Function at 0x40cb60
Capabilities:
Delete registry key
Delete registry value
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov ecx, dword [0x42adfc]
sub esp, 0x44
mov edx, dword [ecx*4 + 0x42abb0]
push ebx
test edx, edx
push esi
je 0x40cf72
mov esi, dword [ecx*4 + 0x42aaf0]
xor eax, eax
test esi, esi
jbe 0x40cba4
mov bl, byte [eax + edx]
mov cl, al
add cl, 0x41
xor bl, cl
mov byte [eax + edx], bl
mov ecx, dword [0x42adfc]
inc eax
cmp eax, dword [ecx*4 + 0x42aaf0]
jb 0x40cb87
xor eax, eax
mov ax, word [edx]
add edx, 2
test eax, eax
jbe 0x40cf72
push ebp
push edi
mov dword [esp + 0x30], eax
jmp 0x40cbc0
mov edx, dword [esp + 0x34]
mov esi, dword [edx]
mov al, byte [edx + 4]
add edx, 4
mov byte [esp + 0x13], al
inc edx
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, edx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov ebx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov dword [esp + 0x38], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, 0x14
lea ecx, [edx + ecx + 1]
mov dword [esp + 0x34], ecx
jb 0x40cc16
mov edx, dword [0x42527c]
mov dword [esp + 0x1c], edx
jmp 0x40cc21
mov eax, dword [esi*4 + 0x425278]
mov dword [esp + 0x1c], eax
push 0xffdc
push ebp
push 0
call fcn.0040c830
mov edi, eax
lea esi, [edi + 1]
push esi
call fcn.0041a280
push esi
push ebp
push eax
mov dword [esp + 0x34], eax
call fcn.0040c830
push 0xffdc
push ebx
push 0
call fcn.0040c830
lea esi, [eax + 1]
push esi
call fcn.0041a280
push esi
push ebx
push eax
mov dword [esp + 0x58], eax
call fcn.0040c830
mov ebp, dword [esp + 0x54]
add esp, 0x38
xor esi, esi
cmp ebp, 0x80000002
mov dword [esp + 0x28], esi
jne 0x40ccd3
cmp edi, 0xa
jb 0x40ccd3
mov edi, dword [esp + 0x18]
push 0xa
push str.Software64
push edi
call fcn.0041a8d0
add esp, 0xc
test eax, eax
jne 0x40ccd7
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
add ecx, 0xfffffff6
push ecx
lea ecx, [eax + 0xa]
add eax, 8
push ecx
push eax
call fcn.0041aa10
mov eax, dword [0x42ad9c]
mov edi, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x40ccd7
mov dword [esp + 0x28], 0x100
mov esi, dword [esp + 0x28]
jmp 0x40ccd7
mov edi, dword [esp + 0x18]
mov bl, byte [esp + 0x13]
test bl, 4
je 0x40cd50
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40cd27
cmp byte [ebx], 0
je 0x40cd27
lea edx, [esp + 0x14]
or esi, 0xf003f
push edx
push esi
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cf61
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40cf61
mov eax, dword [0x42ad9c]
test eax, eax
je 0x40cd43
shr esi, 8
and esi, 1
push esi
push edi
push ebp
call fcn.0040cf80
jmp 0x40cf5e
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40cf61
test bl, 1
je 0x40cde2
lea edx, [esp + 0x14]
or esi, 0x20019
push edx
push esi
push 0
push edi
push ebp
mov dword [esp + 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cdc9
test bl, 2
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0x14
je 0x40cd9d
mov eax, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, 2
je 0x40cdd6
mov eax, dword [esp + 0x3c]
test eax, eax
jmp 0x40cddc
mov al, byte [esp + 0x3c]
test al, al
jne 0x40cf61
mov edi, dword [esp + 0x38]
push 0xffdc
push edi
push 0
call fcn.0040c830
mov esi, eax
add esp, 0xc
lea eax, [esi + esi + 1]
cmp eax, 4
ja 0x40ce06
mov eax, 4
push eax
call fcn.0041a280
mov ebp, eax
lea eax, [esi + 1]
push eax
push edi
push ebp
call fcn.0040c830
add esp, 0x10
mov edi, 1
test bl, 2
je 0x40ce3e
push ebp
call fcn.0041a97d
mov esi, 4
add esp, 4
mov dword [ebp], eax
mov edi, esi
jmp 0x40cef5
push 5
push str.:hex:
push ebp
call fcn.0041a8d0
add esp, 0xc
test eax, eax
jne 0x40cef5
mov al, byte [ebp + 5]
lea esi, [ebp + 5]
mov ecx, ebp
test al, al
mov dword [esp + 0x24], ecx
je 0x40ceec
movsx ecx, al
push ecx
xor bl, bl
call fcn.0041a7fe
add esp, 4
inc esi
cmp al, 0x30
jl 0x40ce85
cmp al, 0x39
jg 0x40ce85
sub al, 0x30
jmp 0x40ce8f
cmp al, 0x41
jl 0x40ce91
cmp al, 0x46
jg 0x40ce91
sub al, 0x37
mov bl, al
mov al, byte [esi]
test al, al
je 0x40ceca
cmp al, 0x2c
je 0x40ceca
movsx edx, al
push edx
call fcn.0041a7fe
add esp, 4
inc esi
cmp al, 0x30
jl 0x40ceba
cmp al, 0x39
jg 0x40ceba
sub bl, 3
shl bl, 4
add bl, al
jmp 0x40ceca
cmp al, 0x41
jl 0x40ceca
cmp al, 0x46
jg 0x40ceca
shl bl, 4
add bl, al
sub bl, 0x37
mov eax, dword [esp + 0x24]
mov byte [eax], bl
inc eax
mov dword [esp + 0x24], eax
mov al, byte [esi]
cmp al, 0x20
je 0x40cedf
cmp al, 0x2c
jne 0x40cee2
inc esi
jmp 0x40ced5
mov al, byte [esi]
test al, al
jne 0x40ce6a
mov ecx, dword [esp + 0x24]
sub ecx, ebp
mov edi, 3
mov esi, ecx
lea eax, [esp + 0x14]
push 0
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
or eax, 0xf003f
push 0
push eax
push 0
push 0
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40cf48
cmp edi, 1
jne 0x40cf28
inc esi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push esi
push ebp
push edi
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0041a3e3
mov edx, dword [esp + 0x24]
push edx
call fcn.0041a3e3
push ebx
call fcn.0041a3e3
add esp, 0xc
mov eax, dword [esp + 0x30]
dec eax
mov dword [esp + 0x30], eax
jne 0x40cbbc
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x44
ret