Function at 0x40c53e
Capabilities:
Delete registry value
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
and byte [ebp - 1], 0
push ebx
push esi
push edi
call fcn.0041844d
test eax, eax
je 0x40c7a4
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 1
push esi
push 0x428b1c
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ca79
mov edi, 0x400
push 0x401
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], edi
call sub.MFC42.DLL_operatornew
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], 7
push eax
lea eax, [ebp - 0x20]
push dword [ebp - 8]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x428b00
push dword [ebp - 0x14]
call esi
mov ebx, eax
cmp ebx, 0xea
jne 0x40c624
push dword [ebp - 8]
call sub.MFC42.DLL_operatordelete
cmp dword [ebp - 0xc], 0xf4240
pop ecx
jbe 0x40c5ef
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c8bb
add dword [ebp - 0xc], edi
push dword [ebp - 0xc]
call sub.MFC42.DLL_operatornew
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push dword [ebp - 8]
push eax
push 0
push 0x428b00
push dword [ebp - 0x14]
call esi
mov ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x40c797
mov esi, dword [ebp - 8]
and byte [ebp - 2], bl
cmp byte [esi], bl
je 0x40c797
and byte [ebp - 0xd], 0
cmp byte [esi], 0
mov dword [ebp - 0x18], esi
je 0x40c69a
push 4
push 0x428af8
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
jne 0x40c667
add esi, 4
mov edi, dword [ebp + 8]
and dword [ebp - 0x1c], 0
mov ebx, dword [edi + 0xc]
test ebx, ebx
jle 0x40c69d
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.004179e4
push esi
push eax
call fcn.00418a4b
pop ecx
test al, al
pop ecx
je 0x40c690
mov byte [ebp - 0xd], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x40c675
jmp 0x40c69d
mov edi, dword [ebp + 8]
push esi
call sub.MSVCRT.dll_strlen
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
pop ecx
je 0x40c6ef
push 4
push 0x428af8
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
jne 0x40c6c7
add esi, 4
mov ebx, dword [edi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x40c6ef
mov ecx, dword [ebp + 8]
push edi
call fcn.004179e4
push esi
push eax
call fcn.00418a4b
pop ecx
test al, al
pop ecx
je 0x40c6ea
mov byte [ebp - 0xd], 1
inc edi
cmp edi, ebx
jl 0x40c6d0
push esi
call sub.MSVCRT.dll_strlen
cmp byte [ebp - 0xd], 0
pop ecx
lea esi, [esi + eax + 1]
je 0x40c725
mov eax, dword [ebp - 8]
sub eax, esi
add eax, dword [ebp - 0xc]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [ebp - 0x18]
add esp, 0xc
sub eax, esi
mov esi, dword [ebp - 0x18]
add dword [ebp - 0xc], eax
mov byte [ebp - 2], 1
cmp byte [esi], 0
jne 0x40c643
cmp byte [ebp - 2], 0
je 0x40c797
lea eax, [ebp - 0x14]
push eax
push 2
push 0
push 0x428b1c
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c793
xor esi, esi
cmp dword [ebp - 0xc], 1
ja 0x40c76a
push 0x428b00
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
jmp 0x40c782
push dword [ebp - 0xc]
push dword [ebp - 8]
push 7
push 0
push 0x428b00
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
test esi, esi
sete byte [ebp - 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c797
and byte [ebp - 1], 0
push dword [ebp - 8]
call sub.MFC42.DLL_operatordelete
jmp 0x40ca78
lea eax, [ebp - 0x22c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x128]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x128]
push 0x428ae8
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x128]
push edi
push 0x80
push 4
push edi
push edi
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x40c8bb
lea ecx, [ebp - 0xc]
mov byte [ebp - 1], 1
push ecx
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 8], edi
cmp esi, edi
je 0x40c885
lea ebx, [esi + 1]
push ebx
call sub.MFC42.DLL_operatornew
cmp eax, edi
pop ecx
mov dword [ebp - 0x18], eax
je 0x40c885
push ebx
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], edi
push edi
push eax
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c87c
mov eax, dword [ebp - 0x20]
cmp esi, eax
jne 0x40c87c
add eax, 0x208
push eax
call sub.MFC42.DLL_operatornew
cmp eax, edi
pop ecx
mov dword [ebp - 8], eax
je 0x40c87c
push dword [ebp - 0x18]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp - 0x18]
call sub.MFC42.DLL_operatordelete
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x40c8bb
push dword [ebp - 8]
call sub.MSVCRT.dll_strlen
mov ebx, eax
lea eax, [ebx + 0x208]
push eax
call sub.MFC42.DLL_operatornew
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
jne 0x40c8c2
call sub.MFC42.DLL_operatordelete
pop ecx
xor al, al
jmp 0x40ca7c
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
xor esi, esi
cmp ebx, edi
pop ecx
jle 0x40c8eb
mov eax, dword [ebp - 0x14]
movsx ax, byte [esi + eax]
push eax
call dword [sym.imp.MSVCRT.dll_towupper]
pop ecx
mov ecx, dword [ebp - 0x14]
mov byte [esi + ecx], al
inc esi
cmp esi, ebx
jl 0x40c8d0
push 0x428adc
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, edi
pop ecx
je 0x40ca79
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
and byte [ebp - 2], 0
lea esi, [eax + ecx + 8]
mov al, byte [eax + ecx + 8]
test al, al
je 0x40ca67
cmp al, 0x5b
je 0x40ca12
push 0x3d
mov dword [ebp - 0x24], esi
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
call esi
mov ebx, eax
pop ecx
cmp ebx, edi
pop ecx
je 0x40ca12
inc ebx
push 0xd
push ebx
call esi
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 0x18], eax
jne 0x40c95c
push 0xa
push ebx
call esi
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 0x18], eax
je 0x40c998
mov edi, dword [ebp - 0x18]
sub edi, ebx
cmp edi, 0x208
jb 0x40c96e
mov edi, 0x207
push edi
lea eax, [ebp - 0x434]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov esi, dword [ebp - 0x18]
add esp, 0xc
and byte [ebp + edi - 0x434], 0
mov al, byte [esi]
cmp al, 0xd
je 0x40c995
cmp al, 0xa
jne 0x40c9b4
inc esi
jmp 0x40c98b
lea eax, [ebp - 0x434]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
push ebx
call sub.MSVCRT.dll_strlen
mov esi, eax
add esp, 0xc
add esi, ebx
jmp 0x40c9b6
xor edi, edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebx + 0xc]
cmp eax, edi
mov dword [ebp - 0x18], eax
jle 0x40ca08
push dword [ebp - 0x1c]
mov ecx, ebx
call fcn.004179e4
lea ecx, [ebp - 0x434]
push ecx
push eax
call fcn.00418a4b
pop ecx
test al, al
pop ecx
je 0x40c9fd
push esi
call sub.MSVCRT.dll_strlen
inc eax
push eax
push esi
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0x10
mov byte [ebp - 2], 1
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jl 0x40c9c6
mov al, byte [esi]
test al, al
jne 0x40c91d
cmp byte [ebp - 2], 0
je 0x40ca67
push edi
push 0x80
push 2
push edi
push edi
lea eax, [ebp - 0x128]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ca41
and byte [ebp - 1], 0
jmp 0x40ca67
lea eax, [ebp + 8]
push edi
push eax
push dword [ebp - 8]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
setne byte [ebp - 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call sub.MFC42.DLL_operatordelete
push dword [ebp - 8]
call sub.MFC42.DLL_operatordelete
pop ecx
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret