Function at 0x41a4bf
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x214], ebx
cmp dword [0x444f40], ebx
je 0x41a549
call fcn.00419a8a
call fcn.00419f17
cmp dword [0x444f44], ebx
je 0x41a572
cmp dword [0x444f3c], ebx
je 0x41a572
call fcn.0041c934
test eax, eax
je 0x41a572
push ebx
call fcn.0041c934
mov ecx, eax
call fcn.00430f1a
test eax, eax
je 0x41a52c
push ebx
call fcn.0041c934
mov ecx, eax
call fcn.00430f1a
jmp 0x41a538
call fcn.0041c934
mov ecx, eax
call fcn.00430e7b
mov esi, eax
call fcn.0041c934
push esi
mov ecx, eax
call fcn.0042ec4b
jmp 0x41a566
test edi, edi
je 0x41a572
cmp dword [0x444f44], ebx
je 0x41a572
cmp dword [0x444f3c], ebx
je 0x41a572
call fcn.0041c934
test eax, eax
je 0x41a572
call fcn.0041c934
mov ecx, eax
call fcn.004311ac
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
push 2
pop eax
push eax
push ebx
push ebx
push ebx
push 0x401680
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, 0x401b9c
push 4
pop esi
test eax, eax
jne 0x41a5e6
mov dword [ebp - 0x218], 1
cmp dword [0x443a4c], ebx
jne 0x41a5cd
test edi, edi
je 0x41a5da
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push ebx
push ecx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x41a5da
push ecx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x224]
call fcn.0043fdcb
or word [ebp - 0x21c], si
lea ecx, [ebp - 0x224]
call fcn.00419aff
test eax, eax
js 0x41a69d
lea eax, [ebp - 0x214]
push eax
push 3
push ebx
push dword [ebp - 0x224]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a69d
mov dword [ebp - 0x218], 1
cmp dword [0x443a4c], ebx
jne 0x41a65d
test edi, edi
je 0x41a68b
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push ebx
push 0x401b9c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x41a66e
push 0x401b9c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x41a68b
push esi
push 0x444f5c
push esi
push ebx
push 0x4035d4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], ebx
test edi, edi
je 0x41a7a6
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x401680
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41a7a1
push esi
push 0x444f78
push esi
push ebx
push 0x40358c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0x444f88
push 3
push ebx
push 0x4036a8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 0x444f80
push esi
push ebx
push 0x4035b0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 0x444f5c
push esi
push ebx
push 0x4035d4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 0x444f4c
push esi
push ebx
push 0x403618
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 0x444f84
push esi
push ebx
push 0x403638
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 0x444f60
push esi
push ebx
push 0x403660
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 0x444f64
push esi
push ebx
push 0x403680
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042089d
mov ecx, dword [0x444f6c]
xor eax, eax
mov word [ebp - 0x210], ax
test ecx, ecx
je 0x41a812
mov word [ebp - 0x210], ax
mov edx, dword [ecx + 0x30]
test edx, edx
je 0x41a7cd
cmp word [edx], bx
setne al
test al, al
je 0x41a7eb
push 0x104
lea eax, [ebp - 0x210]
push eax
lea ecx, [ecx + 0x30]
call fcn.0044031e
mov ecx, dword [0x444f6c]
call fcn.0041d8ad
mov eax, dword [0x444f6c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x446624]
call esi
mov ax, word [ebp - 0x210]
mov dword [0x444f6c], ebx
test edi, edi
je 0x41a8d8
test ax, ax
je 0x41a8bc
lea eax, [ebp - 0x210]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x41a8bc
push 0x22
pop eax
cmp ax, word [ebp - 0x210]
je 0x41a8bc
lea ecx, [ebp - 0x210]
push 2
lea edx, [ecx + 2]
pop esi
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x41a854
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 5]
xor ecx, ecx
mov eax, edi
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x41a8a8
lea eax, [ebp - 0x210]
push eax
push 0x4042b8
push edi
push esi
call fcn.0040c0b5
add esp, 0x10
lea ecx, [ebp - 0x210]
mov edx, 0x104
push esi
call fcn.0040c010
jmp 0x41a8b1
xor eax, eax
mov word [ebp - 0x210], ax
test esi, esi
je 0x41a8bc
push esi
call fcn.00441807
pop ecx
cmp dword [0x443518], ebx
je 0x41a8d3
lea ecx, [ebp - 0x210]
call fcn.0041a031
test eax, eax
jne 0x41a8d8
call fcn.00422e41
test byte [0x443a40], 1
je 0x41a8ed
push 1
mov edx, 0x4034f8
call fcn.0040c514
lea ecx, [ebp - 0x224]
call fcn.00440156
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret