Function at 0x401c90
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0xac
mov al, byte [0x4fbe40]
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x15]
mov edx, dword [0x4fbe20]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.user32.dll_LoadStringA]
lea ecx, [esp + 0x14]
stosw word es:[edi], ax
push 0x50
push ecx
push 0x2bd
push edx
stosb byte es:[edi], al
call esi
lea eax, [esp + 0x14]
push eax
call fcn.004c7f29
mov edx, dword [0x4fbe20]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [0x4fc168], eax
push 0x50
push ecx
push 0x2be
push edx
call esi
lea eax, [esp + 0x14]
push eax
call fcn.004c7f29
mov ecx, dword [0x4fbe20]
add esp, 4
mov dword [0x4fc16c], eax
push 0x100
push 0x4ee164
push 0x2bf
push ecx
call esi
mov edx, dword [0x4fbe20]
push 0x100
push 0x4fbd18
push 0x2c0
push edx
call esi
mov eax, dword [0x4fc168]
mov esi, 1
cmp eax, esi
mov dword [0x4fc170], 0x4fbd18
jne 0x401d66
cmp dword [0x4fc16c], 0xd
jne 0x401d66
mov dword [0x4fc174], 0x4ee2fc
mov dword [0x4fc19c], esi
mov ecx, dword [0x4fbe20]
mov eax, dword [0x4ee790]
mov edx, dword [0x4ee054]
mov dword [0x4fc150], ecx
mov ecx, dword [0x4ee050]
mov dword [0x4fc254], eax
mov dword [0x4fc158], ecx
mov ecx, 0x3ee
mov eax, 0x1e
mov dword [0x4fc154], edx
mov edx, dword [0x4ee264]
mov dword [0x4fc1bc], ecx
mov dword [0x4fc1c0], ecx
push eax
mov ecx, 0x4fc150
mov dword [0x4ee268], eax
mov dword [0x4ee26c], 0x14
mov dword [0x4ee270], 5
mov dword [0x4ee274], eax
mov dword [0x4ee278], eax
mov dword [0x4fc15c], 0x4ee05c
mov dword [0x4fc160], edx
mov dword [0x4fc164], 0x4ee2f0
mov dword [0x4fc1a4], 0x65
mov dword [0x4fc1a8], 0x74
mov dword [0x4fc1ac], 0x8e
mov dword [0x4fc1b0], 0x3ec
mov dword [0x4fc1b4], 0x3eb
mov dword [0x4fc1b8], 0x8f
mov dword [0x4fc1c4], 0x90
mov dword [0x4fc1c8], 0x3ff
mov dword [0x4fc1cc], 0x3fe
mov dword [0x4fc1d4], 0x71
mov dword [0x4fc1d8], 0x14d
mov dword [0x4fc1dc], 0x3fa
mov dword [0x4fc1e0], 0x7d
mov dword [0x4fc1e4], 0x1a5
mov dword [0x4fc1ec], esi
mov dword [0x4fc1f0], 2
mov dword [0x4fc1f4], 0x79
mov dword [0x4fc1f8], 0x81
mov dword [0x4fc1fc], 0x210
mov dword [0x4fc200], 0x6b
mov dword [0x4fc204], 0x72
mov dword [0x4fc208], 0x67
mov dword [0x4fc20c], 0x82
mov dword [0x4fc210], 0x1a7
mov dword [0x4fc214], 0x20c
mov dword [0x4fc218], 0x236
mov dword [0x4fc21c], 0x237
mov dword [0x4fc220], 0x234
mov dword [0x4fc224], 0x233
mov dword [0x4fc228], 0x232
mov dword [0x4fc22c], 0x238
mov dword [0x4fc230], 0xc6
mov dword [0x4fc234], 0xc4
mov dword [0x4fc238], 0x12c
mov dword [0x4fc23c], 0x12d
mov dword [0x4fc240], 0x12f
mov dword [0x4fc244], 0xa0
mov dword [0x4fc248], esi
call fcn.00452010
mov eax, dword [esp + 0xb8]
push 0x4ee2d4
push eax
call dword [sym.imp.kernel32.dll_lstrcmpi]
test eax, eax
jne 0x40200a
mov edx, dword [0x4fc160]
lea ecx, [esp + 8]
push ecx
push 0x2001f
push eax
push edx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401fff
lea eax, [esp + 0xc]
lea ecx, [esp + 0x64]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x4ee2c4
push eax
mov dword [esp + 0x24], 0x50
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0x64]
push ecx
mov ecx, 0x4fc150
call fcn.00451fb0
test eax, eax
jne 0x401ff4
mov edx, dword [esp + 8]
push 0x4ee2c4
push edx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xac
ret
mov eax, esi
pop edi
pop esi
add esp, 0xac
ret