Function at 0x40a36e
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x260
mov eax, dword [esp + 0x264]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x26c]
mov dword [esp + 0x10], eax
and dword [esp + 0x10], 4
je 0x40a398
push str.Open
jmp 0x40a3ac
test al, 8
je 0x40a3a3
push str.Edit
jmp 0x40a3ac
test al, 0x10
je 0x40a3b7
push str.Print
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x426110
mov esi, 0x429390
push 0x3b
push dword [esp + 0x20]
call fcn.0041c530
cmp eax, edi
pop ecx
pop ecx
mov dword [esp + 0x24], eax
je 0x40a3f7
sub eax, dword [esp + 0x1c]
sar eax, 1
inc eax
push eax
push dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x40a402
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [0x426110], di
je 0x40a938
push ebp
lea eax, [esp + 0x4c]
push 0x41df40
push eax
call ebx
add esp, 0xc
push edi
lea eax, [esp + 0x14]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [esp + 0x64]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a842
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x20]
push eax
push edi
push 0x41d4e0
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a478
cmp word [esp + 0x68], di
jne 0x40a4cd
test byte [esp + 0x27c], 1
je 0x40a4bf
lea eax, [esp + 0x4a]
push eax
lea eax, [esp + 0x6c]
push str._sfile
push eax
call ebx
add esp, 0xc
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [esp + 0x6c]
push eax
push 1
push edi
push 0x41d4e0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40a4cd
test byte [esp + 0x27c], 2
jne 0x40a952
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x20], edi
je 0x40a5b0
lea eax, [esp + 0x68]
push eax
push str._sDefaultIcon
push esi
call ebx
add esp, 0xc
push edi
lea eax, [esp + 0x14]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a5b0
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push edi
push 0x41d4e0
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a571
cmp word [0x429390], di
je 0x40a571
test byte [esp + 0x27c], 2
je 0x40a5a6
push dword [esp + 0x278]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a5a6
push 0x41d4e0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40a5a6
test byte [esp + 0x27c], 1
je 0x40a5a6
push dword [esp + 0x278]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x27c]
push 1
push edi
push 0x41d4e0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x6c]
push eax
push str._sShell_sCommand
push esi
call ebx
add esp, 0x10
test byte [esp + 0x27c], 0x10
mov eax, 0x41dee0
jne 0x40a5d9
mov eax, 0x41d4e0
push eax
push dword [esp + 0x27c]
push str.__s__s____1_
push ebp
call ebx
add esp, 0x10
push edi
lea eax, [esp + 0x14]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a842
test byte [esp + 0x27c], 1
je 0x40a6ad
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push edi
push 0x41d4e0
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a689
cmp word [0x429390], di
je 0x40a689
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a689
push edi
push edi
push edi
push edi
push str.AkelUndo
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a689
push dword [esp + 0x14]
push esi
push dword [esp + 0x20]
push edi
push str.AkelUndo
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push edi
push 0x41d4e0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40a838
test byte [esp + 0x27c], 2
je 0x40a838
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push edi
push str.AkelUndo
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a713
cmp word [0x429390], di
je 0x40a704
push dword [esp + 0x14]
push esi
push dword [esp + 0x20]
push edi
push 0x41d4e0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.AkelUndo
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push edi
push 0x41d4e0
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a838
cmp word [0x429390], di
je 0x40a757
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a838
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x6c]
push eax
push str._sShell_s
push esi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 8
push edi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a838
push str.Command
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x68]
push eax
push str._sShell
push esi
call ebx
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 8
push edi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a838
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
push edi
push edi
push edi
lea eax, [esp + 0x24]
push eax
push esi
push edi
push dword [esp + 0x2c]
mov dword [esp + 0x34], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40a838
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 8
push edi
lea eax, [esp + 0x74]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a838
push str.Shell
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x20], edi
je 0x40a938
lea eax, [esp + 0x48]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts_s
push ebp
call ebx
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 3
push edi
push ebp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a938
test byte [esp + 0x27c], 1
je 0x40a8d6
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x20]
push eax
push edi
push str.Application
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a938
cmp word [0x426110], di
je 0x40a8cf
push dword [esp + 0x14]
push ebp
push dword [esp + 0x20]
push edi
push str.AkelUndo
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.Application
jmp 0x40a92e
test byte [esp + 0x27c], 2
je 0x40a938
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x20]
push eax
push edi
push str.AkelUndo
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a938
cmp word [0x426110], di
je 0x40a929
push dword [esp + 0x14]
push ebp
push dword [esp + 0x20]
push edi
push str.Application
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.AkelUndo
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x24]
cmp ecx, edi
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
je 0x40a95c
cmp word [eax], di
jne 0x40a3cd
jmp 0x40a95c
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x260
ret