Function at 0x415a63
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
and byte [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [esp + 0x1d]
cmp dword [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
mov ebp, 0x80000000
stosb byte es:[edi], al
pop ebx
mov eax, 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
je 0x415b5f
mov ebx, 0x80000002
push 0x405b04
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, 0x418a34
mov edi, 0x405ae0
push esi
push edi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xc
push 0x404a50
push 1
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push ebx
call edi
cmp dword [0x42bdd4], 0
je 0x415be0
call fcn.00415821
test eax, eax
jne 0x415be0
lea eax, [esp + 0x14]
mov ebx, 0x405948
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x415b36
lea eax, [esp + 0x1c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [esp + 0x20]
push eax
push 1
push 0x405adc
push ebx
push ebp
call edi
push 0x404a50
lea eax, [esp + 0x20]
push 0x104
push eax
push dword [0x42c490]
call fcn.0040d7bb
lea eax, [esp + 0x2c]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
jmp 0x415bd3
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0041592e
pop ecx
mov esi, 0x418a34
pop ecx
mov edi, 0x405ae0
push esi
push edi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xc
push 0x405acc
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 0x80000002
call edi
call fcn.00415821
test eax, eax
je 0x415be0
lea eax, [esp + 0x14]
mov ebx, 0x405948
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push 0x405adc
push ebx
push ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x415be0
lea eax, [esp + 0x1c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [esp + 0x20]
push eax
push 1
push esi
push ebx
push ebp
call edi
mov ebx, 0x405ac0
push 8
push ebx
push 1
push esi
push 0x405ab8
push ebp
call edi
push 8
push ebx
push 1
push esi
push 0x405ab0
push ebp
call edi
push 8
push ebx
push 1
push esi
push 0x405aa8
push ebp
call edi
push 8
push ebx
push 1
push esi
push 0x405aa0
push ebp
call edi
push 4
push 0x404040
push 1
push esi
push 0x405a90
push ebp
call edi
push dword [esp + 0x12c]
mov ebx, dword [esp + 0x12c]
push ebx
push 0x405a90
call fcn.00415951
add esp, 0xc
push 0x10
push 0x405a7c
push 1
push esi
push 0x405a74
push ebp
call edi
push dword [esp + 0x12c]
push ebx
push 0x405a5c
call fcn.00415951
add esp, 0xc
push 9
push 0x405a50
push 1
push esi
push 0x405a48
push ebp
call edi
push 9
push 0x405a50
push 1
push esi
push 0x405a40
push ebp
call edi
mov esi, dword [esp + 0x12c]
push esi
push ebx
push 0x405a30
call fcn.00415951
push esi
push ebx
push 0x405a24
call fcn.00415951
push esi
push ebx
push 0x405a18
call fcn.00415951
push esi
push ebx
push 0x405a0c
call fcn.00415951
add esp, 0x30
lea eax, [esp + 0x18]
xor esi, esi
push eax
push 0xa
push 2
push 0x4059e8
push esi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
cmp ebx, esi
je 0x415cfe
cmp dword [0x42bdd4], esi
je 0x415d05
push 1
jmp 0x415cff
push esi
call fcn.00417ef9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret