Function at 0x412fd0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3248
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x50f880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov ebx, eax
xor edx, edx
xor esi, esi
cmp dword [ebx + 0xc], 4
je 0x413360
mov edi, dword [ebx + 0x10]
add edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
cmp ecx, 2
jne 0x4130b1
mov eax, dword [ebx + 4]
cmp eax, edx
je 0x41308c
cmp dword [ebx + 8], edx
je 0x413080
mov ecx, dword [ebx]
lea esi, [ebp - 0x10]
push esi
push 0x2001f
push edx
push eax
push ecx
mov dword [ebp - 0x10], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413362
mov ecx, dword [ebx + 8]
mov eax, dword [ebp - 0x10]
push ecx
push eax
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x4133a4
test edi, edi
je 0x4130a7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
add ebx, 0x18
jmp 0x413356
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x41309d
mov eax, dword [ebx + 8]
cmp eax, edx
je 0x4130a9
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x413360
xor edx, edx
add ebx, 0x18
jmp 0x413356
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov eax, 0x20019
cmp ecx, 1
jne 0x4130cc
mov eax, 0x2001f
mov ecx, dword [ebx + 4]
mov esi, dword [ebx]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
push edx
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4130f0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov esi, eax
test eax, eax
je 0x413118
cmp dword [ebp + 0xc], 0
je 0x413251
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea edx, [ebp - 0x28]
push edx
call fcn.00415080
mov esi, eax
test esi, esi
jne 0x41324f
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0xc]
mov edx, eax
mov dword [ebp - 0x10], edx
cmp ecx, 3
ja case.default.0x41312c
jmp dword [ecx*4 + 0x4133b8]
cmp dword [ebp + 0xc], 1
jne 0x41316a
mov esi, dword [ebx + 8]
xor eax, eax
test edi, edi
setne al
test eax, eax
jne 0x41314f
lea esi, [eax + 0xd]
jmp case.default.0x41312c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x28]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push esi
push ecx
jmp 0x413326
mov edx, dword [ebx + 8]
mov esi, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x28]
push eax
lea edi, [ebp - 0x10]
call fcn.00414f70
jmp 0x41332c
cmp dword [ebp + 0xc], 1
jne 0x4131b7
mov edi, dword [edi]
mov esi, dword [ebx + 8]
xor eax, eax
test edi, edi
setne al
test eax, eax
jne 0x4131a0
lea esi, [eax + 0xd]
jmp case.default.0x41312c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push esi
jmp 0x413322
mov eax, dword [ebx + 8]
mov esi, dword [ebp - 0x28]
lea ecx, [edx + edx]
lea edx, [ebp - 0x10]
push edx
push 0
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41337e
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x4131f0
cmp eax, 2
jne 0x413379
mov eax, dword [ebp - 0x10]
shr eax, 1
mov esi, edi
mov dword [ebp - 0x10], eax
call fcn.0041b3e0
mov edx, dword [ebx + 8]
push edx
lea ecx, [ebp - 0x28]
push ecx
lea edi, [ebp - 0x10]
mov esi, eax
call fcn.00414f70
mov edi, dword [ebp - 0x14]
mov esi, eax
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x413231
push ecx
push eax
call fcn.00453fa1
add esp, 8
test eax, eax
js 0x4133ab
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4133ab
mov dword [ecx - 0xc], eax
mov edx, dword [edi]
xor ecx, ecx
mov word [edx + eax*2], cx
test esi, esi
je case.default.0x41312c
mov eax, esi
call fcn.00417e90
mov esi, eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x413266
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 1
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x14]
jne 0x413298
mov edx, dword [edi]
push 4
push ecx
push 4
push 0
mov dword [ebp - 0x14], edx
push eax
jmp 0x413322
push ecx
push edi
lea edx, [ebp - 0x1c]
push edx
push 0
push eax
mov eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41332c
mov esi, dword [ebp - 0x1c]
sub esi, 4
neg esi
sbb esi, esi
and esi, 0xd
jmp case.default.0x41312c
cmp dword [ebp + 0xc], 0
jne 0x413318
lea ecx, [ebp - 0x14]
push ecx
push edi
mov edi, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 8]
push 0
push eax
push edi
mov dword [ebp - 0x10], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je case.default.0x41312c
call fcn.00417e90
mov esi, eax
test edi, edi
je 0x413304
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 8]
push eax
push edi
push 3
push 0
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41334a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], 0
add ebx, 0x18
mov dword [ebp - 0x24], 0
xor edx, edx
cmp dword [ebx + 0xc], 4
jne 0x413011
mov eax, esi
call fcn.00417e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xd
call fcn.00417e90
mov edi, eax
test esi, esi
je 0x413390
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
jmp 0x4132f2
push 0x80070057
call fcn.0041b5f0
lea ecx, [ecx]
xor esi, dword [ecx]
inc ecx
add byte [edx + 0x7a004131], al
xor al, byte [ecx]
lds esi, [edx]
inc ecx
add ah, cl
int3