Function at 0x40f550
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x434
push ebx
mov ebx, dword [esp + 0x440]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov dword [esp + 0x24], ecx
push eax
mov ecx, dword [esp + 0x44c]
push 0x2001f
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea edx, [esp + 0x38]
mov ebp, dword [esp + 0x454]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x2001f
push 0
push 0x46a8c8
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test esi, esi
je 0x40f5be
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
test eax, eax
je 0x40f5d1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
mov esi, dword [esp + 0x450]
test esi, esi
je 0x40f664
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x1b]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f61e
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x1b]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov edi, eax
call esi
mov edx, dword [esp + 0x448]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
push ebp
call esi
test edi, edi
je 0x40f897
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [esp + 0x20], 0
push 0
push 0
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push 0
lea edx, [esp + 0x38]
push ecx
push edx
push 0
push 0
push 0
push eax
call ebp
test eax, eax
jne 0x40f6fe
mov eax, dword [esp + 0x20]
test eax, eax
jbe 0x40f778
mov ecx, dword [esp + 0x1c]
inc ecx
push ecx
call fcn.0043b7dd
mov edx, dword [esp + 0x20]
add esp, 4
inc edx
mov esi, eax
mov eax, dword [esp + 0x10]
push edx
push esi
push 0
push eax
call edi
test eax, eax
jne 0x40f721
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x28]
push eax
push esi
push edx
call fcn.0040f550
test eax, eax
push esi
je 0x40f74d
call fcn.0043b806
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
jbe 0x40f778
jmp 0x40f678
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
push esi
call fcn.0043b806
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
call fcn.0043b806
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
push 0
lea eax, [esp + 0x44]
push 0
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call ebp
test eax, eax
je 0x40f7c5
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x40f861
mov eax, dword [esp + 0x34]
inc eax
push eax
call fcn.0043b7dd
mov esi, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x49]
mov byte [esp + 0x48], 0
add esp, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
xor edi, edi
test eax, eax
jle 0x40f858
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x48]
push 0
push ecx
push esi
push edi
push edx
call ebp
test eax, eax
jne 0x40f848
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x44]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push esi
push eax
call ebx
mov eax, dword [esp + 0x28]
inc edi
cmp edi, eax
jl 0x40f80c
mov ebx, dword [esp + 0x44c]
push esi
call fcn.0043b806
add esp, 4
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0x448]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40f897
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x434
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x434
ret 0x10