Function at 0x40e78c
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x413074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x9c], ecx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0xa0], eax
mov word [ebp - 0x88], cx
lea ecx, [ebx + 0x1c]
mov dword [ebp - 0xa4], esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x8c], edi
test eax, eax
je 0x40e860
push ecx
push 0x4f
push 0x401bc0
push 0x50
push eax
call fcn.004076aa
mov ecx, dword [ebp - 0xa0]
lea esi, [ebx + 4]
lea edi, [ebp - 0xd0]
add esp, 0x14
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ecx + 0xa0]
lea esi, [ebp - 0xd0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov edx, esi
cmp dword [ebx + 0x14], esi
jne 0x40e81f
xor eax, eax
inc eax
jmp 0x40e821
mov eax, esi
mov edi, dword [ebp - 0x8c]
mov dword [ecx + 0xb0], eax
mov dword [ecx + 0xb4], edx
mov eax, dword [ebx + 0x248]
mov dword [ecx + 0xb8], eax
mov eax, dword [ebx + 0x244]
mov dword [ecx + 0xbc], eax
mov eax, dword [ebx + 0x240]
mov dword [ecx + 0xc0], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xc4], eax
cmp dword [ebx + 0x14], esi
je 0x40ea1b
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x98], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x94], edx
fild qword [ebp - 0x98]
mov dword [ebp - 0x94], eax
mov eax, dword [ecx]
mov dword [ebp - 0x98], esi
fild qword [ebp - 0x98]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0xa4]
push eax
push ecx
fchs
mov ecx, esi
faddp st(1)
fstp qword [ebp - 0xc8]
call dword [0x414340]
call esi
mov dword [ebp - 0x94], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov ecx, edx
mov dword [ebp - 0xb0], eax
and edx, 0x7fffffff
and ecx, 0x80000000
mov dword [ebp - 0xac], edx
fild qword [ebp - 0xb0]
and dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], ecx
fild qword [ebp - 0xb0]
fchs
faddp st(1)
fstp qword [ebp - 0xb0]
fld qword [ebp - 0xb0]
fsub qword [ebp - 0xc8]
fdiv qword [0x401d00]
fstp qword [ebp - 0xc8]
test edi, edi
je 0x40ea03
lea eax, [ebx + 0x1c]
push eax
push 0x4f
push 0x401bc0
push 0x50
push edi
call fcn.004076aa
lea esi, [ebx + 4]
fld qword [0x401d08]
lea edi, [ebp - 0xb8]
fld qword [ebp - 0xc8]
movsd dword es:[edi], dword [esi]
fcom st(1)
xor ecx, ecx
add esp, 0x14
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x8c]
lea esi, [ebp - 0xb8]
lea edi, [edi + 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x8c]
xor edi, edi
mov eax, dword [ebx + 0x248]
mov dword [esi + 0xc0], eax
mov eax, dword [ebx + 0x244]
mov dword [esi + 0xc4], eax
mov eax, dword [ebx + 0x240]
mov dword [esi + 0xc8], eax
mov eax, dword [ebp - 0x94]
cdq
mov dword [esi + 0xb8], eax
fnstsw ax
mov dword [esi + 0xbc], edx
mov dword [ebp - 0x94], ecx
test ah, 1
jne 0x40e9df
fsub st(1)
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x40e9e1
add edi, ecx
adc ecx, 0x80000000
mov dword [ebp - 0x94], ecx
jmp 0x40e9e1
fstp st(1)
call sub.msvcrt.dll__ftol2
add eax, edi
mov dword [esi + 0xb0], eax
adc edx, dword [ebp - 0x94]
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xb4], edx
mov dword [esi + 0xcc], eax
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x414340]
call esi
xor esi, esi
mov dword [ebx + 0x14], esi
cmp dword [ebx + 0x18], esi
je 0x40eb79
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ecx + 0x658]
test eax, eax
jns 0x40eb22
test al, 1
je 0x40ea62
push 2
pop esi
push dword [ecx + 0x65c]
lea eax, [ebp - 0x88]
push 0x401c4c
push 0x401c64
push 0x40
push eax
call fcn.004076aa
add esp, 0x14
jmp 0x40ea7a
push ecx
push 0x401c4c
push ecx
push 0x40
pop edx
lea ecx, [ebp - 0x88]
call fcn.004075ee
xor esi, esi
inc esi
lea eax, [ebp - 0xbc]
mov dword [ebp - 0xbc], 4
push eax
lea eax, [ebp - 0x8c]
xor edi, edi
push eax
push edi
push edi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], edi
push eax
push dword [ebx + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp dword [ebx + 0x244], edi
je 0x40eabe
mov eax, dword [ebp - 0x8c]
or eax, esi
jmp 0x40eac8
mov eax, esi
not eax
and eax, dword [ebp - 0x8c]
mov dword [ebp - 0x8c], eax
xor esi, esi
lea eax, [ebp - 0x9c]
push eax
push 0x20006
push esi
push esi
push dword [ebx + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jle 0x40eaf5
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x40eb22
push 4
lea eax, [ebp - 0x8c]
push eax
push 4
push esi
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
push dword [ebp - 0x9c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push dword [ebx + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test byte [ebp - 0xa4], 4
je 0x40eb79
cmp dword [ebx + 0x244], esi
je 0x40eb79
lea eax, [ebp - 0xa0]
push eax
push 0x3001f
push esi
push 0x401b20
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x40eb79
lea eax, [ebx + 0x1c]
push eax
push dword [ebp - 0xa0]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0xa0]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebx + 0x228]
test eax, eax
je 0x40eb90
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov dword [ebx + 0x228], esi
mov eax, dword [ebx + 0x224]
test eax, eax
je 0x40eba7
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov dword [ebx + 0x224], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004124d0
leave
ret 0x10