Function at 0x41bc47
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x4cae27
call fcn.004bf1dc
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0x118]
mov edi, ecx
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x118], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor esi, esi
cmp dword [ebp - 0x108], 1
je 0x41bcd8
call fcn.0041aa31
test eax, eax
jne 0x41bcd8
lea eax, [ebp - 0x11]
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041dbef
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
push 0x2168
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0041a16a
mov eax, dword [ebp - 0x38]
mov ebx, 0x4d68e8
cmp eax, esi
jne 0x41bcba
mov eax, ebx
lea ecx, [edi + 0x184]
push esi
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00405d6e
jmp 0x41bcdd
mov ebx, 0x4d68e8
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x41bd7a
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x54]
push eax
call fcn.0041dbef
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
push 0x2166
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 1
call fcn.0041a16a
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041dbef
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push 0x2169
push eax
call fcn.0041c3cf
mov eax, dword [ebp - 0x50]
add esp, 0xc
cmp eax, esi
jne 0x41bd48
mov eax, ebx
cmp dword [ebp - 0x38], esi
je 0x41bd50
mov ebx, dword [ebp - 0x38]
push esi
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00405d6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00405d6e
mov eax, dword [ebp - 0x10]
jmp 0x41bfa0
mov ecx, edi
call fcn.0041d611
push esi
push 1
push 0x64
push edi
call fcn.0041896a
mov edi, eax
cmp edi, esi
jge 0x41be17
lea eax, [ebp - 0x11]
lea ecx, [ebp - 0x54]
push eax
call fcn.0041dbef
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
push 0x2166
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 3
call fcn.0041a16a
lea eax, [ebp - 0x21]
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041dbef
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
push edi
lea eax, [ebp - 0x3c]
push 0x216a
push eax
mov byte [ebp - 4], 4
call fcn.0041c3cf
mov eax, dword [ebp - 0x50]
add esp, 0xc
cmp eax, esi
jne 0x41bded
mov eax, ebx
cmp dword [ebp - 0x38], esi
je 0x41bdf5
mov ebx, dword [ebp - 0x38]
push esi
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00405d6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00405d6e
mov ecx, dword [ebp - 0x20]
push 1
call fcn.0041c86e
mov dword [ebp - 0x1c], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
mov ebx, 0x20006
push eax
push ebx
push esi
push str.AppID
push SysReAllocStringLen
mov dword [ebp - 4], 5
mov dword [ebp - 0x10], esi
call edi
cmp eax, esi
jne 0x41be61
lea ecx, [ebp - 0x1c]
call fcn.0041a724
mov ecx, dword [ebp - 0x10]
cmp eax, esi
mov dword [ebp - 0x1c], ecx
je 0x41be68
mov esi, eax
jmp 0x41bf96
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 6
push eax
push ebx
push esi
push str.568F3382_A756_11D3_9B07_0090275F67ED
push ecx
mov dword [ebp - 0x10], esi
call edi
mov edi, eax
cmp edi, esi
jne 0x41be9e
lea ecx, [ebp - 0x18]
call fcn.0041a724
mov edi, eax
mov eax, dword [ebp - 0x10]
cmp edi, esi
mov dword [ebp - 0x18], eax
je 0x41bf36
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0x6c]
push eax
call fcn.0041dbef
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
push 0x2166
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 7
call fcn.0041a16a
lea ecx, [ebp - 0x84]
call fcn.0041c3b1
push edi
lea eax, [ebp - 0x84]
push 0x216b
push eax
mov byte [ebp - 4], 8
call fcn.0041c3cf
mov ecx, dword [ebp - 0x68]
add esp, 0xc
cmp ecx, esi
jne 0x41bef1
mov ecx, 0x4d68e8
mov eax, dword [ebp - 0x80]
cmp eax, esi
jne 0x41befd
mov eax, 0x4d68e8
push esi
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.00405d6e
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.00405d6e
lea ecx, [ebp - 0x18]
call fcn.0041a724
lea ecx, [ebp - 0x1c]
call fcn.0041a724
mov eax, edi
jmp 0x41bfa0
mov edi, str.LocalService
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], esi
je 0x41bf70
push edi
push str.NMSSvc
lea ecx, [ebp - 0x18]
call fcn.0041bfb1
push str.ServiceParameters
push str._Service
lea ecx, [ebp - 0x18]
call fcn.0041bfb1
mov ecx, dword [ebp - 0x20]
call fcn.0041d1db
push esi
push dword [ebp + 8]
push dword [ebp - 0x20]
call fcn.0041bfd8
mov ecx, 0x5040a8
mov esi, eax
call fcn.0042f6d0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x18]
call fcn.0041a724
lea ecx, [ebp - 0x1c]
call fcn.0041a724
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8