Function at 0x42abb4
Capabilities:
Delete registry key
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff224
mov eax, 0x4508e8
call fcn.00403b30
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x5a0], ecx
push 4
push 0x45097c
push 0x1b5f
push 0
mov eax, dword [ebp - 0x5a0]
push eax
call fcn.0041d16c
add esp, 0x14
cmp eax, 6
je 0x42ac09
mov edx, dword [ebp - 0x59c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x42b066
cmp dword [0x4560a4], 0
jne 0x42acea
mov word [ebp - 0x58c], 8
lea ecx, [ebp - 0x578]
push ecx
call fcn.0040f344
pop ecx
add dword [ebp - 0x580], 5
mov word [ebp - 0x58c], 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
push edx
lea ecx, [ebp - 0x578]
push ecx
call fcn.0040f8e4
sub dword [ebp - 0x580], 5
add dword [ebp - 0x580], 5
dec dword [ebp - 0x580]
add esp, 8
mov dword [ebp - 0x4f0], 0x44e954
cmp dword [ebp - 0x4d0], 0
je 0x42ac86
mov eax, dword [ebp - 0x4d0]
push eax
call fcn.0040b2e8
pop ecx
sub dword [ebp - 0x580], 2
add dword [ebp - 0x580], 2
dec dword [ebp - 0x580]
mov dword [ebp - 0x55c], 0x44e954
cmp dword [ebp - 0x53c], 0
je 0x42acba
mov edx, dword [ebp - 0x53c]
push edx
call fcn.0040b2e8
pop ecx
dec dword [ebp - 0x580]
lea ecx, [ebp - 0x578]
mov dword [ebp - 0x578], 0x44ec48
push ecx
call fcn.0042c1a8
pop ecx
push 0
push 0
lea eax, [ebp - 0x578]
push eax
call fcn.0042bca0
add esp, 0xc
lea edx, [ebp - 0x5a4]
push edx
push 0xf003f
push 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x48c
push eax
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x42ad87
xor edx, edx
mov dword [ebp - 0x5a8], edx
mov dword [ebp - 0x5ac], pe_nt_image_headers32
jmp 0x42ad49
lea ecx, [ebp - 0x6d4]
push ecx
mov eax, dword [ebp - 0x5a4]
push eax
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [ebp - 0x5ac], pe_nt_image_headers32
inc dword [ebp - 0x5a8]
lea edx, [ebp - 0x5b4]
lea ecx, [ebp - 0x5ac]
push edx
push 0
push 0
push 0
push ecx
lea eax, [ebp - 0x6d4]
push eax
mov edx, dword [ebp - 0x5a8]
push edx
mov ecx, dword [ebp - 0x5a4]
push ecx
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x42ad26
mov eax, dword [ebp - 0x5a4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x48c
push ecx
push 0x80000001
call sub.ADVAPI32.dll_RegDeleteKeyA
lea eax, [ebp - 0x5a4]
push eax
push 0xf003f
push 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x48c
push ecx
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x42ae3c
xor eax, eax
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x5bc], pe_nt_image_headers32
jmp 0x42adfe
lea edx, [ebp - 0x7d4]
push edx
mov ecx, dword [ebp - 0x5a4]
push ecx
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [ebp - 0x5bc], pe_nt_image_headers32
inc dword [ebp - 0x5b8]
lea eax, [ebp - 0x5c4]
lea edx, [ebp - 0x5bc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x7d4]
push ecx
mov eax, dword [ebp - 0x5b8]
push eax
mov edx, dword [ebp - 0x5a4]
push edx
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x42addb
mov ecx, dword [ebp - 0x5a4]
push ecx
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x48c
push edx
push 0x80000002
call sub.ADVAPI32.dll_RegDeleteKeyA
xor ecx, ecx
lea eax, [ebp - 0x8d8]
mov dword [ebp - 0x5c8], ecx
push 0x104
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x284
push ecx
call sub.KERNEL32.dll_GetShortPathNameA
push 0
lea eax, [ebp - 0x5c8]
push eax
push 0
push 0x10
call sub.USER32.dll_SystemParametersInfoA
cmp dword [ebp - 0x5c8], 0
je 0x42af0a
push 0x45099b
lea edx, [ebp - 0x9dc]
push 0x104
push edx
push 0x450968
push 0x45098e
push 0x450989
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [ebp - 0x9dc]
push ecx
call fcn.00401348
pop ecx
test eax, eax
je 0x42af0a
lea eax, [ebp - 0x8d8]
push eax
lea edx, [ebp - 0x9dc]
push edx
call fcn.004014d0
add esp, 8
test eax, eax
jne 0x42af0a
push 3
push 0
push 0
push 0x11
call sub.USER32.dll_SystemParametersInfoA
push 0x45099b
push 0x450968
push 0x45098e
push 0x450989
call sub.KERNEL32.dll_WritePrivateProfileStringA
xor ecx, ecx
lea eax, [ebp - 0xddc]
mov dword [ebp - 0x5cc], ecx
push 0x104
push eax
push 0x1be0
push 0xfffffffffffffffa
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
push ecx
call sub.USER32.dll_GetWindowLongA
push eax
call sub.USER32.dll_LoadStringA
push 0x4509a6
lea eax, [ebp - 0xddc]
push eax
call fcn.0040123c
add esp, 8
lea edx, [ebp - 0xddc]
push edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x284
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042b2c8
add esp, 0xc
test eax, eax
je 0x42af78
mov dword [ebp - 0x5cc], 1
lea ecx, [ebp - 0xddc]
push ecx
push 0x4509a8
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x284
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042b06c
add esp, 0x10
test eax, eax
je 0x42afab
mov dword [ebp - 0x5cc], 1
lea eax, [ebp - 0xddc]
push eax
push 0x4509ad
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x284
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0042b06c
add esp, 0x10
test eax, eax
je 0x42afde
mov dword [ebp - 0x5cc], 1
cmp dword [ebp - 0x5cc], 0
je 0x42b00d
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xddc]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x5d0], ecx
push 0x30
push 0x4509b2
push eax
mov edx, dword [ebp - 0x5d0]
push edx
call sub.USER32.dll_MessageBoxA
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call sub.USER32.dll_GetParent
test eax, eax
je 0x42b035
push 0
push 0
push 0x10
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
push ecx
call sub.USER32.dll_GetParent
push eax
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 2
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
push ecx
call sub.USER32.dll_DestroyWindow
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x59c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret