Function at 0x403e60
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [esp + 0x160]
push edi
mov ecx, ebx
mov eax, dword [esi]
push eax
call fcn.00403040
mov edx, dword [esi]
add edx, 4
test eax, eax
mov dword [esi], edx
jbe 0x403eea
mov dword [esp + 0x1c], eax
mov ebp, dword [esi]
mov ecx, dword [esp + 0x15c]
add ebp, ecx
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
not ecx
add eax, ecx
mov ecx, ebx
push eax
mov dword [esi], eax
call fcn.00403040
mov edx, dword [esi]
add edx, 4
cmp eax, 1
mov dword [esi], edx
jne 0x403edf
mov al, byte [esp + 0x168]
test al, al
jne 0x403edf
mov eax, dword [esp + 0x158]
test eax, eax
je 0x403edf
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x1c], eax
jne 0x403e91
mov ecx, dword [esi]
push ecx
mov ecx, ebx
call fcn.00403040
mov edx, dword [esi]
mov dword [esp + 0x2c], eax
add edx, 4
mov dword [esp + 0x28], 0
test eax, eax
mov dword [esi], edx
jbe 0x40427a
mov ebp, dword [esp + 0x16c]
jmp 0x403f1f
mov ebx, dword [esp + 0x160]
mov edx, dword [esi]
mov ecx, ebx
push edx
call fcn.00403040
mov ecx, dword [esi]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x15c]
add ecx, 4
mov edx, ecx
mov dword [esi], ecx
or ecx, 0xffffffff
lea ebx, [edx + eax]
xor eax, eax
mov edi, ebx
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x158]
not ecx
dec ecx
test edi, edi
lea ecx, [ecx + edx + 1]
mov dword [esi], ecx
je 0x404014
test ebp, ebp
je 0x403f6f
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.00403800
lea edx, [esp + 0x14]
push edx
push 0x2001f
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 5
jne 0x403ff8
mov eax, dword [esi]
mov ecx, dword [esp + 0x160]
push eax
call fcn.00403040
test eax, eax
jg 0x404292
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 5
je 0x404292
mov edx, dword [esp + 0x168]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
push ebp
push edx
mov edx, dword [esp + 0x1c]
push esi
push eax
push ecx
push edx
call fcn.00403e60
add esp, 0x18
test al, al
mov al, byte [esp + 0x168]
jne 0x40403d
test al, al
jne 0x404287
jmp 0x404059
test eax, eax
je 0x403fbc
test ebp, ebp
je 0x404014
mov eax, dword [ebp + 0xc]
mov ecx, ebp
dec eax
push eax
call fcn.004037e0
push eax
mov ecx, ebp
call fcn.00403940
mov edx, dword [esp + 0x168]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
push ebp
push edx
push esi
push eax
push ecx
push 0
call fcn.00403e60
add esp, 0x18
jmp 0x404265
test al, al
je 0x404059
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x404265
jmp 0x404251
test byte [esp + 0x24], 1
jne 0x404078
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x404265
jmp 0x404251
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x18]
stosb byte es:[edi], al
push 0
push 0
lea eax, [esp + 0x2c]
push 0
push eax
push ecx
mov edi, 0x104
push 0
push edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
sete al
test al, al
mov byte [esp + 0x13], al
je 0x4040de
test byte [esp + 0x24], 4
je 0x4040de
mov eax, dword [esp + 0x14]
push eax
call fcn.00403d30
add esp, 4
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x60]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
sete byte [esp + 0x1f]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x24]
test al, 4
je 0x404134
mov edx, dword [esp + 0x158]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40424d
jmp 0x40417c
test al, 2
mov al, byte [esp + 0x13]
je 0x404161
test al, al
jne 0x40417c
mov al, byte [esp + 0x1b]
test al, al
jne 0x40417c
mov eax, dword [esp + 0x158]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40424d
jmp 0x40417c
test al, al
jne 0x40417c
mov ecx, dword [esp + 0x158]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40424d
lea ecx, [esp + 0x30]
call fcn.00402850
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
jle 0x4041ba
push edi
mov ecx, ebp
call fcn.004037e0
push 0
push eax
lea ecx, [esp + 0x38]
call fcn.00402aa0
mov eax, dword [ebp + 0xc]
inc edi
cmp edi, eax
je 0x4041ba
push 0x5c
lea ecx, [esp + 0x34]
call fcn.00402a60
cmp edi, dword [ebp + 0xc]
jl 0x40418e
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], 0
call fcn.00402850
mov edx, dword [esp + 0x1c]
mov ecx, 0x40cb28
push edx
call fcn.00403190
test al, al
je 0x40421b
lea eax, [esp + 0x3c]
push 0
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, 0x40cb28
call fcn.00403080
lea edx, [esp + 0x30]
push 0
push edx
lea ecx, [esp + 0x44]
call fcn.00402b80
test al, al
jne 0x40423b
mov eax, dword [esp + 0x1c]
mov ecx, 0x40cb28
push eax
call fcn.00403190
test al, al
jne 0x4041de
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x40cb28
call fcn.00402b10
push 0
push 0x40c1bc
mov ecx, 0x40cb28
call fcn.00402aa0
lea ecx, [esp + 0x3c]
call fcn.00402950
lea ecx, [esp + 0x30]
call fcn.00402950
test ebp, ebp
je 0x404265
mov eax, dword [ebp + 0xc]
mov ecx, ebp
dec eax
push eax
call fcn.004037e0
push eax
mov ecx, ebp
call fcn.00403940
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
inc eax
cmp eax, ecx
mov dword [esp + 0x28], eax
jb 0x403f18
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x144
ret
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4042aa
mov eax, dword [ebp + 0xc]
mov ecx, ebp
dec eax
push eax
call fcn.004037e0
push eax
mov ecx, ebp
call fcn.00403940
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x144
ret