Function at 0x404820
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov ecx, dword [0x417fc4]
mov eax, dword [0x417fc8]
mov dword [ebp - 0x1c], 0
lea eax, [eax + ecx*4]
add eax, 0xfffffffc
mov dword [ebp - 0x20], eax
test ecx, ecx
je 0x404c0c
push ebx
push esi
mov dword [ebp - 0x10], 0
push edi
mov ebx, dword [eax]
mov edx, dword [0x417ff0]
mov ecx, dword [ebx]
cmp word [ecx], 0x2e
jne 0x4048c2
mov ecx, dword [0x417144]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x404870
mov edx, dword [ebx]
cmp word [edx + 2], 0x5c
jne 0x4048d3
add edx, 4
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404890
mov edi, dword [0x417ff0]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4048a6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4048d3
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x4048c2
mov eax, dword [ebx + 4]
push dword [0x417ff0]
cmp word [eax], 0
je 0x404b7f
call fcn.00401000
mov edx, dword [ebx + 4]
add esp, 4
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4048f3
mov edi, dword [0x417ff0]
sub edx, esi
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404910
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x417fb4]
mov eax, dword [0x417ff0]
mov esi, 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x104
test ecx, ecx
je 0x40496d
push 0x36
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404968
lea ecx, [ebp - 0x2c]
push ecx
push 0x417128
call eax
test eax, eax
je 0x404b99
mov eax, dword [0x417ff0]
push eax
call fcn.00401c40
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
test byte [ebx + 8], 1
mov dword [ebp - 0x24], eax
je 0x404a91
lea eax, [ebp - 8]
push eax
push 0xf003f
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404a19
lea edi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [0x417ff0]
mov dword [ebp - 4], 1
push dword [ebp - 8]
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a19
mov eax, dword [ebp - 4]
test eax, eax
je 0x4049ee
dec eax
mov dword [ebp - 4], eax
xor ecx, ecx
test eax, eax
cmovne esi, ecx
cmp dword [ebp - 0x24], ecx
je 0x4049fe
test eax, eax
je 0x404a19
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
push 0
push dword [0x417ff0]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x404a84
lea eax, [ebp - 0xc]
push eax
push 0x800
call fcn.004028f0
add esp, 8
test eax, eax
je 0x404a6d
push dword [0x417ff0]
push 0xa
push dword [ebp - 0xc]
call fcn.00402f20
mov eax, dword [ebp - 0xc]
add esp, 0xc
cmp word [eax], 0
je 0x404a61
push 0x24
push eax
call fcn.00403370
xor ecx, ecx
add esp, 8
cmp eax, 6
cmovne esi, ecx
lea eax, [ebp - 0xc]
push eax
call fcn.00402930
add esp, 4
test esi, esi
je 0x404a84
test edi, edi
je 0x404a91
push dword [0x417ff0]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x404a91
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404b99
test byte [ebx + 8], 2
je 0x404aad
push dword [0x417ff0]
call fcn.00402790
add esp, 4
test byte [ebx + 8], 4
je 0x404ab8
call fcn.004054d0
push dword [0x417ff0]
call fcn.004011d0
add esp, 4
test eax, eax
je 0x404b99
mov edi, edi
cmp eax, 1
jne 0x404b99
push 2
push dword [0x417ff0]
call fcn.00401130
add esp, 8
cmp eax, 1
jne 0x404b99
test byte [ebx + 8], 6
jne 0x404b4a
mov eax, dword [0x417104]
cmp eax, 0xffffffff
jne 0x404b45
push dword [0x417ff0]
call fcn.004029b0
add esp, 4
sub eax, 6
jne 0x404b36
push 2
push dword [0x417ff0]
call fcn.00401180
push dword [0x417ff0]
call fcn.004011d0
add esp, 0xc
test eax, eax
jne 0x404ad0
jmp 0x404b99
sub eax, 0x3e3
je 0x404b73
dec eax
je 0x404b67
mov eax, dword [0x417104]
cmp eax, 1
jne 0x404b99
push 2
push dword [0x417ff0]
call fcn.00401180
push dword [0x417ff0]
call fcn.004011d0
add esp, 0xc
jmp 0x404b99
mov dword [0x417104], 0
jmp 0x404b99
mov dword [0x417104], 1
jmp 0x404b4a
call fcn.00401d50
add esp, 4
test eax, eax
jne 0x404b99
push dword [0x417ff0]
call fcn.00401fa0
add esp, 4
mov ecx, dword [0x417fa8]
mov esi, dword [ebp - 0x10]
test ecx, ecx
je 0x404be7
xor edx, edx
mov eax, esi
div ecx
mov ecx, 0x64
cmp eax, 0x64
cmova eax, ecx
cmp dword [0x417fa4], eax
je 0x404be7
mov ecx, dword [0x417fa0]
mov dword [0x417fa4], eax
test ecx, ecx
je 0x404bdd
push 0
push eax
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call fcn.004030e0
add esp, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc edx
add esi, 0x64
sub eax, 4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], eax
cmp edx, dword [0x417fc4]
jb 0x404853
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret