Function at 0x41035900
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4114a443
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
push ebx
push esi
push edi
mov eax, dword [0x411bade8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push str.Entering_CTPACWMITList::PutInstance
push 0x41157f9c
push 0x1000001
push 0x7a0
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
push 0xa
lea ecx, [ebp - 0x64]
call fcn.41041b9b
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], edi
call fcn.41031dc0
test eax, eax
jne 0x41035995
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80070005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21]
push eax
push str.DetectedGPO
mov ecx, esi
call dword [sym.imp.framedyn.dll_public:_bool___thiscall_CInstance::Getbool_unsigned_short_int_const___bool__const]
cmp byte [ebp - 0x21], 1
jne 0x410359f3
push str.WMI_PutInstance_is_forbidden_for_this_table
push 0x2000001
push 0x7b3
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.TranslationList
push esi
lea ecx, [ebp - 0xe4]
call fcn.410308e0
push str.TranslationListEx
push esi
lea ecx, [ebp - 0xbc]
call fcn.410308e0
push str.TranslationListEx2
push esi
lea ecx, [ebp - 0xd0]
call fcn.410308e0
xor ecx, ecx
cmp dword [ebp - 0xc4], edi
setg cl
xor edx, edx
cmp dword [ebp - 0xb0], edi
setg dl
xor eax, eax
add ecx, edx
cmp dword [ebp - 0xd8], edi
setg al
add ecx, eax
cmp ecx, 1
jle 0x41035a99
push str.TranslationList
push str.more_than_1_translation_list_is_present
push 0x2000001
push 0x7be
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x28]
push ecx
push str.TranslationList
mov ecx, esi
call dword [sym.imp.framedyn.dll_public:_bool___thiscall_CInstance::GetStringArray_unsigned_short_int_const___struct_tagSAFEARRAY___const]
test al, al
jne 0x41035af7
push str.TranslationList
push str._s_nor_present
push 0x2000001
push 0x7c5
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElemsize]
cmp eax, 1
je 0x41035b4f
push str.TranslationList
push str._s_dimension_not_1
push 0x2000001
push 0x7cb
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
push 1
push ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
test eax, eax
jne 0x410359cb
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x40]
push edx
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
test eax, eax
jne 0x410359cb
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1c]
lea ecx, [ebp + 8]
inc eax
cdq
push ecx
sub eax, edx
mov ebx, eax
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x14]
push str.TranslationListEx2
push esi
sar ebx, 1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x48], edi
mov dword [ebp + 8], edi
call fcn.410314b0
test eax, eax
jne 0x41035d31
mov edi, dword [ebp + 8]
test edi, edi
jle 0x41035d2f
push str.TranslationListEx2
push str._s_is_filled_and_will_be_stored
push 0x1000001
push 0x7e6
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x44], 0
call fcn.41001530
lea ecx, [ebp + 8]
call fcn.41001530
mov byte [ebp - 4], 5
test edi, edi
jle 0x41035c83
mov ebx, dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
lea ebx, [ebx]
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edx
call ebx
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.41001ff0
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
push esi
push ecx
push str.__d__s
push 0x1000001
push 0x837
push str.WMIProv.cpp
call fcn.41002c10
mov eax, dword [esi - 0xc]
add esp, 0x18
push eax
push esi
lea ecx, [ebp + 8]
call fcn.41001a50
mov edx, dword [ebp + 8]
mov eax, dword [edx - 0xc]
inc eax
push eax
lea ecx, [ebp + 8]
call fcn.410078d0
dec edi
test edi, edi
jg 0x41035c20
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
lea ecx, [ebp + 8]
call fcn.410078d0
lea ecx, [ebp - 0xa8]
call fcn.410264f0
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 6
cmp eax, 2
jne 0x4103603d
push 1
push esi
lea ecx, [ebp - 0xa8]
call fcn.410282b0
test eax, eax
jne 0x41035f91
push str.NameTranslationEx2
push str.Syntax_error_in__s
push 0x2000001
push 0x847
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 5
call fcn.41026580
lea ecx, [ebp + 8]
call fcn.41017b50
lea ecx, [ebp - 0x18]
call fcn.41017b50
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x34]
push edx
push str.TranslationListEx
push esi
call fcn.410314b0
test eax, eax
jne 0x41035d8a
mov edi, dword [ebp + 8]
cmp edi, 2
jle 0x41035d88
push str.TranslationListEx
push str._s_is_filled_and_will_be_stored
push 0x1000001
push 0x7f2
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
mov dword [ebp - 0x10], 1
jmp 0x41035bf5
xor edi, edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], edi
call fcn.41001530
lea ecx, [ebp + 8]
call fcn.41001530
push str.TranslationList
push str.Read__s_...
