Function at 0x412530
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x62c], 0x200
mov dword [ebp - 0x20c], 0x200
mov dword [ebp - 0x418], 0x200
lea eax, [ebp - 0x624]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x620], eax
test eax, eax
jne 0x4127d4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebp - 0x628]
push eax
mov eax, dword [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x620], eax
jmp 0x4127ba
lea eax, [ebp - 0x410]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41277a
mov dword [ebp - 0x414], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x61c]
push eax
mov eax, dword [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x41c], eax
jmp 0x412760
inc dword [ebp - 0x414]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x61c]
push eax
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412726
xor esi, esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
jmp 0x412714
inc esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0
push 0
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4126dd
push ebx
lea eax, [ebp - 0x40c]
push eax
call fcn.00420160
add esp, 8
test eax, eax
je 0x4126dd
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 0x40c], 0
dec esi
mov dword [ebp - 0x20c], 0x200
mov dword [ebp - 0x208], 0x200
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
test edi, edi
je 0x412688
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x418], 0x200
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x61c]
push eax
mov eax, dword [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x412631
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x628]
mov dword [ebp - 0x62c], 0x200
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebp - 0x628]
push eax
mov eax, dword [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
je 0x4125c8
mov eax, dword [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4