Function at 0x411700
Capabilities:
Delete registry value
Manipulate boot configuration
Query or enumerate registry value

Disassembly:
sub esp, 0x728
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x724], eax
push esi
push edi
xor edi, edi
push 0xfe
lea eax, [esp + 0x1a]
push edi
push eax
mov word [esp + 0x20], di
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4117bc
test byte [0x4f1904], 1
jne 0x41177e
or dword [0x4f1904], 1
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x15c
add esi, 8
call fcn.00411350
mov edx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKey.
push 0x4f18dc
call edx
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x724]
xor ecx, esp
call fcn.00462b77
add esp, 0x728
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push str.SystemPartition
push eax
mov dword [esp + 0x24], 0x80
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411834
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x166
add esi, 8
call fcn.00411350
mov ecx, dword [esi]
push eax
push str._s:_Failed_to_RegQueryValueEx.
push edi
call ecx
mov edx, dword [esp + 0x18]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x724]
xor ecx, esp
call fcn.00462b77
add esp, 0x728
ret
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
push 0x206
lea ecx, [esp + 0x326]
push edi
push ecx
mov word [esp + 0x32c], di
call sub.ntdll.dll_memset
push 0x206
lea edx, [esp + 0x12a]
push edi
push edx
mov word [esp + 0x130], di
call sub.ntdll.dll_memset
push 0x206
lea eax, [esp + 0x546]
push edi
push eax
mov word [esp + 0x54c], di
call sub.ntdll.dll_memset
lea ecx, [esp + 0x3c]
push ecx
push str._s_boot.ini
lea edx, [esp + 0x34c]
call fcn.00404520
lea edx, [esp + 0x44]
push edx
push str._s_ntldr
lea edx, [esp + 0x14c]
call fcn.00404520
lea eax, [esp + 0x4c]
push eax
push str._s_bootmgr
lea edx, [esp + 0x564]
call fcn.00404520
add esp, 0x3c
test byte [0x4f190c], 1
jne 0x4118f2
or dword [0x4f190c], 1
mov dword [0x4f1908], 0x4db424
mov edx, dword [0x4f1908]
mov eax, dword [edx + 0x64]
push 0x80000000
lea ecx, [esp + 0x324]
push ecx
mov ecx, 0x4f1908
call eax
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41193f
push eax
call esi
mov edx, dword [0x4f1908]
mov eax, dword [edx + 0x64]
push 0x80000000
lea ecx, [esp + 0x11c]
push ecx
mov ecx, 0x4f1908
call eax
cmp eax, 0xffffffff
jne 0x411961
mov edx, dword [0x4f1908]
mov eax, dword [edx + 0x64]
push 0x80000000
lea ecx, [esp + 0x52c]
push ecx
mov ecx, 0x4f1908
call eax
cmp eax, 0xffffffff
je 0x411981
push eax
call esi
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x724]
xor ecx, esp
call fcn.00462b77
add esp, 0x728
ret
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push edi
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4119ca
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x18f
add esi, 8
call fcn.00411350
mov edx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKeyEx.
push edi
call edx
add esp, 0x10
jmp 0x4119e1
mov eax, dword [esp + 0xc]
push str.SystemPartition
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
mov ecx, dword [esp + 0x730]
pop ebx
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00462b77
add esp, 0x728
ret