Function at 0x41f9f0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8fc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
push esi
push edi
mov dword [ebp - 0x10], 0
jle 0x41fc25
lea edi, [ebx + 0x20]
mov dword [ebp - 8], edi
mov al, byte [edi + 2]
test al, al
je 0x41fc0e
mov al, byte [edi]
mov cl, al
and cl, 0x80
je 0x41fa33
mov dl, al
and dl, 0x3f
cmp dl, 1
je 0x41fa99
test cl, cl
je 0x41fa79
mov dl, al
and dl, 0x3f
cmp dl, 7
je 0x41fa99
test cl, cl
je 0x41fa79
mov dl, al
and dl, 0x3f
cmp dl, 6
je 0x41fa99
test cl, cl
je 0x41fa79
mov dl, al
and dl, 0x3f
cmp dl, 0xb
je 0x41fa99
test cl, cl
je 0x41fa79
mov dl, al
and dl, 0x3f
cmp dl, 0xc
je 0x41fa99
test cl, cl
je 0x41fa79
mov cl, al
and cl, 0x3f
cmp cl, 0xe
je 0x41fa99
cmp al, 1
je 0x41fa99
cmp al, 4
je 0x41fa99
cmp al, 7
je 0x41fa99
cmp al, 6
je 0x41fa99
cmp al, 0xb
je 0x41fa99
cmp al, 0xc
je 0x41fa99
cmp al, 0xe
jne 0x41fc0e
mov edx, dword [ebx + 4]
mov eax, dword [edi - 0x18]
mov ecx, dword [edi - 0x14]
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ecx
push 0x800
lea ecx, [ebp - 0x8fc]
push ecx
lea edx, [ebp - 0x1c]
push 0xc
push edx
mov dword [ebp - 4], 0
call fcn.0041ee70
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41fc2e
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push esi
push str.SYSTEMMountedDevices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x41fb27
push esi
push esi
call fcn.0041fc50
add esp, 4
push eax
push str.opening_registry_key
lea ecx, [ebp - 0x24]
push str.error__s:__s___d_
push ecx
call fcn.0041ff50
add esp, 0x14
mov dword [ebp - 4], eax
jmp 0x41fc0a
mov al, byte [ebp - 0x8fc]
xor ebx, ebx
test al, al
je 0x41fb82
lea edi, [ebp - 0x8fc]
lea esp, [esp]
mov edx, dword [ebp - 0xc]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
jne 0x41fbe4
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fb60
sub eax, edx
lea ebx, [ebx + eax + 1]
mov al, byte [ebp + ebx - 0x8fc]
test al, al
lea edi, [ebp + ebx - 0x8fc]
jne 0x41fb40
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41fbfb
lea ecx, [ebp - 0x34]
push ecx
mov word [ebp - 0xfc], 0x23
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x63
lea edx, [ebp - 0xfa]
push edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov eax, dword [ebp - 0xc]
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
push 3
push 0
lea edx, [ebp - 0xfc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x41fbfb
lea ecx, [ebp - 4]
push ecx
push esi
push str.setting_registry_value_to_block_the_drive_letter
call fcn.0041e6b0
add esp, 0xc
jmp 0x41fbfd
lea eax, [ebp - 4]
push eax
push esi
push str.deleting_the_drive_letter_registry_value
call fcn.0041e6b0
mov edi, dword [ebp - 8]
add esp, 0xc
jmp 0x41fbfd
xor esi, esi
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x41fc2e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx]
inc eax
add edi, 0x20
cmp eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jl 0x41fa15
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret