Function at 0x41044b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
lea eax, [ebp - 4]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0xc]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x10]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x14]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x28]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x2c]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x28]
push eax
push 0x20006
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_RegOpenKeyExA
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
je 0x410538
mov eax, dword [ebp - 0x18]
mov ecx, 2
cmp eax, ecx
jne 0x4104ea
lea eax, [ebp - 4]
mov ecx, 0xffffffa2
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x410538
jmp 0x41077b
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jne 0x410519
lea eax, [ebp - 4]
mov ecx, 0xffffffa1
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x410538
jmp 0x41077b
lea eax, [ebp - 4]
mov ecx, 0xffffec77
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x410538
jmp 0x41077b
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_RegQueryInfoKeyA
mov ecx, 0
cmp eax, ecx
je 0x4105a2
lea eax, [ebp - 4]
mov ecx, 0xffffec76
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x4105a2
jmp 0x41077b
mov eax, dword [ebp - 0x1c]
mov ecx, 0
cmp eax, ecx
je 0x410758
mov eax, dword [ebp - 0x1c]
mov ecx, 0x7fffffff
cmp eax, ecx
jbe 0x4105d4
lea eax, [ebp - 0x30]
mov ecx, 0x7fffffff
mov dword [eax], ecx
lea eax, [0x4105dc]
jmp eax
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov ecx, 1
add eax, ecx
push eax
call sub.cvirte.dll_malloc
add esp, 4
lea ecx, [ebp - 0xc]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x410628
lea eax, [ebp - 4]
mov ecx, 0xfffffff4
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x410628
jmp 0x41077b
mov eax, dword [ebp - 0xc]
mov ecx, 0
mov byte [eax], cl
lea eax, [ebp - 8]
mov ecx, 1
mov dword [eax], ecx
jmp 0x410724
mov eax, dword [ebp - 0x20]
mov ecx, 1
add eax, ecx
lea ecx, [ebp - 0x24]
mov dword [ecx], eax
lea eax, [ebp - 0x24]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
mov ecx, 0
cmp eax, ecx
je 0x4106a6
lea eax, [ebp - 4]
mov ecx, 0xffffec76
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x4106a6
jmp 0x41077b
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_RegDeleteKeyA
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
je 0x410713
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jne 0x4106f4
lea eax, [ebp - 4]
mov ecx, 0xffffffa1
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x410713
jmp 0x41077b
lea eax, [ebp - 4]
mov ecx, 0xffffffeb
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
jge 0x410713
jmp 0x41077b
mov eax, dword [ebp - 8]
lea eax, [ebp - 8]
mov ecx, dword [eax]
mov edx, 1
add ecx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jbe 0x410641
mov eax, dword [ebp - 0xc]
mov ecx, 0
cmp eax, ecx
je 0x410758
mov eax, dword [ebp - 0xc]
push eax
call sub.cvirte.dll_free
add esp, 4
lea eax, [ebp - 0xc]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov ecx, 0
cmp eax, ecx
je 0x41077b
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_RegCloseKey
lea eax, [ebp - 0x28]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, 0
cmp eax, ecx
je 0x410797
mov eax, dword [ebp - 0xc]
push eax
call sub.cvirte.dll_free
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, 0
cmp eax, ecx
je 0x4107b3
mov eax, dword [ebp - 0x10]
push eax
call sub.cvirte.dll_free
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, 0
cmp eax, ecx
je 0x4107cf
mov eax, dword [ebp - 0x14]
push eax
call sub.cvirte.dll_free
add esp, 4
mov eax, dword [ebp - 0x2c]
mov ecx, 0
cmp eax, ecx
je 0x4107e8
mov eax, dword [ebp - 0x2c]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 0x28]
mov ecx, 0
cmp eax, ecx
je 0x410801
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
leave
ret 8