Function at 0x412410
Capabilities:
Delete registry value
Manipulate boot configuration
Query or enumerate registry value

Disassembly:
sub esp, 0x728
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x724], eax
push esi
push edi
xor edi, edi
push 0xfe
lea eax, [esp + 0x1a]
push edi
push eax
mov word [esp + 0x20], di
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4124cc
test byte [0x503544], 1
jne 0x41248e
or dword [0x503544], 1
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x15d
add esi, 8
call fcn.00411fb0
mov edx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKey.
push 0x503520
call edx
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x724]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x728
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push str.SystemPartition
push eax
mov dword [esp + 0x24], 0x80
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x412544
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x167
add esi, 8
call fcn.00411fb0
mov ecx, dword [esi]
push eax
push str._s:_Failed_to_RegQueryValueEx.
push edi
call ecx
mov edx, dword [esp + 0x18]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x724]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x728
ret
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
push 0x206
lea ecx, [esp + 0x326]
push edi
push ecx
mov word [esp + 0x32c], di
call sub.ntdll.dll_memset
push 0x206
lea edx, [esp + 0x12a]
push edi
push edx
mov word [esp + 0x130], di
call sub.ntdll.dll_memset
push 0x206
lea eax, [esp + 0x546]
push edi
push eax
mov word [esp + 0x54c], di
call sub.ntdll.dll_memset
lea ecx, [esp + 0x3c]
push ecx
push str._s_boot.ini
lea edx, [esp + 0x34c]
call fcn.00404df0
lea edx, [esp + 0x44]
push edx
push str._s_ntldr
lea edx, [esp + 0x14c]
call fcn.00404df0
lea eax, [esp + 0x4c]
push eax
push str._s_bootmgr
lea edx, [esp + 0x564]
call fcn.00404df0
add esp, 0x3c
test byte [0x50354c], 1
jne 0x412602
or dword [0x50354c], 1
mov dword [0x503548], 0x4e7844
mov edx, dword [0x503548]
mov eax, dword [edx + 0x64]
push 0x80000000
lea ecx, [esp + 0x324]
push ecx
mov ecx, 0x503548
call eax
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41264f
push eax
call esi
mov edx, dword [0x503548]
mov eax, dword [edx + 0x64]
push 0x80000000
lea ecx, [esp + 0x11c]
push ecx
mov ecx, 0x503548
call eax
cmp eax, 0xffffffff
jne 0x412671
mov edx, dword [0x503548]
mov eax, dword [edx + 0x64]
push 0x80000000
lea ecx, [esp + 0x52c]
push ecx
mov ecx, 0x503548
call eax
cmp eax, 0xffffffff
je 0x412691
push eax
call esi
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x724]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x728
ret
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push edi
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4126da
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x190
add esi, 8
call fcn.00411fb0
mov edx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKeyEx.
push edi
call edx
add esp, 0x10
jmp 0x4126f1
mov eax, dword [esp + 0xc]
push str.SystemPartition
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
mov ecx, dword [esp + 0x730]
pop ebx
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0046d6fd
add esp, 0x728
ret