Function at 0x40e5e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
xor ebx, ebx
push 0x4263ec
push connect
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40e622
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
push 0x2000
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40e841
mov ecx, 0x7fc
xor eax, eax
mov edi, esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0x1ff0
rep stosd dword es:[edi], eax
cmp dword [esp + 0x28], ebx
je 0x40e65d
push 0x4274e8
jmp 0x40e662
push 0x4274d4
mov ebp, dword [sym.imp.MSVCRT.dll_wcscpy]
push esi
call ebp
mov eax, dword [esp + 0x1c]
add esp, 8
lea ecx, [esp + 0x10]
lea ebx, [esi + 0x10]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push 0
push 0x4263d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e7ca
push 0x2000
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 4
test edi, edi
je 0x40e71f
push ebx
push edi
call ebp
push edi
call dword [sym.imp.MSVCRT.dll__wcslwr]
mov eax, dword [esp + 0x34]
add esp, 0xc
test eax, eax
je 0x40e6d6
mov ebp, dword [sym.imp.MSVCRT.dll_wcsstr]
push 0x4274c4
push edi
call ebp
add esp, 8
test eax, eax
je 0x40e6f3
jmp 0x40e6eb
mov ebp, dword [sym.imp.MSVCRT.dll_wcsstr]
push 0x4274b4
push edi
call ebp
add esp, 8
test eax, eax
je 0x40e6f3
mov dword [esp + 0x1c], 1
push 0x4274a8
push edi
call ebp
add esp, 8
test eax, eax
je 0x40e70a
mov dword [esp + 0x20], 1
push edi
call sub.MFC42u.DLL_operatordelete
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
jne 0x40e7f2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
shr edx, 1
test eax, eax
mov word [esi + edx*2 + 0x10], 0
push ebx
je 0x40e73c
call fcn.004121a0
jmp 0x40e741
call fcn.00412230
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
call edi
lea eax, [eax + eax + 2]
add esp, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40e7a9
push 0x4274a8
push esi
call fcn.004122c0
push esi
call edi
lea eax, [eax + eax + 2]
lea ecx, [esi + 0xa]
push eax
push esi
push ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [0x42749c]
mov edx, esi
add esp, 0x10
mov dword [edx], eax
mov ecx, dword [0x4274a0]
mov dword [edx + 4], ecx
mov ax, word [0x4274a4]
mov word [edx + 8], ax
mov eax, dword [esp + 0x10]
add eax, 0xa
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push esi
push edx
push 0
push 0x4263d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40e838
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push 0x4263d0
push ecx
mov dword [esp + 0x28], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e838
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push esi
push eax
push 0
push 0x4263d0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push connect
push 0x427438
call fcn.00412b20
push connect
push 0x4273c8
call fcn.00412b20
push connect
push 0x427354
call fcn.00412b20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4