Function at 0x40cad0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x24c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], 0x1a8
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 8
cmp dword [0x5b2904], ebx
jne 0x40cb1b
mov edi, 0xf003f
cmp dword [0x5b2908], ebx
je 0x40cb20
mov edi, 0xf013f
call fcn.0044b8f0
mov esi, eax
call fcn.0044b920
cmp esi, ebx
je 0x40cb4b
cmp dword [esi + 0x37c], ebx
je 0x40cb4b
mov cl, byte [esi + 0x2af1]
lea eax, [esi + 2]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], cl
jmp 0x40cb68
cmp eax, ebx
je 0x40cb68
cmp dword [eax + 0x37c], ebx
je 0x40cb68
lea edx, [eax + 2]
mov al, byte [eax + 0x2af1]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], al
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0xc]
push ecx
push edi
push ebx
push str.SYSTEMCurrentControlSetServices_bcfntBootEnum
push closesocket
call esi
test eax, eax
je 0x40cbc0
cmp dword [0x5b2904], ebx
jne 0x40cb9a
mov eax, 1
cmp dword [0x5b2908], ebx
je 0x40cb9f
mov eax, 0x101
lea edx, [esp + 0xc]
push edx
push eax
push ebx
push str.SYSTEMCurrentControlSetServices_bcfntBootEnum
push closesocket
call esi
test eax, eax
jne 0x40cdf4
mov dword [esp + 0x24], ebx
jmp 0x40cbc8
mov dword [esp + 0x24], 1
push ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1ec]
push ecx
push ebx
push edx
xor ebp, ebp
mov dword [esp + 0x34], 0x1a8
mov dword [esp + 0x38], 0x20
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40cde8
lea esp, [esp]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1dc]
push 0x550694
push ecx
call fcn.00525c7d
add esp, 0xc
cmp eax, 1
jne 0x40cc39
mov edx, dword [esp + 0x1c]
mov dword [0x5c24e0], edx
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x40cc59
cmp dword [esp + 0x28], ebx
je 0x40cc59
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1d8]
push eax
push ecx
jmp 0x40cd9e
mov edx, dword [esp + 0x24]
push edx
mov ecx, 8
lea esi, [esp + 0x1bc]
lea edi, [esp + 0x23c]
push 0x1a8
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
push ecx
mov edx, ecx
push edx
push ebx
push eax
call fcn.004143e0
add esp, 0x18
test eax, eax
je 0x40cde8
call fcn.0044b6a0
mov esi, eax
test esi, esi
je 0x40cd32
lea edx, [esi + 2]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ccb0
sub eax, edi
sar eax, 1
lea ecx, [esp + 0x218]
push ecx
add eax, eax
push eax
push edx
call fcn.004535b0
add esp, 0xc
cmp dword [esi + 0x37c], 0
je 0x40cd20
mov eax, 0x20
xor ecx, ecx
jmp 0x40ccf0
mov edx, dword [esp + ecx + 0x238]
cmp edx, dword [esp + ecx + 0x218]
jne 0x40cd20
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x40ccf0
mov ebx, 1
mov dword [esi + 0x3b24], ebx
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x3b30], eax
mov esi, dword [esi + 0x3f54]
test esi, esi
jne 0x40cca1
test ebx, ebx
jne 0x40cda4
call fcn.0044b6a0
mov esi, eax
test esi, esi
je 0x40cd80
lea ecx, [ecx]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esi + 2]
push edx
call fcn.00525745
add esp, 8
test eax, eax
jne 0x40cd72
cmp dword [esi + 0x37c], eax
je 0x40cd72
mov ebx, 1
mov dword [esi + 0x3b24], ebx
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x3b30], eax
mov esi, dword [esi + 0x3f54]
test esi, esi
jne 0x40cd40
test ebx, ebx
jne 0x40cda4
cmp dword [esp + 0x28], 0
je 0x40cda4
cmp dword [esp + 0x260], 0
je 0x40cda4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1d8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
xor ebx, ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1ec]
push ecx
inc ebp
push ebp
push edx
mov dword [esp + 0x34], 0x1a8
mov dword [esp + 0x38], 0x20
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40cc10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x24c
ret