Function at 0x40bafad7
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp eax, 9
ja case.default.0x40bafaed
jmp dword [eax*4 + 0x40bafcd7]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40bafcd0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40bafcd0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
jmp 0x40bafcd0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40bafcd0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40bafcd0
mov edi, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x18]
mov eax, edi
neg eax
sbb eax, eax
lea ecx, [ebp - 8]
and eax, ecx
push eax
mov eax, ebx
neg eax
sbb eax, eax
lea ecx, [ebp + 0x10]
and eax, ecx
push eax
push dword [ebp + 0x20]
mov eax, esi
push dword [ebp + 0x1c]
neg eax
sbb eax, eax
lea ecx, [ebp + 0xc]
and eax, ecx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40bafcd0
test esi, esi
je 0x40bafb9c
mov ecx, dword [ebp + 0xc]
mov dword [esi], ecx
test ebx, ebx
je 0x40bafba5
mov ecx, dword [ebp + 0x10]
mov dword [ebx], ecx
test edi, edi
je 0x40bafcd0
mov ecx, dword [ebp - 8]
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + 4], ecx
jmp 0x40bafcd0
mov ebx, dword [ebp + 0x28]
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp + 0x18]
mov eax, ebx
neg eax
sbb eax, eax
lea ecx, [ebp + 0x14]
and eax, ecx
push eax
push dword [ebp + 0x24]
mov eax, edi
neg eax
sbb eax, eax
lea ecx, [ebp + 0x10]
and eax, ecx
push eax
push dword [ebp + 0x1c]
mov eax, esi
neg eax
sbb eax, eax
lea ecx, [ebp + 0xc]
and eax, ecx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40bafcd0
test esi, esi
je 0x40bafc10
mov ecx, dword [ebp + 0xc]
mov dword [esi], ecx
test edi, edi
je 0x40bafc19
mov ecx, dword [ebp + 0x10]
mov dword [edi], ecx
test ebx, ebx
je 0x40bafcd0
mov ecx, dword [ebp + 0x14]
mov dword [ebx], ecx
jmp 0x40bafcd0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
jmp 0x40bafb12
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bafcd0
mov ecx, dword [ebp + 0x1c]
jmp 0x40bafb1d
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp + 0x18]
mov eax, edi
neg eax
sbb eax, eax
lea ecx, [ebp + 0x10]
and eax, ecx
push eax
push dword [ebp + 0x1c]
mov eax, esi
neg eax
sbb eax, eax
lea ecx, [ebp + 0xc]
and eax, ecx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40bafc9d
cmp eax, 0xea
jne 0x40bafcd0
test esi, esi
je 0x40bafca6
mov ecx, dword [ebp + 0xc]
mov dword [esi], ecx
test edi, edi
je 0x40bafcd0
mov ecx, dword [ebp + 0x10]
mov dword [edi], ecx
jmp 0x40bafcd0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40bafcd0
mov eax, 0x3f1
pop edi
pop esi
pop ebx
leave
ret 0x24