Function at 0x40c9a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x228], eax
push ebp
push edi
lea eax, [esp + 0xc]
push eax
push 0x20019
xor ebp, ebp
push ebp
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
mov edi, ecx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cc54
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x1c]
push ecx
push ebp
lea edx, [esp + 0x38]
push edx
push ebp
push str.PendingFileRenameOperations
push eax
mov dword [esp + 0x34], ebp
call esi
test eax, eax
jne 0x40ca61
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ecx
push ebp
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebp
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
je 0x40ca61
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
push ebp
push str.PendingFileRenameOperations
push eax
call esi
test eax, eax
je 0x40ca61
mov ecx, dword [esp + 0x10]
push ecx
push ebp
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x10], ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x40cc52
push 0x200
lea eax, [esp + 0x3c]
push ebp
push eax
mov dword [esp + 0x2c], ebp
call fcn.0041be10
lea ecx, [esp + 0x40]
push ecx
push edi
call fcn.004010e1
lea edx, [esp + 0x4c]
push edx
push 1
mov edi, eax
push 0x4360b0
push edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x48], 1
call fcn.00401190
add esp, 0x24
mov ecx, str.Not_Found
lea eax, [esp + 0x38]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cae9
cmp dx, bp
je 0x40cae5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cae9
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x40cac3
xor eax, eax
jmp 0x40caee
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x40cbee
jmp 0x40cb00
cmp word [esp + 0x38], bp
je 0x40cbee
mov edi, dword [esp + 0x18]
shr edi, 1
cmp word [esi], bp
je 0x40cb89
test edi, edi
jbe 0x40cb89
push esi
mov ebp, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
lea esi, [esi + eax*2]
push esi
sub edi, eax
mov ebx, eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
lea esi, [esi + eax*2]
sub edi, eax
add ebx, eax
lea eax, [esp + 0x38]
push eax
lea ecx, [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40cb5e
mov edx, dword [esp + 0x28]
cmp word [edx], ax
je 0x40cb66
cmp word [esi], 0
jne 0x40cb16
jmp 0x40cb89
lea eax, [edi + edi]
push eax
push esi
push ebp
call fcn.0041ce00
mov ecx, dword [esp + 0x24]
add esp, 0xc
neg ebx
lea edx, [ecx + ebx*2]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x38]
push ecx
add eax, 1
push eax
push 0x4360b0
push edi
mov dword [esp + 0x34], eax
call fcn.00401190
add esp, 0x10
mov ecx, str.Not_Found
lea eax, [esp + 0x38]
xor ebp, ebp
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cbdd
cmp dx, bp
je 0x40cbd9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cbdd
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x40cbb7
xor eax, eax
jmp 0x40cbe2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
mov esi, dword [esp + 0x10]
jne 0x40cb00
push edi
call fcn.004012bc
add esp, 4
cmp dword [esp + 0x20], ebp
je 0x40cc43
lea edx, [esp + 0x14]
push edx
push 0x20006
push ebp
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cc43
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea ecx, [eax + eax]
push ecx
push esi
push 7
push ebp
push str.PendingFileRenameOperations
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
pop edi
pop ebp
xor ecx, esp
call fcn.0041bdf4
add esp, 0x22c
ret