Function at 0x40e03c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, dword [0x54f9fc]
push ebx
push esi
push edi
push str.GetPhantosysIpAdapters__
push eax
call fcn.004125e8
mov edx, dword [ebp + 8]
add esp, 8
mov eax, dword [0x54f9fc]
mov ecx, dword [edx + 8]
push ecx
push str.nic_list__Count_d
push eax
call fcn.004125e8
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x40e083
xor eax, eax
jmp 0x40e299
mov edx, eax
shl edx, 5
add edx, eax
lea edx, [eax + edx*2]
shl edx, 2
push edx
call fcn.004e0050
pop ecx
mov edi, eax
push pe_nt_image_headers32
call fcn.004e0050
pop ecx
mov dword [ebp - 0x14], eax
xor esi, esi
lea ebx, [edi + 0x104]
jmp 0x40e143
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.00424510
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 0x18], ecx
mov ecx, esi
shl ecx, 5
add ecx, esi
lea ecx, [esi + ecx*2]
shl ecx, 2
add ecx, edi
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push esi
mov esi, eax
push edi
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, dword [ecx + 0x18e]
mov ecx, esi
add cl, 2
mov edx, dword [eax]
mov dword [ebx], edx
mov byte [ebx + 4], 0
mov byte [ebx + 5], cl
mov eax, dword [ebp - 4]
mov edx, dword [0x54f9fc]
add eax, 2
push eax
push esi
push str.__d___s
push edx
call fcn.004125e8
add esp, 0x10
inc esi
add ebx, 0x10c
mov ecx, dword [ebp + 8]
cmp esi, dword [ecx + 8]
jl 0x40e0b4
lea eax, [ebp - 8]
push eax
push str.SoftWarePhantosys
push reloc.WS2_32.DLL_bind
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x40e28d
xor esi, esi
push esi
push 0x511027
lea eax, [ebp - 0x28]
push eax
call fcn.004e3fec
add esp, 0xc
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], pe_nt_image_headers32
push edx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
push ecx
push eax
push 0
push edx
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x40e1bd
lea esi, [ebp - 0x28]
mov eax, dword [0x54f9fc]
push esi
push str._s_not_found___Exit
push eax
call fcn.004125e8
add esp, 0xc
jmp 0x40e235
xor ebx, ebx
lea eax, [edi + 0x108]
mov dword [ebp - 0x38], eax
jmp 0x40e21a
mov edx, ebx
shl edx, 5
add edx, ebx
lea edx, [ebx + edx*2]
shl edx, 2
add edx, edi
push edx
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004e116c
add esp, 8
test eax, eax
jne 0x40e212
lea ecx, [esi + 2]
push ecx
mov eax, dword [ebp - 0x14]
push eax
push ebx
push str.__d___s_found___last_adapter_no_d
mov edx, dword [0x54f9fc]
push edx
call fcn.004125e8
add esp, 0x14
mov eax, esi
add al, 2
mov edx, dword [ebp - 0x38]
mov byte [edx], al
jmp 0x40e222
inc ebx
add dword [ebp - 0x38], 0x10c
mov ecx, dword [ebp + 8]
cmp ebx, dword [ecx + 8]
jl 0x40e1ca
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.DLL_RegDeleteValueA
inc esi
jmp 0x40e16c
xor ebx, ebx
jmp 0x40e27c
push ebx
push str.NAN_d
lea eax, [ebp - 0x34]
push eax
call fcn.004e3fec
add esp, 0xc
mov esi, ebx
shl esi, 5
add esi, ebx
lea esi, [ebx + esi*2]
shl esi, 2
add esi, edi
push esi
call fcn.004e0ef8
pop ecx
inc eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
push eax
push esi
push 1
push 0
push edx
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
mov ecx, dword [ebp + 8]
cmp ebx, dword [ecx + 8]
jl 0x40e239
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0x14]
push edx
call fcn.004e0060
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret