Function at 0x4111fe
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov eax, dword [ebp + 0x24]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
dec eax
cmp eax, 5
ja case.0x41121d.5
jmp dword [eax*4 + 0x4148e4]
lea eax, [ebp - 0x220]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x228]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne case.0x41121d.5
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
jmp 0x41131b
lea eax, [ebp - 0x228]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne case.0x41121d.5
mov eax, dword [ebp + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 0x228]
sub esp, 0x18
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
push eax
jne case.0x41121d.5
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 2
lea ebx, [ebp - 0x21c]
mov dword [esp + 8], str._c_.8x_s
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.0040afa3
jmp 0x411433
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00410a45
test al, al
mov bl, al
je case.0x41121d.5
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], esi
lea esi, [ebp - 0x21c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 3
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x4148bc
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.0040afa3
test eax, eax
jg 0x4115eb
jmp 0x411452
lea eax, [ebp - 0x228]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne case.0x41121d.5
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
mov ebx, eax
mov eax, dword [ebp - 0x228]
push ecx
push ecx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
push eax
jne case.0x41121d.5
mov eax, dword [ebp + 0x14]
lea ebx, [ebp - 0x21c]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 0x18], eax
mov dword [esp + 8], str._c_.8x_s_s
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.0040afa3
test eax, eax
jle 0x411452
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x51
mov dword [esp], eax
call fcn.00403f73
mov bl, 1
jmp 0x41160a
lea eax, [ebp - 0x228]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne case.0x41121d.5
lea eax, [ebp - 0x224]
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x411598
mov eax, dword [ebp - 0x224]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x21c], eax
je 0x411598
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x224]
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x41152c
xor ebx, ebx
jmp 0x41158a
mov eax, dword [ebp - 0x224]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x411528
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
push edx
sete bl
push edx
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call fcn.00405434
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
test bl, bl
push eax
je 0x41160a
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], esi
lea esi, [ebp - 0x21c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 6
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], str._c_.8x_s_s_a_s
mov dword [esp + 4], 0x204
mov dword [esp], esi
mov dword [esp + 0x18], eax
call fcn.0040afa3
test eax, eax
jle 0x41160a
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x51
mov dword [esp], eax
call fcn.00403f73
jmp 0x41160a
xor ebx, ebx
lea esp, [ebp - 0xc]
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret