Function at 0x405840
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x4431cc]
xor eax, ebp
push ebx
mov dword [esp + 0x824], eax
push esi
push edi
xor eax, eax
xor esi, esi
mov word [esp + 0x228], si
mov ecx, 0x7f
lea edi, [esp + 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x628], si
mov ecx, 0x7f
lea edi, [esp + 0x62a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [ebp + 8]
xor eax, eax
mov word [esp + 0x428], si
mov ecx, 0x7f
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x20], si
mov ecx, 0x81
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push esi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
mov ecx, 0x44d2d0
jne 0x405bfc
push str.Opening_the_Sub_Registry_Key:
call fcn.00402680
push ebx
mov ecx, 0x44d2d0
call fcn.00402680
push 0x433110
mov ecx, 0x44d2d0
call fcn.00402680
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push esi
push esi
push esi
xor eax, eax
push esi
mov ecx, 0x80
lea edi, [esp + 0x638]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x63c]
push edx
push esi
push eax
mov dword [esp + 0x34], 0x200
call ebx
cmp eax, 0x103
je 0x4059d3
cmp eax, esi
jne 0x4059d3
push str.Deleting_the_data_Key:
mov ecx, 0x44d2d0
call fcn.00402680
lea ecx, [esp + 0x628]
push ecx
mov ecx, 0x44d2d0
call fcn.00402680
push 0x433110
mov ecx, 0x44d2d0
call fcn.00402680
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x628]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push esi
push esi
xor eax, eax
push esi
mov ecx, 0x80
lea edi, [esp + 0x638]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x63c]
push edx
push esi
push eax
mov dword [esp + 0x34], 0x200
call ebx
cmp eax, 0x103
jne 0x405954
mov eax, dword [esp + 0x10]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x23c]
push edx
push esi
push eax
mov dword [esp + 0x3c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x405b52
test esi, esi
jne 0x405b52
mov ecx, 0x80
lea edi, [esp + 0x428]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x42c]
push edx
call fcn.004145fa
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x434]
push ecx
call fcn.004145d0
lea edx, [esp + 0x438]
push 0x4330e4
push edx
call fcn.004145d0
lea eax, [esp + 0x440]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404400
add esp, 0x20
lea ecx, [esp + 0x428]
push ecx
mov ecx, 0x44d2d0
mov esi, eax
call fcn.00402680
test esi, esi
jne 0x405a89
push str._:_Security_Properties_for_the_registry_key_are_set_r_n
jmp 0x405abc
push 0xa
lea edx, [esp + 0x24]
push edx
push esi
call fcn.00414ddb
add esp, 0xc
push str._:_failed_to_set_the_Security_options_for_the_registry_key__error_:
mov ecx, 0x44d2d0
call fcn.00402680
lea eax, [esp + 0x20]
push eax
mov ecx, 0x44d2d0
call fcn.00402680
push 0x433110
mov ecx, 0x44d2d0
call fcn.00402680
lea ecx, [esp + 0x428]
push ecx
call fcn.00405840
mov eax, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x228]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [esp + 0x228]
push ecx
mov ecx, 0x44d2d0
mov esi, eax
call fcn.00402680
test esi, esi
jne 0x405b15
push str._:_registry_key_deleted_r_n
mov ecx, 0x44d2d0
call fcn.00402680
jmp 0x405918
push 0xa
lea edx, [esp + 0x24]
push edx
push esi
call fcn.00414ddb
add esp, 0xc
push str._:_failed_to_delete_registry_key__error_:
mov ecx, 0x44d2d0
call fcn.00402680
lea eax, [esp + 0x20]
push eax
mov ecx, 0x44d2d0
call fcn.00402680
push 0x433110
mov ecx, 0x44d2d0
call fcn.00402680
lea ecx, [esp + 0x228]
push 0x433190
push ecx
call fcn.004150fa
add esp, 8
test eax, eax
je 0x405bda
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x228]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [esp + 0x228]
push ecx
mov ecx, 0x44d2d0
mov esi, eax
call fcn.00402680
test esi, esi
jne 0x405b9d
push str._:_registry_key_deleted_r_n
jmp 0x405bd0
push 0xa
lea edx, [esp + 0x24]
push edx
push esi
call fcn.00414ddb
add esp, 0xc
push str._:_failed_to_delete_registry_key__error_:
mov ecx, 0x44d2d0
call fcn.00402680
lea eax, [esp + 0x20]
push eax
mov ecx, 0x44d2d0
call fcn.00402680
push 0x433110
mov ecx, 0x44d2d0
call fcn.00402680
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, ebp
call fcn.00414a22
mov esp, ebp
pop ebp
ret
push str.UnSuccessful_in_opening_the_Reg_key:
call fcn.00402680
push ebx
mov ecx, 0x44d2d0
call fcn.00402680
push str.Error:
mov ecx, 0x44d2d0
call fcn.00402680
push 0xa
lea edx, [esp + 0x24]
push edx
push edi
call fcn.00414ddb
add esp, 0xc
lea eax, [esp + 0x20]
push eax
mov ecx, 0x44d2d0
call fcn.00402680
push 0x433110
mov ecx, 0x44d2d0
call fcn.00402680
mov ecx, dword [esp + 0x82c]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414a22
mov esp, ebp
pop ebp
ret