Function at 0x416543
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4242b4]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], eax
lea eax, [esi + 0x74]
push eax
mov edi, 0x407bb8
push edi
mov dword [ebp - 0x21c], 2
call fcn.0040c335
xor ebx, ebx
test eax, eax
jne 0x41665d
push 0x4072f4
lea eax, [esi + 0x17c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x4165a9
push 0x4082d4
call fcn.0040be00
jmp 0x416951
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.0040c335
test eax, eax
je 0x416656
mov ecx, esi
call fcn.00414ec1
test eax, eax
je 0x416952
mov eax, dword [esi + 0x75fc]
cmp eax, ebx
je 0x4165f2
lea ecx, [ebp - 0x21c]
push ecx
push 0x413156
push ebx
lea ecx, [ebp - 0x108]
push ecx
call dword [eax + 0x20]
cmp eax, ebx
jne 0x416665
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push 0x40829c
call fcn.0040be00
cmp dword [esi + 0x20], ebx
pop ecx
pop ecx
je 0x416642
cmp edi, 0xd
jne 0x416642
lea eax, [ebp - 0x108]
push eax
call fcn.0040c022
test eax, eax
lea eax, [ebp - 0x108]
push eax
jne 0x41662f
push 0x408258
jmp 0x416634
push 0x408230
call fcn.0040be00
pop ecx
pop ecx
push 0xffffffffffffffed
jmp 0x416954
xor eax, eax
cmp edi, 0x70
setne al
dec eax
and eax, 3
add eax, 0xfffffff7
jmp 0x416959
push 0xffffffffffffffef
jmp 0x416954
push edi
mov ecx, esi
call fcn.00413063
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x214]
push eax
push 0x20007
push ebx
push 0x407e20
push 0x80000002
call edi
cmp eax, ebx
jne 0x4167d3
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push 0x407e14
push dword [ebp - 0x214]
call edi
cmp eax, ebx
jne 0x416788
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x218]
mov dword [ebp - 0x210], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x218]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x4166f1
push eax
push 0x4081f0
call fcn.0040be00
pop ecx
pop ecx
cmp edi, ebx
jne 0x416779
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c4a4
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c335
test eax, eax
je 0x41675c
push 0x4081b4
call fcn.0040be00
pop ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c022
test eax, eax
je 0x4167bb
push 0x407e14
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
je 0x4167bb
cmp eax, 2
je 0x4167bb
push eax
push 0x407e20
push 0x408170
jmp 0x41676f
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x280]
push eax
push 0x408148
call fcn.0040be00
add esp, 0xc
jmp 0x4167bb
push edi
push 0x40810c
call fcn.0040be00
pop ecx
pop ecx
jmp 0x4167bb
cmp eax, 2
je 0x416795
push eax
push 0x4080c8
jmp 0x41677f
lea edi, [esi + 0x9a0]
cmp byte [edi], bl
je 0x4167bb
push ebx
push edi
call fcn.0040c335
test eax, eax
je 0x4167bb
push 0x4081b4
call fcn.0040be00
pop ecx
push edi
call fcn.0040c022
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x4167e5
push eax
push 0x408090
jmp 0x4167de
cmp eax, 2
je 0x4167e5
push eax
push 0x408058
call fcn.0040be00
pop ecx
pop ecx
lea eax, [esi + 0x384]
push eax
push 0x406420
call fcn.0040c335
test eax, eax
je 0x416957
push 0x407bb8
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x416821
push 0x408030
jmp 0x41659f
cmp dword [esi + 0x7600], ebx
jne 0x41685b
push 0x124
call fcn.0041af8c
cmp eax, ebx
pop ecx
je 0x416841
mov ecx, eax
call fcn.0041407a
jmp 0x416843
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x7600], eax
je 0x416851
cmp dword [eax], ebx
jne 0x41685b
push 0x407ffc
jmp 0x41659f
mov eax, dword [esi + 0x7600]
push ebx
push 2
call dword [eax + 0x18]
cmp dword [esi + 0x18], ebx
mov dword [ebp - 0x210], eax
mov edi, 0x407fb8
je 0x4168a1
push 0x407f80
call fcn.0040be00
mov eax, dword [esi + 0x7600]
pop ecx
push ebx
push 2
push ebx
push 0x407f58
call dword [eax + 0x14]
cmp eax, ebx
je 0x4168a1
push eax
push edi
call fcn.0040be00
pop ecx
pop ecx
cmp dword [esi + 0x14], ebx
je 0x4168ca
mov eax, dword [esi + 0x7600]
push ebx
push 2
push ebx
push 0x407f30
call dword [eax + 0x14]
cmp eax, ebx
je 0x4168c7
push eax
push edi
call fcn.0040be00
pop ecx
pop ecx
jmp 0x4168ca
mov dword [esi + 0x14], ebx
cmp dword [esi + 0x10], ebx
je 0x41690b
mov eax, dword [esi + 0x7600]
push ebx
push 2
push ebx
push 0x407a70
call dword [eax + 0x14]
cmp eax, ebx
je 0x4168f0
push eax
push edi
call fcn.0040be00
pop ecx
pop ecx
jmp 0x4168f3
mov dword [esi + 0x10], ebx
cmp dword [esi + 0x10], ebx
je 0x41690b
push 0x407f08
call fcn.0040be00
mov dword [esp], 0x407ee4
jmp 0x416917
push 0x407ebc
call fcn.0040be00
pop ecx
push ebx
mov eax, dword [esi + 0x7600]
lea ecx, [ebp - 0x108]
push ecx
call dword [eax + 0x1c]
cmp dword [ebp - 0x210], ebx
mov edi, eax
je 0x416941
mov eax, dword [esi + 0x7600]
push ebx
push dword [ebp - 0x210]
call dword [eax + 0x18]
cmp edi, ebx
je 0x416957
push edi
push 0x407e7c
call fcn.0040be00
pop ecx
pop ecx
push 0xfffffffffffffff7
pop eax
jmp 0x416959
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041a84f
leave
ret