Function at 0x40ed46
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x415884]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0x318], eax
mov bl, al
mov dword [ebp - 0x310], eax
mov esi, edx
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x31c], ecx
push eax
call sub.msvcrt.dll_memset
push 0x404184
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x40eda0
mov bl, 1
push ecx
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x318]
push eax
push ecx
lea ecx, [ebp - 0x30c]
call fcn.0040bfb6
test eax, eax
je 0x40edc7
movzx eax, ax
jmp 0x40f241
test bl, bl
je 0x40ede5
mov edx, dword [ebp - 0x320]
mov ecx, dword [ebp - 0x318]
push 0x403aec
call fcn.0040bf80
test eax, eax
jne 0x40edbf
lea eax, [ebp - 0x328]
mov dl, bl
push eax
lea ecx, [ebp - 0x30c]
call fcn.0040d5a7
test eax, eax
jne 0x40f241
mov ecx, dword [ebp - 0x328]
mov eax, 0x104
cmp ecx, eax
jbe 0x40ee18
push 0x7a
pop eax
jmp 0x40f241
push edi
sub eax, ecx
push 0x408f90
push eax
lea eax, [ebp + ecx*2 - 0x30e]
push eax
call fcn.0040c045
add esp, 0x10
test eax, eax
jne 0x40edbf
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x310]
push eax
xor eax, eax
push eax
push 3
push eax
push eax
push eax
lea eax, [ebp - 0x30c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40f241
mov edi, dword [ebp - 0x31c]
cmp edi, 1
jne 0x40f12d
mov eax, dword [esi + 0x30]
test eax, eax
je 0x40eea7
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push 0
push 0x401160
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
mov eax, dword [esi + 0x38]
test eax, eax
je 0x40eeda
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push 0
push 0x401178
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40ef0d
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push 0
push 0x401198
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
mov eax, dword [esi + 0x44]
test eax, eax
je 0x40ef40
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push 0
push 0x4011b8
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
test bl, bl
je 0x40ef4d
test dword [esi + 0x40], 0x2000000
je 0x40efae
cmp byte [0x415bdc], 0
je 0x40ef7a
push 0x20
push 0x416660
push 3
push 0
push 0x4011e4
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
cmp byte [0x415beb], 0
je 0x40efae
mov eax, dword [0x415be4]
shl eax, 2
push eax
push 0x415d20
push 3
push 0
push 0x401404
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
mov eax, dword [esi + 0x40]
test eax, eax
je 0x40efe1
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push 0
push 0x40122c
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40f014
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push 0
push 0x4012d8
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
and dword [ebp - 0x314], 0
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x40f077
add eax, esi
push eax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
movzx eax, word [ebp - 0x324]
add eax, 2
push eax
push dword [ebp - 0x320]
push 1
push 0
push 0x4011d0
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x40f071
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40f241
mov edi, dword [ebp - 0x31c]
test bl, bl
je 0x40f1d7
push 0xfe
xor ebx, ebx
lea eax, [ebp - 0x102]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x102]
push 0x7b
pop eax
mov word [ebp - 0x104], ax
lea eax, [esi + 0x18]
push eax
push 0x7f
pop edx
call fcn.0040c61c
lea ecx, [ebp - 0x104]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f0bb
sub ecx, edx
sar ecx, 1
push 0x7d
pop eax
mov word [ebp + ecx*2 - 0x104], ax
lea ecx, [ebp - 0x104]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f0de
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push ebx
push 0x401254
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x40f1d9
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40f241
push 0x401160
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x401178
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x401198
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4011b8
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4011e4
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x40122c
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4012d8
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4012f0
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4011d0
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x401254
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40f207
push 4
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x314]
push eax
push 4
push ebx
push 0x401208
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40f22a
push 4
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], edi
push eax
push 4
push ebx
push 0x401154
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x310], 0
je 0x40f23f
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413fa0
leave
ret 8