Function at 0x412631
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x41f024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x408], 0
and dword [ebp - 0x410], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x418], edx
xor edi, edi
mov dword [ebp - 0x41c], esi
inc edi
call fcn.00412bf9
push 0x3d
pop ecx
call fcn.00412dbf
test eax, eax
je 0x412926
call fcn.00412bf9
push 0x100
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x40c], ebx
test ebx, ebx
jne 0x4126aa
mov dword [0x41fe18], 0x84
jmp 0x41292b
push 0x22
pop ecx
call fcn.00412dbf
test eax, eax
je 0x4126f2
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.00412940
test eax, eax
je 0x4126de
call fcn.00412b77
test eax, eax
jne 0x4126ea
xor edi, edi
mov dword [ebp - 0x408], 1
xor esi, esi
inc esi
jmp 0x41286c
mov ecx, dword [0x401fec]
call fcn.00412dbf
test eax, eax
je 0x412773
movzx eax, word [0x401fee]
mov esi, 0x401fee
test ax, ax
je 0x41273e
mov ecx, eax
lea esi, [esi + 2]
call fcn.00412dbf
test eax, eax
jne 0x41272c
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x412714
test edi, edi
je 0x412916
call fcn.00412bf9
mov ecx, ebx
call fcn.00412add
test eax, eax
je 0x412757
call fcn.00412b77
test eax, eax
jne 0x412763
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x40c]
push 4
pop ebx
mov esi, ebx
jmp 0x41287e
push 0x2d
pop ecx
call fcn.00412dbf
test eax, eax
je 0x4127a9
call fcn.00412b77
test eax, eax
jne 0x412797
mov dword [ebp - 0x408], 1
jmp 0x412916
push dword [ebp - 0x418]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x412916
movzx eax, word [0x401fe4]
mov esi, 0x401fe4
test ax, ax
je 0x4127e6
mov ecx, eax
lea esi, [esi + 2]
call fcn.00412dbf
test eax, eax
jne 0x4127d4
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4127bc
test edi, edi
je 0x412916
push 0x28
pop ecx
call fcn.00412dbf
test eax, eax
je 0x412821
lea ecx, [ebp - 0x410]
call fcn.00412add
test eax, eax
je 0x41280d
push 0x29
pop ecx
call fcn.00412dbf
test eax, eax
jne 0x412819
xor edi, edi
mov dword [ebp - 0x408], 1
mov esi, dword [ebp - 0x410]
jmp 0x412824
push 3
pop esi
test edi, edi
je 0x412916
push 0x3a
pop ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.00412dbf
test eax, eax
je 0x412860
lea ecx, [ebp - 0x414]
call fcn.00412a1a
test eax, eax
je 0x412860
call fcn.00412b77
test eax, eax
jne 0x41286c
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x414]
mov ebx, dword [ebp - 0x410]
mov dword [ebp - 0x40c], eax
test edi, edi
je 0x412910
cmp dword [0x41fe1c], 0x500
jae 0x4128f1
cmp esi, 2
je 0x41289c
cmp esi, 7
jne 0x4128f1
xor ecx, ecx
lea eax, [ebp - 0x404]
push ecx
push ecx
push 0x400
push eax
push 0xffffffffffffffff
push dword [ebp - 0x418]
mov byte [ebp - 0x404], cl
push ecx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push ebx
push esi
push 0
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x412916
mov dword [0x41fe18], 0x84
jmp 0x412916
push ebx
push eax
push esi
push 0
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp - 0x40c]
jmp 0x4128e1
mov ebx, dword [ebp - 0x40c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x408], 0
je 0x41292b
call fcn.00412c2b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dc30
leave
ret