Function at 0x40230e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10e4
call fcn.00436b30
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
mov dword [ebp - 0x1c], ecx
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40252d
push edi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0xc], esi
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x402523
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x402523
add eax, 2
push eax
push 0x40
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x18], edi
je 0x402523
push ebx
push dword [ebp - 0x10]
push esi
push edi
call fcn.00436360
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push esi
push str.PendingFileRenameOperations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402519
cmp dword [ebp - 0xc], 7
jne 0x402519
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
test eax, eax
jle 0x402519
mov ebx, str.autoup.ini
push ebx
push edi
call fcn.00436ab9
pop ecx
test eax, eax
pop ecx
jne 0x402415
push edi
call esi
lea edi, [edi + eax + 1]
push ebx
push edi
call fcn.00436ab9
pop ecx
test eax, eax
pop ecx
jne 0x402415
push edi
call esi
lea edi, [edi + eax + 1]
push edi
call esi
test eax, eax
jg 0x4023e1
jmp 0x402519
and byte [ebp - 0x80], 0
push 0x18
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
push 0x44c48c
push str.PendingState
push str.AhnLab
call esi
lea eax, [ebp - 0x80]
push eax
push str._Autoup__Update__Exist_PendingFileRenameOperations_autoup.ini___PendingState_s
push 1
call fcn.00408aae
mov ebx, 0x44c420
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00436a0a
add esp, 0x14
test eax, eax
jne 0x402519
and byte [ebp - 0xe4], al
push 0x18
pop ecx
lea edi, [ebp - 0xe3]
rep stosd dword es:[edi], eax
and byte [ebp - 0x10e4], 0
mov ecx, 0x3ff
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x10e3]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10e4]
push 0x1000
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
cmp eax, 7
jbe 0x402512
mov eax, dword [ebp - 0x1c]
push dword [ebp + 8]
lea edi, [eax + 0xfd8]
lea eax, [ebp - 0xe4]
push 0x64
push eax
push 0x44c48c
push str.PendingState
mov ecx, edi
call fcn.00406944
push eax
call esi
lea eax, [ebp - 0xe4]
push eax
push dword [edi]
push str._Autoup__Update__Exist_PendingAppName__s___PendingState_s
push 1
call fcn.00408aae
lea eax, [ebp - 0xe4]
push ebx
push eax
call fcn.00436a0a
add esp, 0x18
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [ebp - 8], ecx
jmp 0x402519
mov dword [ebp - 8], 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 8]
pop esi
leave
ret 4