Function at 0x405f18
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x428bd4
call fcn.00410ccc
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
push esi
cmp eax, 0x80000000
push edi
jne 0x405f39
mov edi, str.HKEY_CLASSES_ROOT_
jmp 0x405f90
cmp eax, 0x80000001
jne 0x405f47
mov edi, str.HKEY_CURRENT_USER_
jmp 0x405f90
cmp eax, 0x80000002
jne 0x405f55
mov edi, str.HKEY_LOCAL_MACHINE_
jmp 0x405f90
cmp eax, 0x80000003
jne 0x405f63
mov edi, str.HKEY_USERS_
jmp 0x405f90
cmp eax, 0x80000004
jne 0x405f71
mov edi, str.HKEY_PERFORMANCE_DATA_
jmp 0x405f90
cmp eax, 0x80000005
jne 0x405f7f
mov edi, str.HKEY_CURRENT_CONFIG_
jmp 0x405f90
cmp eax, 0x80000006
mov edi, str.HKEY_DYN_DATA_
je 0x405f90
mov edi, 0x4347e8
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
xor ebx, ebx
push 0xf003f
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
mov dword [ebp + 0xc], eax
je 0x40619c
cmp eax, ebx
je 0x406033
push str.RegOpenKeyEx_
lea ecx, [ebp - 0x1c]
call fcn.0041ee56
push edi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
call fcn.0041eff0
push esi
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.0041eff0
push 0x4342a8
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
call fcn.0041eff0
push dword [eax]
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
call fcn.0040bc53
pop ecx
mov byte [ebp - 4], 2
pop ecx
lea ecx, [ebp + 8]
call fcn.0041ede8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0041ede8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0041ede8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
jmp 0x406186
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], ebx
je 0x4060e3
push str.RegQueryInfoKey_
lea ecx, [ebp - 0x14]
call fcn.0041ee56
push edi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 4
push eax
call fcn.0041eff0
push esi
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 5
push eax
call fcn.0041eff0
push 0x4342a8
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 6
push eax
call fcn.0041eff0
push dword [eax]
mov byte [ebp - 4], 7
push dword [ebp + 0xc]
call fcn.0040bc53
pop ecx
mov byte [ebp - 4], 6
pop ecx
lea ecx, [ebp + 8]
call fcn.0041ede8
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0041ede8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.0041ede8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
jmp 0x406186
cmp dword [ebp - 0x20], ebx
ja 0x40618b
cmp dword [ebp - 0x24], ebx
ja 0x40618b
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40619c
push str.RegDeleteKey_
lea ecx, [ebp - 0x34]
call fcn.0041ee56
push edi
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 8
push eax
call fcn.0041eff0
push esi
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 9
push eax
call fcn.0041eff0
push 0x4342a8
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push eax
call fcn.0041eff0
push dword [eax]
mov byte [ebp - 4], 0xb
push dword [ebp + 0xc]
call fcn.0040bc53
pop ecx
mov byte [ebp - 4], 0xa
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0041ede8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.0041ede8
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.0041ede8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0041ede8
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push 1
pop eax
jmp 0x40618d