Function at 0x4116d1
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x408], 0
and dword [ebp - 0x410], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x418], edx
xor edi, edi
mov dword [ebp - 0x41c], esi
inc edi
call fcn.00411c77
push 0x3d
pop ecx
call fcn.00411e2a
test eax, eax
je 0x4119c6
call fcn.00411c77
push 0x100
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x40c], ebx
test ebx, ebx
jne 0x41174a
mov dword [0x41edf8], 0x84
jmp 0x4119cb
push 0x22
pop ecx
call fcn.00411e2a
test eax, eax
je 0x411792
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.004119da
test eax, eax
je 0x41177e
call fcn.00411bfb
test eax, eax
jne 0x41178a
xor edi, edi
mov dword [ebp - 0x408], 1
xor esi, esi
inc esi
jmp 0x41190c
mov ecx, dword [0x401ff4]
call fcn.00411e2a
test eax, eax
je 0x411813
movzx eax, word [0x401ff6]
mov esi, 0x401ff6
test ax, ax
je 0x4117de
mov ecx, eax
call fcn.00411e2a
lea esi, [esi + 2]
test eax, eax
jne 0x4117cc
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4117b4
test edi, edi
je 0x4119b6
call fcn.00411c77
mov ecx, ebx
call fcn.00411b6d
test eax, eax
je 0x4117f7
call fcn.00411bfb
test eax, eax
jne 0x411803
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x40c]
push 4
pop ebx
mov esi, ebx
jmp 0x41191e
push 0x2d
pop ecx
call fcn.00411e2a
test eax, eax
je 0x411849
call fcn.00411bfb
test eax, eax
jne 0x411837
mov dword [ebp - 0x408], 1
jmp 0x4119b6
push dword [ebp - 0x418]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4119b6
movzx eax, word [0x401fec]
mov esi, 0x401fec
test ax, ax
je 0x411886
mov ecx, eax
call fcn.00411e2a
lea esi, [esi + 2]
test eax, eax
jne 0x411874
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x41185c
test edi, edi
je 0x4119b6
push 0x28
pop ecx
call fcn.00411e2a
test eax, eax
je 0x4118c1
lea ecx, [ebp - 0x410]
call fcn.00411b6d
test eax, eax
je 0x4118ad
push 0x29
pop ecx
call fcn.00411e2a
test eax, eax
jne 0x4118b9
xor edi, edi
mov dword [ebp - 0x408], 1
mov esi, dword [ebp - 0x410]
jmp 0x4118c4
push 3
pop esi
test edi, edi
je 0x4119b6
push 0x3a
pop ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.00411e2a
test eax, eax
je 0x411900
lea ecx, [ebp - 0x414]
call fcn.00411aae
test eax, eax
je 0x411900
call fcn.00411bfb
test eax, eax
jne 0x41190c
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x414]
mov ebx, dword [ebp - 0x410]
mov dword [ebp - 0x40c], eax
test edi, edi
je 0x4119b0
cmp dword [0x41edfc], 0x500
jae 0x411991
cmp esi, 2
je 0x41193c
cmp esi, 7
jne 0x411991
xor ecx, ecx
lea eax, [ebp - 0x404]
push ecx
push ecx
push 0x400
push eax
push 0xffffffffffffffff
push dword [ebp - 0x418]
mov byte [ebp - 0x404], cl
push ecx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push ebx
push esi
push 0
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4119b6
mov dword [0x41edf8], 0x84
jmp 0x4119b6
push ebx
push eax
push esi
push 0
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp - 0x40c]
jmp 0x411981
mov ebx, dword [ebp - 0x40c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x408], 0
je 0x4119cb
call fcn.00411ca3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cc10
leave
ret