Function at 0x411040
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x44d3f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x23c]
mov ecx, dword [esp + 0x238]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 0xf003f
push ebp
push ebx
push ecx
mov dword [esp + 0x244], 2
mov dword [esp + 0x28], ebp
call esi
cmp eax, ebp
jne 0x4110d1
mov eax, dword [esp + 0x244]
mov edi, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x24], edi
jne 0x411124
mov edx, dword [esp + 0x240]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp edi, ebp
mov esi, eax
je 0x41120e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x41120e
mov eax, dword [0x463294]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [ebx - 0xc]
cmp edx, eax
je 0x4110f6
lea esi, [ebx - 0xc]
push esi
call edi
test eax, eax
jg 0x4110f6
push esi
call fcn.0044737a
add esp, 4
mov eax, dword [esp + 0x240]
mov edx, dword [0x463294]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41111d
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x41111d
push esi
call fcn.0044737a
add esp, 4
xor eax, eax
jmp 0x41126f
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x240]
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebp
push ecx
push edi
mov byte [esp + 0x244], 3
mov dword [esp + 0x2c], ebp
call esi
mov esi, eax
cmp esi, ebp
jne 0x411167
lea ecx, [esp + 0x10]
call fcn.004112b0
mov esi, eax
mov eax, dword [esp + 0x18]
cmp esi, ebp
mov dword [esp + 0x10], eax
je 0x41117d
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 2
call fcn.004112b0
jmp 0x41120e
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
push edx
push ebp
push ebp
push ebp
lea edx, [esp + 0x38]
push ecx
push edx
mov ebx, 0x100
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
jne 0x4111dc
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
call fcn.004112d0
mov esi, eax
test esi, esi
jne 0x4111f6
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea eax, [esp + 0x38]
push edx
push eax
push esi
push ecx
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
je 0x4111a6
lea ecx, [esp + 0x10]
call fcn.004112b0
mov edx, dword [esp + 0x240]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 2
call fcn.004112b0
mov ebx, dword [esp + 0x23c]
xor eax, eax
test esi, esi
sete al
test edi, edi
mov ebp, eax
je 0x411222
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x463294]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [ebx - 0xc]
cmp ecx, eax
je 0x411247
lea esi, [ebx - 0xc]
push esi
call edi
test eax, eax
jg 0x411247
push esi
call fcn.0044737a
add esp, 4
mov esi, dword [esp + 0x240]
mov eax, dword [0x463294]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x41126d
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x41126d
push esi
call fcn.0044737a
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret