Function at 0x40e4df
Capabilities:
Delete registry key
Delete registry value
Get common file path
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xf40
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0xf3c], eax
mov eax, dword [esp + 0xf44]
push ebx
mov dword [esp + 0x18], eax
xor ebx, ebx
lea eax, [esp + 0x930]
push eax
push ebx
push ebx
push 0x8026
push ebx
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
test eax, eax
js 0x40eb96
lea eax, [esp + 0x930]
push str.Axis_FirstDiplomat
push eax
call fcn.00446fa0
pop ecx
pop ecx
call fcn.0045db70
push ebx
push ebx
movzx eax, ax
push str.axisdealer
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov eax, dword [esp + 0x18]
setne byte [esp + 0x13]
test eax, eax
je 0x40e5a2
lea eax, [esp + 0x424]
push 0x4c34d4
push eax
call fcn.00446f90
mov eax, dword [esp + 0x20]
push eax
lea eax, [esp + 0x430]
push eax
call fcn.00446fa0
lea eax, [esp + 0x434]
push 0x5c
push eax
call fcn.0040970e
lea eax, [esp + 0x43c]
push eax
call fcn.0045ba77
mov eax, dword [esp + 0x34]
add esp, 0x1c
push ebp
push esi
push edi
or ecx, 0xffffffff
xor edi, edi
mov ebp, connect
mov dword [esp + 0x10], ecx
cmp word [esp + 0xf58], bx
je 0x40e685
mov esi, 0x50c948
inc edi
test eax, eax
je 0x40e5ef
push eax
push dword [esi]
call fcn.0040a4e2
pop ecx
pop ecx
test ax, ax
je 0x40e5ef
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esi]
inc eax
push eax
call fcn.0040a4e2
pop ecx
pop ecx
test ax, ax
jne 0x40e66d
push dword [esi]
lea eax, [esp + 0x53c]
push eax
call fcn.00446f90
pop ecx
pop ecx
lea eax, [esp + 0x18]
push eax
push 0x20007
push 0
lea eax, [esp + 0x544]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e663
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x18]
test eax, eax
movzx ebx, bl
cmove ebx, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40e663
lea eax, [esp + 0x538]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
movzx ebx, bl
lea eax, [esp + 0x538]
push eax
cmove ebx, edi
call fcn.0040dcf0
pop ecx
cmp byte [esp + 0x538], 0
jne 0x40e63e
mov eax, dword [esp + 0x24]
sub esi, 8
cmp esi, 0x50c770
jge 0x40e5c7
jmp 0x40eb7f
xor esi, esi
inc edi
test eax, eax
jne 0x40e6d7
push dword [esi*4 + 0x50c770]
push str..axs_
call fcn.004478d0
pop ecx
pop ecx
test eax, eax
jne 0x40e6b0
push 0xf8
call fcn.00460b68
pop ecx
jmp 0x40e6cc
push dword [esi*4 + 0x50c770]
push str..axx_
call fcn.004478d0
pop ecx
pop ecx
test eax, eax
jne 0x40e744
call fcn.0045db2a
test ax, ax
je 0x40eb7f
jmp 0x40e744
cmp ecx, 0xffffffff
jne 0x40e709
push dword [esi*4 + 0x50c770]
lea eax, [esp + 0x434]
push eax
call fcn.00447146
pop ecx
pop ecx
test eax, eax
jne 0x40eb6b
mov ecx, esi
mov dword [esp + 0x10], ecx
cmp esi, 0xffffffff
je 0x40eb6f
push dword [esi*4 + 0x50c770]
lea eax, [esp + 0x434]
push eax
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e744
mov eax, dword [esp + 0x10]
push dword [esi*4 + 0x50c770]
push dword [eax*4 + 0x50c774]
call fcn.00409732
pop ecx
pop ecx
test eax, eax
je 0x40eb6b
push dword [esi*4 + 0x50c770]
lea eax, [esp + 0x30]
push eax
call fcn.00446f90
lea eax, [esp + 0x34]
push eax
call fcn.00447230
add esp, 0xc
lea ecx, [esp + 0x2c]
dec ecx
add eax, ecx
and dword [esp + 0x20], 0
jmp 0x40e775
mov dword [esp + 0x20], eax
dec eax
cmp byte [eax], 0x5c
jne 0x40e770
cmp word [esp + 0x28], 0
mov byte [eax], 0
jne 0x40e97e
lea eax, [esp + 0x2c]
push eax
push str.axbfile
call fcn.00409732
pop ecx
test eax, eax
lea eax, [esp + 0x30]
pop ecx
push eax
je 0x40e837
push str.explore
call fcn.00409732
pop ecx
test eax, eax
lea eax, [esp + 0x30]
pop ecx
push eax
je 0x40e7ed
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.axbfile_shellExplore
test eax, eax
movzx ebx, bl
push ebp
cmove ebx, edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x40eb6f
xor edi, edi
mov bl, 1
inc edi
jmp 0x40eb6f
push str.ZIP_compatible
call fcn.00409732
pop ecx
test eax, eax
lea eax, [esp + 0x30]
pop ecx
push eax
je 0x40e810
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.axbfile_shellMake_ZIP_compatible
jmp 0x40e7c8
push str.ZIP_incompatible
call fcn.00409732
pop ecx
pop ecx
test eax, eax
je 0x40e97e
