Function at 0x40f506
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1bc]
sub esp, 0x23c
mov eax, dword [0x49c250]
xor eax, ebp
mov dword [ebp + 0x1b8], eax
mov eax, dword [ebp + 0x1c8]
push ebx
push esi
mov esi, dword [ebp + 0x1cc]
push edi
mov edi, dword [ebp + 0x1c4]
push str.RegDeleteKeyExA
push str.ADVAPI32.DLL
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x50], 0x2001f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
call fcn.0040cfa4
test eax, eax
je 0x40f570
mov dword [ebp - 0x50], 0x2011f
push 0x47e220
push 0x49df30
call fcn.0045dff0
inc dword [esi]
pop ecx
pop ecx
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x50]
xor ebx, ebx
push ebx
push dword [ebp - 0x4c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f708
push dword [ebp - 0x4c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x54], ebx
je 0x40f5b9
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push edi
call dword [ebp - 0x54]
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40f6ea
mov eax, dword [ebp - 0x68]
dec eax
cmp eax, ebx
mov dword [ebp - 0x5c], eax
jl 0x40f6e1
mov esi, 0xff
push esi
lea eax, [ebp - 0x47]
push ebx
push eax
mov byte [ebp - 0x48], bl
call fcn.0045df50
add esp, 0xc
push 0x100
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
lea eax, [ebp + 0xb9]
push ebx
push eax
mov byte [ebp + 0xb8], bl
call fcn.0045df50
push dword [ebp - 0x4c]
lea eax, [ebp + 0xb8]
push eax
call fcn.0045dfe0
lea eax, [ebp + 0xb8]
push 0x47ab28
push eax
call fcn.0045dff0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0xb8]
push eax
call fcn.0045dff0
add esp, 0x24
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x50]
lea eax, [ebp + 0xb8]
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f6c7
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40f6c7
cmp dword [ebp - 0x6c], ebx
je 0x40f6be
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x70]
lea eax, [ebp + 0xb8]
push eax
push edi
call fcn.0040f506
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xb8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [ebp - 0x5c]
jns 0x40f5f8
mov esi, dword [ebp - 0x60]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], ebx
jne 0x40f708
push dword [ebp - 0x4c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x54], ebx
je 0x40f708
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push edi
call dword [ebp - 0x54]
mov ecx, dword [ebp + 0x1b8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0045dfca
add ebp, 0x1bc
leave
ret 0xc