl 0x415123
cmp dword [ebp - 0x28], edi
je 0x415123
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push 0x415200
push 0x80000002
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x41a607
cmp dword [ebp - 0x14], edi
je 0x41a607
mov dword [ebp - 0x2c], edi
mov ebx, 0x4151e4
mov edi, 0xf0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x24]
push ecx
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41a587
push dword [ebp - 0x24]
push 0x415170
push 8
call fcn.004015a0
mov eax, dword [ebp - 0x24]
add esp, 0xc
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x415123
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 2
cmp eax, edi
je 0x415134
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x415145
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
cmp eax, edi
je 0x415156
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x415167
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
call fcn.00402881
ret
push eax
push 0x41aa10
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x415123
push eax
push 0x41a9a0
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x414f9a
push eax
push 0x41a930
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x414fe6
push eax
push 0x41a8c0
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x415025
push eax
push 0x41a858
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x415066
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + 1]
mov dword [ebp - 0x2c], eax
cmp eax, edi
jae 0x41a5c7
cmp esi, 2
jne 0x41a5e1
push ecx
push 0x41a7d0
push 1
call fcn.004015a0
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp eax, edi
jae 0x415113
jmp 0x4150c1
push 0x41a768
push 1
call fcn.004015a0
pop ecx
pop ecx
mov dword [ebp - 0x10], 0x80004005
jmp 0x415113
push esi
push 0x41a6c8
push 1
call fcn.004015a0
add esp, 0xc
test esi, esi
jg 0x41a5f9
xor edi, edi
jmp 0x41a627
and esi, 0xffff
or esi, 0x80070000
jmp 0x41a5f5
push esi
push 0x41a630
push 1
call fcn.004015a0
add esp, 0xc
cmp esi, edi
jle 0x41a627
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0x10], esi
jmp 0x415115