Function at 0x40ca10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0xc]
push ebx
push esi
push edi
push 0
push 0
push eax
push edx
push 0
push ecx
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
test eax, eax
je 0x40ca4c
or eax, 0xffffffff
jmp 0x40cc93
inc dword [ebp - 0x10]
inc dword [ebp - 0xc]
inc dword [ebp - 8]
mov edx, dword [ebp - 8]
push edx
call fcn.00468dd0
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00468dd0
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00468dd0
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00468dd0
pop ecx
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
jmp 0x40caeb
mov edx, dword [ebp - 0x24]
push edx
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push esi
mov edx, dword [ebp + 0x10]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x40cadc
push edi
call fcn.00468de0
pop ecx
push ebx
call fcn.00468de0
pop ecx
push esi
call fcn.00468de0
pop ecx
mov ecx, dword [ebp - 4]
push ecx
call fcn.00468de0
pop ecx
or eax, 0xffffffff
jmp 0x40cc93
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x28]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
push edx
push ecx
push 0
push eax
push esi
mov edx, dword [ebp - 0x28]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ADVAPI32.DLL_RegEnumValueA
cmp eax, 0x103
jne 0x40ca99
push esi
call fcn.00468de0
pop ecx
mov eax, dword [ebp - 4]
push eax
call fcn.00468de0
pop ecx
xor edx, edx
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x40cc5d
lea edx, [ebp - 0x30]
push edx
push 0x10f003f
push 0
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x40cb68
push edi
call fcn.00468de0
pop ecx
push ebx
call fcn.00468de0
pop ecx
or eax, 0xffffffff
jmp 0x40cc93
xor edx, edx
mov dword [ebp - 0x34], edx
xor esi, esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40cb95
mov edx, dword [ebp - 0x34]
push edx
call fcn.00468dd0
mov esi, eax
lea eax, [ebp - 0x34]
pop ecx
push eax
push esi
push 0xf
mov edx, dword [ebp - 0x30]
push edx
call dword [0x49a8d8]
jmp 0x40cb9a
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x44], 0xc
mov dword [ebp - 0x40], esi
xor eax, eax
mov dword [ebp - 0x3c], eax
push 0
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x44]
push ecx
push 0x10f003f
push 0
push edi
push 0
push ebx
mov eax, dword [ebp + 0x10]
push eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x40cbf5
test esi, esi
je 0x40cbd6
push esi
call fcn.00468de0
pop ecx
mov edx, dword [ebp - 0x30]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
push ebx
call fcn.00468de0
pop ecx
push edi
call fcn.00468de0
pop ecx
or eax, 0xffffffff
jmp 0x40cc93
test esi, esi
je 0x40cc00
push esi
call fcn.00468de0
pop ecx
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x30]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ca10
add esp, 0xc
inc eax
jne 0x40cc3c
mov edx, dword [ebp - 0x38]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov ecx, dword [ebp - 0x30]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
push ebx
call fcn.00468de0
pop ecx
push edi
call fcn.00468de0
pop ecx
or eax, 0xffffffff
jmp 0x40cc93
mov edx, dword [ebp - 0x38]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov ecx, dword [ebp - 0x30]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
inc dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0x1c]
push ecx
push edi
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
mov edx, dword [ebp - 0x28]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
cmp eax, 0x103
jne 0x40cb39
push ebx
call fcn.00468de0
pop ecx
push edi
call fcn.00468de0
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret