Function at 0x41cf34
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8aa850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x248], 0
mov dword [ebp - 4], 0
mov eax, ecx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x244]
push edx
mov esi, dword [eax]
push 0x2001f
xor ecx, ecx
mov dword [ebp - 0x244], ecx
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
je 0x41cfa4
mov esi, dword [ebp - 0x248]
jmp 0x41cfcf
mov edx, dword [ebp - 0x248]
xor ebx, ebx
test edx, edx
je 0x41cfc3
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [ebp - 0x248], 0
mov esi, dword [ebp - 0x244]
mov dword [ebp - 0x248], esi
test ebx, ebx
je 0x41d007
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41cfef
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x240], 0x100
lea ecx, [ebp - 0x234]
xor ebx, ebx
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41d258
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x130]
push eax
xor edx, edx
mov dword [ebp - 0x130], edx
push 0x2001f
push edx
push ecx
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
je 0x41d082
mov esi, dword [ebp - 0x134]
jmp 0x41d0ad
mov edx, dword [ebp - 0x134]
xor ebx, ebx
test edx, edx
je 0x41d0a1
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [ebp - 0x134], 0
mov esi, dword [ebp - 0x130]
mov dword [ebp - 0x134], esi
test ebx, ebx
je 0x41d0d6
mov dword [ebp - 4], 0
test esi, esi
je 0x41d17e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
jmp 0x41d17e
mov dword [ebp - 0x12c], 0x100
lea ecx, [ebp - 0x120]
xor ebx, ebx
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41d1fd
lea ecx, [ebp - 0x134]
lea eax, [ebp - 0x120]
push eax
call fcn.0041cf34
mov ebx, eax
test ebx, ebx
jne 0x41d15c
mov dword [ebp - 0x12c], 0x100
lea ecx, [ebp - 0x120]
xor ebx, ebx
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x41d10a
jmp 0x41d1fd
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x134]
test edx, edx
je 0x41d17e
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
test ebx, ebx
jne 0x41d1c0
mov dword [ebp - 0x240], 0x100
lea ecx, [ebp - 0x234]
xor ebx, ebx
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push ebx
push edx
push ecx
push ebx
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x41d03b
jmp 0x41d258
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x248]
test edx, edx
je 0x41d1e2
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x41d218
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x134]
test edx, edx
je 0x41d17e
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x134], 0
jmp 0x41d17e
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x41d273
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x248]
test edx, edx
je 0x41d2a6
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], 0
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4