Function at 0x4024d3
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x114], 0
jmp 0x40250d
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x114], eax
jge 0x402552
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x2c
jne 0x40254d
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov byte [eax + ecx], 0
inc dword [ebp - 0x114]
jmp 0x402552
jmp 0x402507
mov eax, dword [ebp - 0x114]
add eax, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x114], 0
jmp 0x402576
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x114], eax
jge 0x4025bb
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x2c
jne 0x4025b6
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov byte [eax + ecx], 0
inc dword [ebp - 0x114]
jmp 0x4025bb
jmp 0x402570
mov eax, dword [ebp - 0x114]
add eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
push 0x407838
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4025f3
mov dword [ebp - 0x224], 0x80000000
jmp 0x4026e4
push 0x40784c
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40261c
mov dword [ebp - 0x224], 0x80000005
jmp 0x4026e4
push 0x407860
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402645
mov dword [ebp - 0x224], 0x80000001
jmp 0x4026e4
push 0x407874
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40266e
mov dword [ebp - 0x224], 0x80000002
jmp 0x4026e4
push 0x407888
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402697
mov dword [ebp - 0x224], 0x80000003
jmp 0x4026e4
push 0x407894
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4026c0
mov dword [ebp - 0x224], 0x80000004
jmp 0x4026e4
push 0x4078ac
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4026e4
mov dword [ebp - 0x224], 0x80000006
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40284b
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x10c], eax
push str.Save
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x110]
push eax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x324]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40282a
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4027e6
lea eax, [ebp - 0x324]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x402825
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
lea eax, [ebp - 0x324]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40283e
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402850
pop edi
pop esi
pop ebx
leave
ret