Function at 0x41d4e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x494
mov eax, dword [0x5365f0]
xor eax, esp
mov dword [esp + 0x490], eax
cmp dword [ebp + 8], 2
push ebx
push esi
push edi
mov esi, ecx
jne 0x41d71b
cmp dword [esi], 2
je 0x41d72b
lea ebx, [esp + 0x1c]
call fcn.00406f20
lea ecx, [esp + 0x38]
mov eax, ebx
call fcn.00406fa0
or edi, 0xffffffff
test al, al
je 0x41d538
movzx eax, word [esp + 0x44]
mov dword [esp + 0x10], eax
jmp 0x41d53c
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x88]
lea eax, [esp + 0x1c]
call fcn.00406fa0
test al, al
je 0x41d55e
movzx ecx, word [esp + 0x92]
mov dword [esp + 0x18], ecx
jmp 0x41d562
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x68]
lea eax, [esp + 0x1c]
call fcn.00406fa0
test al, al
je 0x41d57e
movzx edx, word [esp + 0x70]
mov dword [esp + 0x14], edx
jmp 0x41d582
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x48]
lea eax, [esp + 0x1c]
call fcn.00406fa0
movzx ebx, word [esp + 0x4e]
test al, al
jne 0x41d59a
mov ebx, edi
lea ecx, [esp + 0x58]
lea eax, [esp + 0x1c]
call fcn.00406fa0
test al, al
je 0x41d5b0
movzx edi, word [esp + 0x5a]
lea ecx, [esp + 0x78]
lea eax, [esp + 0x1c]
call fcn.00406fa0
test al, al
je 0x41d5c8
movzx ecx, word [esp + 0x78]
jmp 0x41d5cb
or ecx, 0xffffffff
mov dx, word [esp + 0x10]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov ax, word [esp + 0x14]
mov word [esp + 0x28], cx
mov cx, word [esp + 0x18]
mov word [esp + 0x2a], di
add esi, 0x34
lea edi, [esp + 0x28]
mov word [esp + 0x2e], bx
mov word [esp + 0x30], ax
mov word [esp + 0x32], cx
mov word [esp + 0x34], dx
call fcn.00406de0
neg eax
sbb eax, eax
inc eax
mov dword [esi + 8], eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0xa2]
push ecx
mov word [esp + 0xa4], ax
call fcn.004da450
add esp, 0xc
lea ecx, [esp + 0x78]
mov eax, esi
call fcn.00406fa0
or edi, 0xffffffff
test al, al
je 0x41d65e
movzx edx, word [esp + 0x84]
mov dword [esp + 0x10], edx
jmp 0x41d662
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x58]
mov eax, esi
call fcn.00406fa0
test al, al
je 0x41d67c
movzx eax, word [esp + 0x62]
mov dword [esp + 0x18], eax
jmp 0x41d680
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x48]
mov eax, esi
call fcn.00406fa0
test al, al
je 0x41d69a
movzx ecx, word [esp + 0x50]
mov dword [esp + 0x14], ecx
jmp 0x41d69e
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x68]
mov eax, esi
call fcn.00406fa0
movzx ebx, word [esp + 0x68]
test al, al
jne 0x41d6b4
mov ebx, edi
lea ecx, [esp + 0x88]
mov eax, esi
call fcn.00406fa0
test al, al
je 0x41d6ce
movzx edi, word [esp + 0x8e]
lea ecx, [esp + 0x38]
mov eax, esi
call fcn.00406fa0
test al, al
je 0x41d6e4
movzx eax, word [esp + 0x3a]
jmp 0x41d6e7
or eax, 0xffffffff
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push ebx
push edi
push eax
push str._02d__02d__d__02d:_02d:_02d
lea edx, [esp + 0xb4]
call fcn.00401000
add esp, 0x1c
lea esi, [esp + 0x98]
call fcn.0041d750
jmp 0x41d72b
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoStartDateTime
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x49c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4