Function at 0x41f9ff
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x250], eax
mov edi, eax
mov esi, eax
mov dword [ebp - 0x254], ebx
lea eax, [ebp - 0x258]
push eax
push 0x2001f
push ebx
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ffb3
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x24c], ebx
push eax
push 0x2001f
push ebx
push 0x40416c
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fbc2
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fb9d
cmp dword [ebp - 0x250], esi
je 0x41fac9
cmp dword [ebp - 0x250], 2
jne 0x41fb9d
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41fb9d
mov eax, ecx
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea ecx, [ebp - 0x248]
call fcn.0041e3eb
test eax, eax
jne 0x41fb06
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41ffa7
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push 0x4040a4
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fb9b
cmp dword [ebp - 0x250], 1
je 0x41fb4d
cmp dword [ebp - 0x250], 2
jne 0x41fb9b
lea ecx, [ebp - 0x248]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41fb56
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push ebx
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4040a4
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41fb9d
mov edi, ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x41fbc2
mov ecx, dword [ebp - 0x258]
mov edx, 0x404194
call fcn.00426285
jmp 0x41fd1d
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push ebx
push 0x404194
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fd1d
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push 0x4031d0
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fc72
cmp dword [ebp - 0x250], 1
je 0x41fc2f
cmp dword [ebp - 0x250], 2
jne 0x41fc72
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41fc72
mov eax, ecx
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x4041ac
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x41fc72
push 0x4031d0
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push 0x4040a4
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fd04
cmp dword [ebp - 0x250], 1
je 0x41fcb9
cmp dword [ebp - 0x250], 2
jne 0x41fd04
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41fd04
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41fccb
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push ebx
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4040a4
jmp 0x41fd05
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push ebx
push 0x40403c
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fe55
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fdab
cmp dword [ebp - 0x250], 1
jne 0x41fdab
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41fdab
mov eax, ecx
push 0x404048
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov esi, eax
neg esi
pop ecx
sbb esi, esi
pop ecx
add esi, 1
je 0x41fe41
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push 0x4040a4
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fe30
cmp dword [ebp - 0x250], 1
jne 0x41fe30
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41fe30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41fdfb
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4040a4
jmp 0x41fe35
test edi, edi
jne 0x41fe41
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41ffa7
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push ebx
push 0x4041c8
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x4040a4
test eax, eax
jne 0x41ff20
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ff14
cmp dword [ebp - 0x250], 1
je 0x41fec3
cmp dword [ebp - 0x250], 2
jne 0x41ff14
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41ff14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41fed5
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push ebx
push ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ffa7
cmp dword [ebp - 0x250], 1
jne 0x41ffa7
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x41ffa7
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41ff6c
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret