Function at 0x419546
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x20
mov eax, 0x46ba62
call fcn.0042dbd7
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xd], bl
call fcn.0040699e
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
test edi, edi
je 0x419581
cmp dword [ebp + 0x10], ebx
jne 0x419596
push 4
push str.IN_Operations::_RemoveRegMultiStringValue_:_szValue_or_szSubKey_is_NULL__returning
mov ecx, 0x493f4c
call fcn.0040c5b8
mov byte [ebp - 0xd], 1
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x4195b8
push 5
push str.IN_Operations::_RemoveRegMultiStringValue_:_szValueName_is_NULL__returning
mov ecx, 0x493f4c
call fcn.0040c5b8
mov esi, dword [ebp - 0x14]
xor bl, bl
jmp 0x4198f9
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push edi
push str.IN_Operations::_RemoveRegMultiStringValue_:_Entering__RemoveRegMultiStringValue___parameters:__s___s___s
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x14]
add esp, 0x14
cmp dword [esi - 4], 1
jle 0x4195e5
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov esi, dword [ebp - 0x14]
push 4
push esi
mov ecx, 0x493f4c
call fcn.0040c5b8
cmp dword [ebp + 0x18], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x2001b
mov eax, 0x2011b
cmove eax, ecx
push eax
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41988b
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4196a0
push eax
lea eax, [ebp - 0x14]
push str.RegQueryValueEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41965f
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov eax, dword [ebp - 0x14]
push 7
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
push ebx
push edi
push str.IN_Operations::_RemoveRegMultiStringValue_:_Failed_to_get_size_of__s_s
lea eax, [ebp - 0x14]
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x419696
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov esi, dword [ebp - 0x14]
mov ecx, 0x493f4c
jmp 0x4198ee
cmp dword [ebp - 0x20], 0
jne 0x4196e4
push ebx
push edi
lea eax, [ebp - 0x14]
push str.IN_Operations::_RemoveRegMultiStringValue_:_registry_value__s_s_is_empty
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x4196d0
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov esi, dword [ebp - 0x14]
push 4
push esi
mov ecx, 0x493f4c
call fcn.0040c5b8
mov bl, 1
jmp 0x4198f9
push dword [ebp - 0x20]
call fcn.00425070
push dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.00425070
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x419876
test eax, eax
je 0x419876
lea eax, [ebp - 0x20]
push eax
push ecx
lea eax, [ebp - 0x2c]
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41976a
push eax
lea eax, [ebp - 0x14]
push str.RegQueryValueEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x419751
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov eax, dword [ebp - 0x14]
push 7
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
push ebx
push edi
push str.IN_Operations::_RemoveRegMultiStringValue_:_Failed_to_get_value__s_s
jmp 0x419673
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov edi, ecx
mov dword [ebp - 0x28], eax
cmp byte [ecx], al
je 0x4197dc
mov esi, dword [ebp - 0x18]
mov ebx, eax
push dword [ebp + 0x10]
push edi
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
je 0x4197bb
push edi
call fcn.00436130
pop ecx
mov edx, eax
xor ecx, ecx
test edx, edx
je 0x4197b1
lea eax, [ebx + esi]
mov dword [ebp - 0x28], eax
mov esi, eax
mov al, byte [ecx + edi]
mov byte [esi + ecx], al
inc ecx
cmp ecx, edx
jb 0x4197a3
mov esi, dword [ebp - 0x18]
lea eax, [ecx + ebx]
mov byte [eax + esi], 0
lea ebx, [eax + 1]
push 0x104
push edi
call fcn.00435cdc
inc edi
add edi, eax
pop ecx
pop ecx
cmp byte [edi], 0
jne 0x41977d
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x18]
mov byte [eax + edi], 0
inc eax
push eax
push edi
push 7
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x41986f
push eax
lea eax, [ebp - 0x14]
push str.RegSetValueEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x419821
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov eax, dword [ebp - 0x14]
push 7
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push str.IN_Operations::_RemoveRegMultiStringValue_:_Failed_to_set_registry_value__s_s
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x41985a
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov esi, dword [ebp - 0x14]
push 4
push esi
mov ecx, 0x493f4c
call fcn.0040c5b8
mov bl, byte [ebp - 0xd]
jmp 0x4198fc
mov bl, 1
jmp 0x4198fc
push 6
push str.Operations::_RemoveRegMultiStringValue__szMultiSzValue_or_szResultMultiSz
mov ecx, 0x493f4c
call fcn.0040c5b8
xor bl, bl
jmp 0x4198f9
push eax
lea eax, [ebp - 0x14]
push str.RegOpenKeyEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x4198b4
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov eax, dword [ebp - 0x14]
push 7
mov ebx, 0x493f4c
push eax
mov ecx, ebx
call fcn.0040c5b8
push edi
lea eax, [ebp - 0x14]
push str.IN_Operations::_RemoveRegMultiStringValue_:_Failed_to_open_regkey__s
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x14]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x4198ec
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406aae
mov esi, dword [ebp - 0x14]
mov ecx, ebx
push 4
push esi
call fcn.0040c5b8
mov bl, byte [ebp - 0xd]
mov edi, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
je 0x41990b
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x419919
push eax
call fcn.00425080
pop ecx
test edi, edi
je 0x419924
push edi
call fcn.00425080
pop ecx
lea ecx, [esi - 0x10]
call fcn.00406c57
mov al, bl
call fcn.0042dba0
ret