Function at 0x4144fa
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x47d871
call fcn.004026ff
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x18]
push eax
push 0x413ec0
push 0x17
push edi
push 0x413f9c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x41a246
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
cmp dword [ebp - 0x18], edi
je 0x41459e
lea eax, [ebp - 0x44]
push eax
call ebx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 4
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x41a25b
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edi, edi
cmp dword [ebp - 0x10], edi
jl 0x41471b
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x18], edi
je 0x4145e3
push 0x414898
lea ecx, [ebp - 0x24]
call fcn.004144c7
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
call dword [ecx + 0x1c]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x41a270
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x10], edi
jl 0x41471b
cmp dword [ebp - 0x20], edi
je 0x414622
push 0x41488c
lea ecx, [ebp - 0x24]
call fcn.004144c7
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x24]
mov byte [ebp - 4], 6
push eax
call dword [ecx + 0x34]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x41a285
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x10], edi
jl 0x41471b
cmp dword [ebp - 0x1c], edi
je 0x41466a
lea eax, [ebp - 0x44]
push eax
call ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 7
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x30]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x41a29a
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edi, edi
cmp dword [ebp - 0x10], edi
jl 0x41471b
cmp dword [ebp - 0x28], edi
je 0x41471b
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push 0x4147f8
push 0x80000002
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x41a32f
cmp dword [ebp - 0x14], edi
je 0x41a32f
mov dword [ebp - 0x2c], edi
mov ebx, 0x4147dc
mov edi, 0xf0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x24]
push ecx
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41a2af
push dword [ebp - 0x24]
push 0x414768
push 8
call fcn.004015a0
mov eax, dword [ebp - 0x24]
add esp, 0xc
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x41471b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 2
cmp eax, edi
je 0x41472c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x41473d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0
cmp eax, edi
je 0x41474e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x41475f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
call fcn.00402739
ret
push eax
push 0x41a738
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x41471b
push eax
push 0x41a6c8
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x414592
push eax
push 0x41a658
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x4145de
push eax
push 0x41a5e8
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x41461d
push eax
push 0x41a580
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x41465e
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + 1]
mov dword [ebp - 0x2c], eax
cmp eax, edi
jae 0x41a2ef
cmp esi, 2
jne 0x41a309
push ecx
push 0x41a4f8
push 1
call fcn.004015a0
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp eax, edi
jae 0x41470b
jmp 0x4146b9
push 0x41a490
push 1
call fcn.004015a0
pop ecx
pop ecx
mov dword [ebp - 0x10], 0x80004005
jmp 0x41470b
push esi
push 0x41a3f0
push 1
call fcn.004015a0
add esp, 0xc
test esi, esi
jg 0x41a321
xor edi, edi
jmp 0x41a34f
and esi, 0xffff
or esi, 0x80070000
jmp 0x41a31d
push esi
push 0x41a358
push 1
call fcn.004015a0
add esp, 0xc
cmp esi, edi
jle 0x41a34f
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0x10], esi
jmp 0x41470d