lea eax, [esp + 0x2c]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.axbfile_shellMake_ZIP_incompatible
jmp 0x40e7c8
push str.axcfile
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e909
lea eax, [esp + 0x2c]
push eax
push str..axc
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e909
lea eax, [esp + 0x2c]
push eax
push str.axkfile
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e8f2
lea eax, [esp + 0x2c]
push eax
push str..axk
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e8f2
lea eax, [esp + 0x2c]
push eax
push str.axffile
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e8f2
lea eax, [esp + 0x2c]
push eax
push str..axf
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e8f2
lea eax, [esp + 0x2c]
push eax
push str.axzfile
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e8e6
lea eax, [esp + 0x2c]
push eax
push str..axz
call fcn.00409732
pop ecx
pop ecx
test eax, eax
je 0x40e97e
lea eax, [esp + 0x2c]
push eax
push str.Queue_for_FTP_collection
jmp 0x40e92f
lea eax, [esp + 0x2c]
push eax
push str.Configure
call fcn.00409732
pop ecx
pop ecx
test eax, eax
jne 0x40e93a
jmp 0x40e925
lea eax, [esp + 0x2c]
push eax
push str.Configure
call fcn.00409732
pop ecx
pop ecx
test eax, eax
je 0x40e925
cmp byte [esp + 0x1f], 0
je 0x40e93a
lea eax, [esp + 0x2c]
push eax
push str.ShellNew
call fcn.00409732
pop ecx
pop ecx
test eax, eax
je 0x40e97e
push dword [esi*4 + 0x50c770]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebp
call edi
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
cmp dword [esp + 0x20], 0
je 0x40eb68
lea eax, [esp + 0x2c]
push eax
push ebp
call edi
mov ecx, dword [esp + 0x10]
xor edi, edi
inc edi
test eax, eax
jne 0x40eb6f
mov bl, 1
jmp 0x40eb6f
lea eax, [esp + 0x14]
push eax
push 0x20007
push 0
lea eax, [esp + 0x38]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40e9bf
xor ecx, ecx
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
push 0x20007
push ecx
push ecx
push ecx
lea eax, [esp + 0x48]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40eb6b
mov eax, dword [esi*4 + 0x50c774]
cmp byte [eax], 0x5c
jne 0x40ea0b
lea eax, [esp + 0x538]
push 0x4c3f24
push eax
call fcn.00446f90
lea eax, [esp + 0x944]
push eax
lea eax, [esp + 0x544]
push eax
call fcn.00446fa0
push dword [esi*4 + 0x50c774]
lea eax, [esp + 0x54c]
push eax
call fcn.00446fa0
add esp, 0x18
jmp 0x40ea1b
push eax
lea eax, [esp + 0x53c]
push eax
call fcn.00446f90
pop ecx
pop ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x401
push eax
lea eax, [esp + 0xb4c]
push eax
push 0
push 0
push dword [esp + 0x30]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ea61
lea eax, [esp + 0x538]
push eax
lea eax, [esp + 0xb4c]
push eax
call fcn.004478d0
pop ecx
pop ecx
test eax, eax
je 0x40eaa3
cmp byte [esp + 0x538], 0
je 0x40eaa3
lea eax, [esp + 0x538]
push eax
call fcn.00447230
pop ecx
inc eax
push eax
lea eax, [esp + 0x53c]
push eax
push 1
push 0
push dword [esp + 0x30]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
xor edi, edi
inc edi
lea eax, [esp + 0x2c]
push eax
push str.axsfile
call fcn.004478d0
pop ecx
pop ecx
test eax, eax
jne 0x40eb5c
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x401
push eax
lea eax, [esp + 0xb4c]
push eax
push 0
push 0
push str.IsShortcut
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40eb0c
xor eax, eax
push eax
push eax
push 1
push eax
push str.IsShortcut
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
xor edi, edi
inc edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x401
push eax
lea eax, [esp + 0xb4c]
push eax
push 0
push 0
push str.NeverShowExt
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40eb5c
xor eax, eax
push eax
push eax
push 1
push eax
push str.NeverShowExt
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
xor edi, edi
inc edi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40eb6b
xor edi, edi
inc edi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
add esi, 2
cmp esi, 0x78
jb 0x40e688
pop edi
pop esi
pop ebp
test bl, bl
je 0x40eb96
xor eax, eax
push eax
push eax
push eax
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [esp + 0xf40]
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0xf40
ret