Function at 0x4017f0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov dword [ebp - 0x224], 0x412abc
mov dword [ebp - 0x220], 0x412ad4
mov word [ebp - 8], 2
mov word [ebp - 6], 1
mov dword [ebp - 0x114], 0
jmp 0x401834
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x20
jge 0x4019c2
push 1
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411258
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
sub ecx, edx
sar ecx, 4
push ecx
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
push eax
call fcn.004011d0
add esp, 0xc
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x4019bd
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
mov edx, dword [ecx + 0x411264]
cmp dword [edx], 0
je 0x4019bd
push 2
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411248
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
sub eax, ecx
sar eax, 4
push eax
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
push edx
call fcn.004011d0
add esp, 0xc
test eax, eax
je 0x4019bd
push 1
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411248
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
sub eax, ecx
sar eax, 4
push eax
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
push edx
call fcn.004011d0
add esp, 0xc
test eax, eax
jne 0x40196e
push 2
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411248
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
sub eax, ecx
sar eax, 4
push eax
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
push edx
call fcn.004010f0
add esp, 0xc
jmp 0x4019bd
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
mov ecx, dword [eax + 0x411254]
mov byte [ecx], 0
push 2
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411248
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
sub edx, eax
sar edx, 4
push edx
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
push ecx
call fcn.004010f0
add esp, 0xc
jmp 0x401825
mov dword [ebp - 0x114], 0
jmp 0x4019dd
mov edx, dword [ebp - 0x114]
add edx, 1
mov dword [ebp - 0x114], edx
cmp dword [ebp - 0x114], 0x20
jge 0x401d01
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
mov ecx, dword [eax + 0x411264]
cmp dword [ecx], 0
je 0x401c00
push 0
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411238
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
sub edx, eax
sar edx, 4
push edx
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
push ecx
call fcn.004011d0
add esp, 0xc
test eax, eax
jne 0x401a64
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
mov eax, dword [edx + 0x411244]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00408170
add esp, 8
jmp 0x401aa9
mov dword [ebp - 4], 0x104
lea edx, [ebp - 0x228]
push edx
push 0x412ae0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x114]
xor edx, edx
mov dx, word [ecx*2 + 0x4111c8]
push edx
push 0x412afc
lea eax, [ebp - 0x10c]
push eax
call fcn.0040811b
add esp, 0xc
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x114]
xor ecx, ecx
mov cx, word [eax*2 + 0x4111c8]
push ecx
push 0x412b20
lea edx, [ebp - 0x10c]
push edx
call fcn.0040811b
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x118], 0
jmp 0x401b6a
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 2
jge 0x401bee
mov eax, dword [ebp - 0x118]
mov cx, word [ebp + eax*2 - 8]
push ecx
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411248
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
sub edx, eax
sar edx, 4
push edx
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
push ecx
call fcn.004011d0
add esp, 0xc
push 4
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
mov eax, dword [edx + 0x411254]
push eax
push 1
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp + ecx*4 - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
jmp 0x401b5b
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401cfc
mov edx, dword [ebp - 0x114]
xor eax, eax
mov ax, word [edx*2 + 0x4111c8]
push eax
push 0x412b50
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0040811b
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x114]
xor ecx, ecx
mov cx, word [eax*2 + 0x4111c8]
push ecx
push 0x412b74
lea edx, [ebp - 0x10c]
push edx
call fcn.0040811b
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cef
mov dword [ebp - 0x118], 0
jmp 0x401c9b
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov dword [ebp - 4], 0x104
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401cdb
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x401c8c
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4019ce
mov esp, ebp
pop ebp
ret