Function at 0x10040d0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x10070b8]
push ebx
push edi
push 0xb
xor ebx, ebx
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x474], bx
lea edi, [ebp - 0x472]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x41c]
push eax
push 0x1003254
push 1
push ebx
push 0x1003234
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x428], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x1003e70
push eax
push 0x1001580
push ebx
push 0x39a
push reloc.KERNEL32.dll_WritePrivateProfileSectionW
call fcn.01005834
add esp, 0x14
jmp 0x1004175
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax]
push esi
mov edi, 0x10070f8
push edi
push eax
call dword [ecx + 0x1c]
cmp eax, ebx
mov esi, reloc.KERNEL32.dll_WritePrivateProfileSectionW
jge 0x1003ea1
push eax
push 0x1001e10
push ebx
push 0x3a1
push esi
call fcn.01005834
add esp, 0x14
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax]
lea edx, [ebp - 0x418]
push edx
push 0x1003264
push 0x1003244
push edi
push eax
call dword [ecx + 0x20]
cmp eax, ebx
jge 0x1003edd
push eax
push 0x1001dd0
push ebx
push 0x3ab
push esi
call fcn.01005834
add esp, 0x14
jmp 0x1004174
lea eax, [ebp - 0x414]
push eax
call fcn.01005ace
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1001dcc
lea eax, [ebp - 0x414]
push eax
call edi
push 0x1001db0
lea eax, [ebp - 0x414]
push eax
call edi
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
lea edx, [ebp - 0x414]
push edx
push eax
call dword [ecx + 0x80]
cmp eax, ebx
jge 0x1003f33
push eax
push 0x1001d60
push ebx
push 0x3b6
jmp 0x1003ecf
push 0x1001d54
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [0x1007300]
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x1001d50
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [0x100730c]
inc eax
push eax
push 0x1001d44
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x88]
cmp eax, ebx
jge 0x1003fb4
push eax
push 0x1001d00
push ebx
push 0x3c3
jmp 0x1003ecf
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push ebx
push 0x1001cfc
push eax
call dword [ecx + 0x78]
cmp eax, ebx
jge 0x1003fdb
push eax
push 0x1001ca8
push ebx
push 0x3c9
jmp 0x1003ecf
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
lea edx, [ebp - 0x424]
push edx
lea edx, [ebp - 0x434]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x100400a
push eax
push 0x1001c60
push ebx
push 0x3cf
jmp 0x1003ecf
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 1
push ebx
push ebx
push dword [ebp - 0x42c]
call fcn.01005740
mov ecx, dword [ebp - 0x430]
xor edi, edi
add eax, ecx
adc edx, edi
add eax, dword [ebp + 8]
adc edx, dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x42c], edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [ebp - 0x444]
mov word [ebp - 0x470], ax
mov ax, word [ebp - 0x442]
mov word [ebp - 0x46e], ax
mov ax, word [ebp - 0x43e]
mov word [ebp - 0x46c], ax
mov ax, word [ebp - 0x43c]
mov word [ebp - 0x464], ax
mov ax, word [ebp - 0x43a]
mov word [ebp - 0x462], ax
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 0x474]
inc edi
push edx
mov word [ebp - 0x474], 0x30
mov dword [ebp - 0x460], 0x5a0
mov dword [ebp - 0x45c], 0x3c
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], edi
mov word [ebp - 0x450], di
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x100410b
push eax
push 0x1001c20
push ebx
push 0x3ef
jmp 0x1003ecf
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
lea edx, [ebp - 0x420]
push edx
push 0x10032a4
push eax
call dword [ecx]
cmp eax, ebx
jge 0x1004137
push eax
push 0x1001bc0
push ebx
push 0x3f7
jmp 0x1003ecf
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax]
push edi
push ebx
push eax
call dword [ecx + 0x18]
cmp eax, ebx
jge 0x100415a
push eax
push 0x1001b70
push ebx
push 0x3fd
jmp 0x1003ecf
push 0x1001b20
push ebx
push 0x401
push esi
call fcn.01005834
add esp, 0x10
mov dword [ebp - 0x428], edi
pop esi
mov eax, dword [ebp - 0x41c]
cmp eax, ebx
je 0x1004185
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x418]
cmp eax, ebx
je 0x1004195
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x424]
cmp eax, ebx
je 0x10041a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x420]
pop edi
cmp eax, ebx
pop ebx
je 0x10041b7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x428]
call fcn.01005458
leave
ret 8