Function at 0x419cd6
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.0043fdcb
push 4
pop esi
or word [ebp - 0x14], si
lea ecx, [ebp - 0x1c]
call fcn.00419aff
mov ebx, 0x4035d4
test eax, eax
js 0x419d43
lea eax, [ebp - 4]
push eax
push 3
push edi
push dword [ebp - 0x1c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419d43
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4035f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x401680
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419f03
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4035f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x40356c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [0x444f48]
neg eax
mov dword [ebp - 0x10], esi
sbb eax, eax
and dword [0x444f5c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x40358c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419dd3
cmp dword [ebp - 8], esi
jne 0x419dd3
mov eax, dword [ebp - 0xc]
mov dword [0x444f78], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x4036a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e0f
cmp dword [ebp - 8], esi
jne 0x419e01
mov al, byte [ebp - 0xc]
and al, 1
jmp 0x419e0a
cmp dword [ebp - 8], 3
jne 0x419e0f
mov al, byte [ebp - 0xc]
mov byte [0x444f88], al
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x4035b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e3e
cmp dword [ebp - 8], esi
jne 0x419e3e
mov eax, dword [ebp - 0xc]
mov dword [0x444f80], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403618
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e6d
cmp dword [ebp - 8], esi
jne 0x419e6d
mov eax, dword [ebp - 0xc]
mov dword [0x444f4c], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403638
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e9c
cmp dword [ebp - 8], esi
jne 0x419e9c
mov eax, dword [ebp - 0xc]
mov dword [0x444f84], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403660
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419ecb
cmp dword [ebp - 8], esi
jne 0x419ecb
mov eax, dword [ebp - 0xc]
mov dword [0x444f60], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x403680
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419efa
cmp dword [ebp - 8], esi
jne 0x419efa
mov eax, dword [ebp - 0xc]
mov dword [0x444f64], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042089d
lea ecx, [ebp - 0x1c]
call fcn.00440156
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret