Function at 0x40e7b3
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x41b014]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x408], 0
and dword [ebp - 0x410], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x418], edx
xor edi, edi
mov dword [ebp - 0x41c], esi
inc edi
call fcn.0040ed67
push 0x3d
pop ecx
call fcn.0040ef20
test eax, eax
je 0x40eaa8
call fcn.0040ed67
push 0x100
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x40c], ebx
test ebx, ebx
jne 0x40e82c
mov dword [0x41be24], 0x84
jmp 0x40eaad
push 0x22
pop ecx
call fcn.0040ef20
test eax, eax
je 0x40e874
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.0040eabe
test eax, eax
je 0x40e860
call fcn.0040ece9
test eax, eax
jne 0x40e86c
xor edi, edi
mov dword [ebp - 0x408], 1
xor esi, esi
inc esi
jmp 0x40e9ee
mov ecx, dword [0x401cb4]
call fcn.0040ef20
test eax, eax
je 0x40e8f5
movzx eax, word [0x401cb6]
mov esi, 0x401cb6
test ax, ax
je 0x40e8c0
mov ecx, eax
call fcn.0040ef20
lea esi, [esi + 2]
test eax, eax
jne 0x40e8ae
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40e896
test edi, edi
je 0x40ea98
call fcn.0040ed67
mov ecx, ebx
call fcn.0040ec57
test eax, eax
je 0x40e8d9
call fcn.0040ece9
test eax, eax
jne 0x40e8e5
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x40c]
push 4
pop ebx
mov esi, ebx
jmp 0x40ea00
push 0x2d
pop ecx
call fcn.0040ef20
test eax, eax
je 0x40e92b
call fcn.0040ece9
test eax, eax
jne 0x40e919
mov dword [ebp - 0x408], 1
jmp 0x40ea98
push dword [ebp - 0x418]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40ea98
movzx eax, word [0x401cac]
mov esi, 0x401cac
test ax, ax
je 0x40e968
mov ecx, eax
call fcn.0040ef20
lea esi, [esi + 2]
test eax, eax
jne 0x40e956
xor edi, edi
mov dword [ebp - 0x408], 1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40e93e
test edi, edi
je 0x40ea98
push 0x28
pop ecx
call fcn.0040ef20
test eax, eax
je 0x40e9a3
lea ecx, [ebp - 0x410]
call fcn.0040ec57
test eax, eax
je 0x40e98f
push 0x29
pop ecx
call fcn.0040ef20
test eax, eax
jne 0x40e99b
xor edi, edi
mov dword [ebp - 0x408], 1
mov esi, dword [ebp - 0x410]
jmp 0x40e9a6
push 3
pop esi
test edi, edi
je 0x40ea98
push 0x3a
pop ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], 0x100
call fcn.0040ef20
test eax, eax
je 0x40e9e2
lea ecx, [ebp - 0x414]
call fcn.0049adf4
test eax, eax
je 0x40e9e2
call fcn.0040ece9
test eax, eax
jne 0x40e9ee
xor edi, edi
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x414]
mov ebx, dword [ebp - 0x410]
mov dword [ebp - 0x40c], eax
test edi, edi
je 0x40ea92
cmp dword [0x41ce28], 0x500
jae 0x40ea73
cmp esi, 2
je 0x40ea1e
cmp esi, 7
jne 0x40ea73
xor ecx, ecx
lea eax, [ebp - 0x404]
push ecx
push ecx
push 0x400
push eax
push 0xffffffffffffffff
push dword [ebp - 0x418]
mov byte [ebp - 0x404], cl
push ecx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push ebx
push esi
push 0
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40ea98
mov dword [0x41be24], 0x84
jmp 0x40ea98
push ebx
push eax
push esi
push 0
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp - 0x40c]
jmp 0x40ea63
mov ebx, dword [ebp - 0x40c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x408], 0
je 0x40eaad
call fcn.0040ed95
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419cc0
mov esp, ebp
pop ebp
ret