Function at 0x410fc4
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24c
mov eax, dword [esp + 0x27c]
mov esi, dword [esp + 0x264]
mov edi, dword [esp + 0x268]
mov ebp, dword [esp + 0x26c]
dec eax
cmp eax, 5
ja case.0x410ff4.5
jmp dword [eax*4 + 0x42444c]
lea eax, [esp + 0x38]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne case.0x410ff4.5
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
jmp 0x4110f1
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne case.0x410ff4.5
mov eax, dword [esp + 0x278]
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x274]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x270]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
push eax
jne case.0x410ff4.5
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 2
lea ebx, [esp + 0x3c]
mov dword [esp + 8], str._c_.8x_s
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
jmp 0x4111f1
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0041086b
test al, al
mov bl, al
je case.0x410ff4.5
mov dword [esp + 0x10], esi
lea esi, [esp + 0x3c]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x424425
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
test eax, eax
je 0x411214
jmp 0x411387
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne case.0x410ff4.5
mov eax, dword [esp + 0x30]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
mov ebx, eax
push ecx
push ecx
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
push eax
jne case.0x410ff4.5
lea ebx, [esp + 0x3c]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], str._c_.8x_s_s
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
test eax, eax
je 0x411214
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x260]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xe8
mov dword [esp], eax
call fcn.00405d7d
mov bl, 1
jmp 0x4113aa
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne case.0x410ff4.5
lea eax, [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x411337
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x3c], eax
je 0x411337
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
lea edx, [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x4112d6
xor ebx, ebx
jmp 0x41132b
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x274]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x4112d2
mov eax, dword [esp + 0x30]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
push edx
push edx
sete bl
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00407f59
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
test bl, bl
push eax
je 0x4113aa
mov eax, dword [esp + 0x274]
mov dword [esp + 0x10], esi
lea esi, [esp + 0x3c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 6
mov dword [esp + 8], str._c_.8x_s_s_a_s
mov dword [esp + 0x18], eax
mov dword [esp + 4], 0x204
mov dword [esp], esi
call fcn.004127a8
test eax, eax
je 0x4113aa
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x260]
mov dword [esp + 8], esi
mov dword [esp + 4], 0xe8
mov dword [esp], eax
call fcn.00405d7d
jmp 0x4113aa
xor ebx, ebx
add esp, 0x24c
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret