Function at 0x40c650
Capabilities:
Delete registry key
Get common file path
Get program files directory
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x412043
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x848
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x458]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x350]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor ebx, ebx
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x354]
push 0x26
push eax
push ebx
mov dword [esp + 0x38], ebp
call esi
lea ecx, [esp + 0x350]
lea edx, [esp + 0x458]
push ecx
push 0x41b01c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x464]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
je 0x40cc44
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x248]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24c]
push 0x26
push ecx
push ebx
stosb byte es:[edi], al
call esi
mov edi, 0x41aff8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x41c354
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString_1
push 0x41afe4
lea ecx, [esp + 0x24]
mov dword [esp + 0x864], ebx
call fcn.0041030a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00410436
mov ecx, ebp
call fcn.0040d050
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x144]
lea edx, [esp + 0x144]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x248]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41afd0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x144]
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebp
call fcn.0040d1f0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 1
jne 0x40c814
lea ecx, [esp + 0x144]
push ebx
push ecx
mov ecx, ebp
call fcn.0040d280
cmp eax, 1
jne 0x40c814
push 0x64
call esi
push 0xf
call esi
push SysReAllocString
lea ecx, [esp + 0x3c]
call fcn.0040f160
push 0x41c354
lea ecx, [esp + 0x14]
mov byte [esp + 0x864], 1
call sub.MFC42.DLL_CString::CString_1
push 0x41c354
lea ecx, [esp + 0x28]
mov byte [esp + 0x864], 2
call sub.MFC42.DLL_CString::CString_1
push 0x41c354
lea ecx, [esp + 0x38]
mov byte [esp + 0x864], 3
call sub.MFC42.DLL_CString::CString_1
push 0x41afa8
push 0x41afa0
push 0x41af94
mov byte [esp + 0x86c], 4
call fcn.00408610
add esp, 0xc
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x18]
push edx
push 0xf003f
push ebx
push 0x41af64
push SysReAllocString
mov dword [esp + 0x2c], ebx
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
jne 0x40c983
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], esi
push 0x2001f
push 0x41c354
push esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x86c], 6
call fcn.0040efb0
cmp eax, ebx
jne 0x40c967
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea edx, [esp + 0x54]
push ecx
push edx
push ebx
push eax
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40c94c
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040f000
cmp eax, ebx
jne 0x40c967
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x54]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40c910
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40c95f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
push 0x41c354
push esi
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x860], 5
call fcn.0040ef90
cmp esi, ebx
je 0x40c983
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x18]
mov byte [esp + 0x860], 7
push eax
push 0xf003f
push ebx
push 0x41af4c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call ebp
cmp eax, ebx
jne 0x40ca81
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], esi
push 0x2001f
push 0x41c354
push esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x86c], 8
call fcn.0040efb0
cmp eax, ebx
jne 0x40ca5f
lea ecx, [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ecx
mov ecx, dword [esp + 0x18]
push ebx
push ebx
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x54]
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call ebp
test eax, eax
jne 0x40ca44
lea edx, [esp + 0x44]
lea ecx, [esp + 0x14]
push edx
call fcn.0040f000
cmp eax, ebx
jne 0x40ca5f
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea edx, [esp + 0x54]
push ecx
push edx
push ebx
push eax
mov dword [esp + 0x38], 0x100
call ebp
test eax, eax
je 0x40ca0c
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40ca57
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
push 0x41c354
push esi
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x860], 7
call fcn.0040ef90
cmp esi, ebx
je 0x40ca81
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x1c], esi
push 0x41af94
push 0x41af40
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x41af10
call fcn.0041030a
mov ecx, dword [esp + 0x10]
push 0x41aef8
push ecx
push SysReAllocString
call fcn.0040bec0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x41aee0
call fcn.0041043c
mov edx, dword [esp + 0x10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x41aea0
lea ecx, [esp + 0x14]
call fcn.0041030a
mov eax, dword [esp + 0x10]
push 0x41ae1c
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov ecx, dword [esp + 0x1c]
push 0x41ae90
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov edx, dword [esp + 0x28]
push 0x41ae84
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov eax, dword [esp + 0x34]
push 0x41ae78
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov ecx, dword [esp + 0x40]
push 0x41ae68
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov edx, dword [esp + 0x4c]
add esp, 0x3c
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x41ae2c
lea ecx, [esp + 0x14]
call fcn.0041030a
mov eax, dword [esp + 0x10]
push 0x41ae1c
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov ecx, dword [esp + 0x1c]
push 0x41ae90
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov edx, dword [esp + 0x28]
push 0x41ae84
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov eax, dword [esp + 0x34]
push 0x41ae78
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov ecx, dword [esp + 0x40]
push 0x41ae68
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040bec0
mov edx, dword [esp + 0x4c]
add esp, 0x3c
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [esp + 0x28]
call fcn.0040cc60
cmp esi, ebx
je 0x40cbed
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x34]
mov byte [esp + 0x860], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x860], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x860], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x860], bl
call fcn.0040f1a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x860], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x858]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x854
ret