push 0x1000001
push 0x7fe
push str.WMIProv.cpp
mov byte [ebp - 4], 2
call fcn.41002c10
add esp, 0x14
cmp ebx, edi
jle 0x41035e77
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.41001ff0
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x1c]
push ecx
lea ecx, [ebp + 8]
call fcn.41001ff0
push 0x4116b2dc
lea ecx, [ebp - 0x10]
call fcn.41033260
push 0x4116b2dc
lea ecx, [ebp + 8]
call fcn.41033260
push 0x4116b2dc
lea ecx, [ebp - 0x10]
call fcn.410339a0
push 0x4116b2dc
lea ecx, [ebp + 8]
call fcn.410339a0
mov edx, dword [ebp - 0x10]
cmp dword [edx - 0xc], edi
je 0x41035f59
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
je 0x41035f59
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x64]
call fcn.41041de6
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x64]
call fcn.41041de6
dec ebx
cmp ebx, edi
jg 0x41035dd0
lea eax, [ebp - 0x64]
push eax
call fcn.41033050
add esp, 4
test eax, eax
je 0x41035f59
lea ecx, [ebp - 0x3c]
call fcn.41010ac0
push 0xf003f
push str.SoftwareThinPrintTPAutoConnect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.41010fa0
test eax, eax
jne 0x41035f18
push str.Entering_CRegKeyEx::DeleteValue
push 0x41157f9c
push 0x1000001
push 0x1a5
push str.RegKeyEx.h
call fcn.41002c10
mov ecx, dword [ebp - 0x3c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esp, 0x14
push str.NameTranslationEx
push ecx
call esi
push str.Entering_CRegKeyEx::DeleteValue
push 0x41157f9c
push 0x1000001
push 0x1a5
push str.RegKeyEx.h
call fcn.41002c10
mov edx, dword [ebp - 0x3c]
add esp, 0x14
push str.NameTranslationEx2
push edx
call esi
lea ecx, [ebp - 0x3c]
call fcn.41010b50
call sym.TPSvc.dll_TPADLLLoadTranslationList
test eax, eax
jne 0x41035f3d
push str.TPADLLLoadTranslationList_failed
push 0x2000001
push 0x826
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.41010de0
lea ecx, [ebp + 8]
call fcn.41017b50
lea ecx, [ebp - 0x10]
jmp 0x41036201
lea ecx, [ebp + 8]
call fcn.41017b50
lea ecx, [ebp - 0x10]
call fcn.41017b50
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
call fcn.41001530
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 7
call fcn.4102a2e0
test eax, eax
je 0x41035fe2
push str.TranslationListEx2_is_compatible_to_TranslationListEx_and_will_be_stored_there_instead
push 0x1000001
push 0x851
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 1
call fcn.410043b0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.41017b50
lea ecx, [ebp - 0x30]
call fcn.41010ac0
push 0xf003f
push str.SoftwareThinPrintTPAutoConnect
mov bl, 8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.41010fa0
test eax, eax
jne 0x410361b6
lea ecx, [ebp - 0x14]
call fcn.41001530
cmp dword [ebp - 0x10], 2
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x14]
jne 0x410360bb
push str.NameTranslationEx2
jmp 0x410360c0
cmp eax, 1
jne 0x41035fee
push eax
push esi
lea ecx, [ebp - 0xa8]
call fcn.41028bc0
test eax, eax
jne 0x41035fee
push str.NameTranslationEx
push str.Syntax_error_in__s
push 0x2000001
push 0x85d
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 5
call fcn.41026580
lea ecx, [ebp + 8]
call fcn.41017b50
lea ecx, [ebp - 0x18]
call fcn.41017b50
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.NameTranslationEx
call fcn.41001ff0
mov eax, dword [esi - 0xc]
mov edi, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
push edi
push str.Storing:_at__s___d_lines___d_characters
push 0x1000001
push 0x86c
push str.WMIProv.cpp
call fcn.41002c10
mov eax, dword [esi - 0xc]
add esp, 0x1c
lea ecx, [eax + eax]
push ecx
push esi
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x38], esp
mov esi, esp
push eax
call fcn.41003530
add eax, 0x10
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [esi], eax
call fcn.41033180
test eax, eax
je 0x41036134
push str.Could_not_write_to_registry
push 0x2000001
push 0x873
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
push str.Entering_CRegKeyEx::DeleteValue
push 0x41157f9c
push 0x1000001
push 0x1a5
push str.RegKeyEx.h
call fcn.41002c10
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esp, 0x14
cmp dword [ebp - 0x10], 1
jle 0x4103616c
mov edx, dword [ebp - 0x30]
push str.NameTranslationEx
push edx
jmp 0x41036175
mov eax, dword [ebp - 0x30]
push str.NameTranslationEx2
push eax
call esi
push str.Entering_CRegKeyEx::DeleteValue
push 0x41157f9c
push 0x1000001
push 0x1a5
push str.RegKeyEx.h
call fcn.41002c10
mov ecx, dword [ebp - 0x30]
add esp, 0x14
push str.NameTranslation
push ecx
call esi
lea ecx, [ebp - 0x30]
call fcn.41010b50
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.41017b50
call sym.TPSvc.dll_TPADLLLoadTranslationList
test eax, eax
jne 0x410361db
push str.TPADLLLoadTranslationList_failed
push 0x2000001
push 0x880
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.41010de0
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 5
call fcn.41026580
lea ecx, [ebp + 8]
call fcn.41017b50
lea ecx, [ebp - 0x18]
call fcn.41017b50
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.41041cc9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8