Function at 0x40c31d
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
cmp dword [ebp + 8], 0
push esi
je 0x40c6fd
push ebx
push edi
push 0x1c
mov esi, 0x420ee8
pop ecx
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x25
mov esi, 0x420e54
pop ecx
lea edi, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push 0x21
mov esi, 0x420dcc
pop ecx
lea edi, [ebp - 0x44c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x24
mov esi, 0x420d38
pop ecx
lea edi, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1c
mov esi, 0x420cc8
pop ecx
lea edi, [ebp - 0x344]
rep movsd dword es:[edi], dword [esi]
push 0x1b
mov esi, 0x420c58
pop ecx
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f
mov esi, 0x420bd8
pop ecx
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x28
mov esi, 0x420b38
pop ecx
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x420b24
lea edi, [ebp - 0x28]
mov esi, ebx
lea eax, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x41ff8c
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push eax
push 1
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x420ae4
push esi
call ebx
lea eax, [ebp - 0x2d4]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
lea eax, [ebp - 0x9c]
push 0x420ab4
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push dword [ebp + 0xc]
push 1
push 0x420a94
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x9c]
push 0x420a74
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x420a68
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x420a5c
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x420a4c
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x420a40
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x420a30
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x420a28
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x420a1c
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x420a10
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x44c]
push 0x4209ec
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x344]
push dword [ebp + 0xc]
push 1
push 0x422128
push eax
push esi
call ebx
and word [ebp - 0x864], 0
mov edx, 0x82
mov ecx, edx
xor eax, eax
and word [ebp - 0x658], ax
lea edi, [ebp - 0x862]
push dword [ebp + 0xc]
and word [ebp - 0xa70], ax
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x656]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0xa6e]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4209c8
lea eax, [ebp - 0x864]
push 0x104
push eax
mov dword [ebp + 8], 1
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x658]
push 0x420990
push 0x104
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0xa70]
push 0x42096c
push 0x104
push eax
call edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x864]
push eax
call edi
add esp, 0x34
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x864]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x420948
push eax
push esi
call ebx
lea eax, [ebp + 8]
push 4
push eax
push 4
lea eax, [ebp - 0x10c]
push 0x42092c
push eax
push esi
call ebx
lea eax, [ebp - 0x658]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x658]
push eax
push 1
push 0x420908
lea eax, [ebp - 0x10c]
push eax
push esi
call ebx
lea eax, [ebp - 0xa70]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa70]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x4208e4
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x3c4]
push dword [ebp + 0xc]
push 1
push 0x422128
push eax
push esi
call ebx
pop edi
pop ebx
jmp 0x40c71f
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x42088c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x420b24
push 0x420ae4
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
pop esi
leave
ret