Function at 0x41b249
Capabilities:
Delete registry key

Disassembly:
push 0x1b0
mov eax, 0x46214a
call fcn.00450d90
xor ebx, ebx
mov dword [ebp - 0x1a4], ecx
mov esi, edx
mov dword [ebp - 0x1a8], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp esi, ebx
jne 0x41b277
jmp 0x41b4f2
mov eax, 0x46971c
call fcn.00412fd6
test eax, eax
je 0x41b28a
jmp 0x41b4f2
lea eax, [ebp - 0x1a8]
push eax
push 0x46d6a4
push edi
push ebx
push 0x46974c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x41b2ac
jmp 0x41b4f2
cmp dword [esi], ebx
mov eax, esi
mov dword [ebp - 0x1ac], eax
jne 0x41b516
cmp dword [ebp + 8], ebx
jne 0x41b4f2
push 0x40
lea eax, [ebp - 0x190]
push eax
push dword [ebp - 0x1a4]
call dword [sym.imp.ole32.dll_StringFromGUID2]
call dword [section..data]
mov dword [ebp - 0x1bc], ebx
mov byte [ebp - 4], 6
push str.CLSID_
mov esi, 0x80
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0044f907
push eax
call fcn.0040ad16
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0041b59b
push str.Required_Categories
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0044faec
push eax
call fcn.0040ad16
mov edi, SysReAllocString
add esp, 0x28
mov dword [ebp - 0x1b8], edi
mov byte [ebp - 4], 7
mov dword [ebp - 0x1a4], ebx
mov byte [ebp - 4], 8
lea eax, [ebp - 0x1ac]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x110]
push eax
push edi
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1ac], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41b3db
mov eax, dword [ebp - 0x1ac]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x1b4]
push ecx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0x1a4], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], eax
je 0x41b3bd
push dword [ebp - 0x1ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1a4], ebx
cmp dword [ebp - 0x1b0], ebx
jne 0x41b3db
cmp dword [ebp - 0x1b4], ebx
jne 0x41b3db
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.CLSID_
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0044f907
push eax
call fcn.0040ad16
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0041b59b
push str.Implemented_Categories
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0044faec
push eax
call fcn.0040ad16
add esp, 0x28
lea eax, [ebp - 0x1b0]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x110]
push eax
push edi
mov dword [ebp - 0x1b0], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41b4bf
xor eax, eax
cmp dword [ebp - 0x1a4], ebx
je 0x41b462
push dword [ebp - 0x1a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1a4], ebx
cmp eax, ebx
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a4], esi
jne 0x41b4bf
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1b4]
push eax
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp esi, ebx
mov dword [ebp - 0x1b0], eax
je 0x41b4a1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1a4], ebx
cmp dword [ebp - 0x1b0], ebx
jne 0x41b4bf
cmp dword [ebp - 0x1b4], ebx
jne 0x41b4bf
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 7
cmp dword [ebp - 0x1a4], ebx
je 0x41b4dd
push dword [ebp - 0x1a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1a4], ebx
mov byte [ebp - 4], 6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b8], ebx
mov byte [ebp - 4], 1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1a8]
cmp eax, ebx
je 0x41b506
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.00450e13
ret 4
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp + 8], ebx
mov esi, dword [eax + 4]
lea edi, [ebp - 0x1a0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x1a0]
movsd dword es:[edi], dword [esi]
push edx
push 1
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
je 0x41b56b
cmp dword [eax], 1
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
push eax
jne 0x41b54a
call dword [ecx + 0x14]
jmp 0x41b54d
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jge 0x41b581
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1a8]
cmp eax, ebx
je 0x41b567
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x41b508
cmp dword [eax], 1
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
push eax
jne 0x41b57e
call dword [ecx + 0x18]
jmp 0x41b581
call dword [ecx + 0x20]
add dword [ebp - 0x1ac], 8
mov eax, dword [ebp - 0x1ac]
cmp dword [eax], ebx
jne 0x41b510
jmp 0x41b2bc