Function at 0x41ab60
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x680
mov eax, dword [0x475280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x620], 0
push 0x403c38
push 0
call fcn.0041bc10
add esp, 8
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x630], 0
movzx eax, byte [0x475a88]
test eax, eax
je 0x41abb9
mov dword [ebp - 0x630], 0x403c80
jmp 0x41abda
movzx ecx, byte [0x475a81]
test ecx, ecx
je 0x41abd0
mov dword [ebp - 0x630], 0x403d38
jmp 0x41abda
mov dword [ebp - 0x630], 0x403df0
mov edx, dword [ebp - 0x630]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
je 0x41ac21
cmp dword [ebp - 0x624], 2
je 0x41ac21
mov dword [ebp - 0x620], 0x80004005
cmp dword [ebp - 0x620], 0
jge 0x41ac21
jmp 0x41b2b9
push 0
lea eax, [ebp - 0x628]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov ecx, dword [ebp - 0x630]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x624], eax
mov edx, dword [ebp - 0x624]
push edx
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41ac74
jmp 0x41b2b9
mov dword [ebp - 0x634], 0x404674
mov eax, dword [ebp - 0x634]
add eax, 2
mov dword [ebp - 0x65c], eax
mov ecx, dword [ebp - 0x634]
mov dx, word [ecx]
mov word [ebp - 0x646], dx
add dword [ebp - 0x634], 2
cmp word [ebp - 0x646], 0
jne 0x41ac8d
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0x65c]
sar eax, 1
mov dword [ebp - 0x660], eax
mov ecx, dword [ebp - 0x660]
lea edx, [ecx + ecx + 2]
push edx
push 0x404674
push 1
push 0
push 0x403ea8
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
push ecx
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41ad13
jmp 0x41b2b9
push 0x404674
push 0x403ec0
push 0
call fcn.0041bc10
add esp, 0xc
mov dword [ebp - 0x62c], 0
movzx edx, byte [0x475a88]
test edx, edx
je 0x41ad6e
lea eax, [ebp - 0x62c]
push eax
mov edx, 0x30
mov ecx, dword [0x475a9c]
call fcn.00424c8a
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41ad6c
jmp 0x41b2b9
jmp 0x41addb
movzx ecx, byte [0x475a81]
test ecx, ecx
je 0x41adab
lea edx, [ebp - 0x62c]
push edx
mov edx, 0x31
mov ecx, dword [0x475a9c]
call fcn.00424c8a
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41ada9
jmp 0x41b2b9
jmp 0x41addb
lea eax, [ebp - 0x62c]
push eax
mov edx, 0x2c
mov ecx, dword [0x475a9c]
call fcn.00424c8a
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41addb
jmp 0x41b2b9
mov ecx, dword [ebp - 0x62c]
mov dword [ebp - 0x638], ecx
mov edx, dword [ebp - 0x638]
add edx, 2
mov dword [ebp - 0x664], edx
mov eax, dword [ebp - 0x638]
mov cx, word [eax]
mov word [ebp - 0x648], cx
add dword [ebp - 0x638], 2
cmp word [ebp - 0x648], 0
jne 0x41adf6
mov edx, dword [ebp - 0x638]
sub edx, dword [ebp - 0x664]
sar edx, 1
mov dword [ebp - 0x668], edx
mov eax, dword [ebp - 0x668]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 0x62c]
push edx
push 1
push 0
push 0x403f04
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
push ecx
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41ae7e
jmp 0x41b2b9
mov edx, dword [ebp - 0x62c]
push edx
push 0x403f20
push 0
call fcn.0041bc10
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x404650
push 0x104
lea edx, [ebp - 0x414]
push edx
call fcn.004118d0
add esp, 0x10
test eax, eax
jl 0x41af88
lea eax, [ebp - 0x414]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
add ecx, 2
mov dword [ebp - 0x66c], ecx
mov edx, dword [ebp - 0x63c]
mov ax, word [edx]
mov word [ebp - 0x64a], ax
add dword [ebp - 0x63c], 2
cmp word [ebp - 0x64a], 0
jne 0x41aeea
mov ecx, dword [ebp - 0x63c]
sub ecx, dword [ebp - 0x66c]
sar ecx, 1
mov dword [ebp - 0x670], ecx
mov edx, dword [ebp - 0x670]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 1
push 0
push 0x403f68
mov edx, dword [ebp - 0x628]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
push eax
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41af72
jmp 0x41b2b9
lea ecx, [ebp - 0x414]
push ecx
push 0x403f80
push 0
call fcn.0041bc10
add esp, 0xc
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
lea edx, [ebp - 0x654]
push edx
lea edx, [ebp - 0x658]
mov ecx, dword [ebp + 8]
call fcn.00424a54
test eax, eax
jl 0x41b0ee
push 0x208
push 0
lea eax, [ebp - 0x61c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x654]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x654]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x658]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x658]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push 0x40465c
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.004118d0
add esp, 0x1c
test eax, eax
jl 0x41b0ee
lea ecx, [ebp - 0x61c]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x674], edx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x64c], cx
add dword [ebp - 0x640], 2
cmp word [ebp - 0x64c], 0
jne 0x41b050
mov edx, dword [ebp - 0x640]
sub edx, dword [ebp - 0x674]
sar edx, 1
mov dword [ebp - 0x678], edx
mov eax, dword [ebp - 0x678]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 1
push 0
push 0x403fc8
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
push ecx
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41b0d8
jmp 0x41b2b9
lea edx, [ebp - 0x61c]
push edx
push 0x403fe8
push 0
call fcn.0041bc10
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
movzx ecx, byte [0x475a88]
test ecx, ecx
je 0x41b134
mov edx, dword [ebp + 8]
push edx
push 0x404550
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004118d0
add esp, 0x10
mov dword [ebp - 0x620], eax
jmp 0x41b187
movzx ecx, byte [0x475a81]
test ecx, ecx
je 0x41b164
mov edx, dword [ebp + 8]
push edx
push 0x4046a8
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004118d0
add esp, 0x10
mov dword [ebp - 0x620], eax
jmp 0x41b187
mov ecx, dword [ebp + 8]
push ecx
push 0x404580
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004118d0
add esp, 0x10
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jl 0x41b24f
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x644], eax
mov ecx, dword [ebp - 0x644]
add ecx, 2
mov dword [ebp - 0x67c], ecx
mov edx, dword [ebp - 0x644]
mov ax, word [edx]
mov word [ebp - 0x64e], ax
add dword [ebp - 0x644], 2
cmp word [ebp - 0x64e], 0
jne 0x41b1af
mov ecx, dword [ebp - 0x644]
sub ecx, dword [ebp - 0x67c]
sar ecx, 1
mov dword [ebp - 0x680], ecx
mov edx, dword [ebp - 0x680]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0
push 0x404038
mov edx, dword [ebp - 0x628]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
push eax
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41b237
jmp 0x41b2b9
lea ecx, [ebp - 0x20c]
push ecx
push 0x404058
push 0
call fcn.0041bc10
add esp, 0xc
jmp 0x41b263
push 0x4040a8
mov edx, dword [ebp - 0x620]
push edx
call fcn.0041ba40
add esp, 8
push 4
push 0x4046e8
push 4
push 0
push 0x404108
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
push ecx
call fcn.00411710
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jge 0x41b2a5
jmp 0x41b2b9
push 0x1400
push 0x404128
push 0
call fcn.0041bc10
add esp, 0xc
cmp dword [ebp - 0x628], 0
je 0x41b2cf
mov edx, dword [ebp - 0x628]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471d10
mov esp, ebp
pop ebp
ret 4