Function at 0x40a1c2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp + 8]
and dword [eax], 0
call fcn.00409fa1
test eax, eax
jne 0x40a1f1
mov eax, 0xffff
jmp 0x40a4da
lea eax, [ebp - 0x230]
push eax
call fcn.00409c32
pop ecx
test eax, eax
je 0x40a20c
mov eax, 0xffff
jmp 0x40a4da
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x20007
push 0
push 0
push 0
push str.SoftwareSymantecNorton_UtilitiesNorton_UnEraseStateIcons
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40a24e
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffff
jmp 0x40a4da
mov dword [ebp - 0x11c], 0x10e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x41747c
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40a2c9
mov al, byte [0x4220bc]
mov byte [ebp - 0x234], al
push 0
lea eax, [ebp - 0x234]
push eax
push 1
push 0
push 0x41747c
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffff
jmp 0x40a4da
mov dword [ebp - 0x11c], 0x10e
and byte [ebp - 0x22c], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.CurrentEmpty
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a32a
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0040f490
pop ecx
pop ecx
test eax, eax
jne 0x40a32a
lea eax, [ebp - 0x22c]
push eax
call fcn.0040a83f
pop ecx
test eax, eax
jne 0x40a381
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40a354
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040a4dc
pop ecx
pop ecx
test eax, eax
jne 0x40a37f
push 0
call fcn.00409e5f
pop ecx
test eax, eax
je 0x40a37f
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffff
jmp 0x40a4da
jmp 0x40a38a
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov dword [ebp - 0x11c], 0x10e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x417484
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40a405
mov al, byte [0x4220c0]
mov byte [ebp - 0x238], al
push 0
lea eax, [ebp - 0x238]
push eax
push 1
push 0
push 0x417484
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffff
jmp 0x40a4da
mov dword [ebp - 0x11c], 0x10e
and byte [ebp - 0x22c], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.CurrentFull
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a466
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0040f490
pop ecx
pop ecx
test eax, eax
jne 0x40a466
lea eax, [ebp - 0x22c]
push eax
call fcn.0040a83f
pop ecx
test eax, eax
jne 0x40a4ba
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40a490
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040a4dc
pop ecx
pop ecx
test eax, eax
jne 0x40a4b8
push 1
call fcn.00409e5f
pop ecx
test eax, eax
je 0x40a4b8
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffff
jmp 0x40a4da
jmp 0x40a4c3
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret