Function at 0x40d0e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x281c
call fcn.0047af40
mov ecx, dword [esp + 0x2824]
mov edx, dword [esp + 0x2820]
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d118
xor eax, eax
add esp, 0x281c
ret
mov edx, dword [esp + 0x2828]
push ebx
mov ebx, dword [esp + 0x2830]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40d154
xor eax, eax
pop ebx
add esp, 0x281c
ret
mov ecx, dword [esp + 4]
push ebp
push esi
push edi
push 0x401
lea eax, [esp + 0x2c]
push eax
xor ebp, ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x40d28c
jmp 0x40d180
mov eax, dword [esp + 0x2834]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d190
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x28]
lea esi, [eax + 2]
jmp 0x40d1b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d1b0
sub eax, esi
sar eax, 1
add eax, edx
lea edx, [eax + eax + 4]
push edx
call fcn.0047afeb
mov ecx, dword [esp + 0x2838]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push 0x4eae74
push edi
call fcn.0047bd15
mov eax, ebx
add esp, 0x14
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d1f0
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x28]
lea esi, [eax + 2]
jmp 0x40d210
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d210
sub eax, esi
sar eax, 1
add eax, edx
lea edx, [eax + eax + 4]
push edx
call fcn.0047afeb
mov esi, eax
lea eax, [esp + 0x2c]
push eax
push ebx
push 0x4eae74
push esi
call fcn.0047bd15
mov ecx, dword [esp + 0x284c]
mov edx, dword [esp + 0x2844]
push esi
push ecx
push edi
push edx
call fcn.0040d0e0
push edi
call fcn.0047b0b5
push esi
call fcn.0047b0b5
inc ebp
add esp, 0x2c
cmp ebp, 0x186a0
jg 0x40d28c
mov ecx, dword [esp + 0x10]
push 0x401
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x40d180
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor edi, edi
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x840]
push ecx
push eax
push edx
mov dword [esp + 0x34], 0x1000
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call ebp
test eax, eax
jne 0x40d354
mov eax, dword [esp + 0x18]
push eax
call fcn.0047afeb
inc dword [esp + 0x18]
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
push esi
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x840]
push ecx
push 0
push edx
call ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push esi
push ecx
push 0
lea edx, [esp + 0x83c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x82c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call fcn.0047b0b5
inc edi
add esp, 4
cmp edi, 0x186a0
jg 0x40d354
test ebx, ebx
je 0x40d294
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
mov edx, dword [esp + 0x2834]
mov eax, dword [esp + 0x2830]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x281c
ret