Function at 0x4020a7
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebp, 0x40f80c
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetSystemTime
movzx edx, word [esp + 0xe]
movzx ecx, word [esp + 0xa]
imul eax, ecx, 0x1e
add edx, eax
mov dword [0x40f678], edx
mov dword [0x40f67c], edx
push 0x64
push 0x40ec7c
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x40ec7c
call fcn.004054ec
pop ecx
movsx ecx, byte [eax + 0x40ec7c]
cmp ecx, 0x5c
jne 0x40210d
push 0x40ec7c
call fcn.004054ec
pop ecx
mov byte [eax + 0x40ec7c], 0
push 0x40c3ec
push 0x40ec7c
call fcn.00405454
add esp, 8
push 0x40c3f7
push 0x40e40c
call fcn.004054bc
add esp, 8
push 0x40c403
push 0x40e80c
call fcn.004054bc
add esp, 8
xor esi, esi
xor ebx, ebx
push 0x40c40c
imul eax, esi, 0x14a
mov edi, ebx
shl edi, 5
add edi, ebx
add eax, edi
lea edx, [ebp + 4]
add eax, edx
push eax
call fcn.004054bc
add esp, 8
imul eax, esi, 0xa5
lea ecx, [ebp + eax*2]
mov dword [ecx + edi], 0x64
lea eax, [ebp + eax*2 + 0x1d]
mov dword [eax + edi], 0x3c
inc ebx
cmp ebx, 0xa
jl 0x402147
inc esi
cmp esi, 3
jl 0x402145
push esp
push 0x40c416
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4023c1
mov dword [esp + 4], 0x400
lea edx, [esp + 4]
push edx
push 0x40e40c
push 0x40c430
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegQueryValueA
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
push 0x40e80c
push 0x40c435
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegQueryValueA
mov dword [esp + 4], 0x560
lea eax, [esp + 4]
push eax
push 0x40f0ec
lea edx, [esp + 0xc]
push edx
push 0
push 0x40c43b
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegQueryValueExA
push dword [esp]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 4], 0x55f
jne 0x4023c1
xor ecx, ecx
mov dword [0x40f64c], ecx
push 1
push 0x40c079
call fcn.00402077
add esp, 8
push 4
push 0x40c09c
call fcn.00402077
add esp, 8
push 4
push 0x40c0a0
call fcn.00402077
add esp, 8
push 0x10
call sub.USER32.dll_GetSystemMetrics
cmp eax, dword [0x40c09c]
setl bl
and ebx, 1
push 0x10
call sub.USER32.dll_GetSystemMetrics
cmp eax, dword [0x40c0a0]
setl al
and eax, 1
or ebx, eax
je 0x402296
mov edx, 0x80000000
mov dword [0x40c09c], edx
mov dword [0x40c0a0], edx
push 4
push 0x40c088
call fcn.00402077
add esp, 8
push 4
push 0x40c0a8
call fcn.00402077
add esp, 8
push 4
push 0x40c08c
call fcn.00402077
add esp, 8
push 4
push 0x40c090
call fcn.00402077
add esp, 8
push 4
push 0x40f668
call fcn.00402077
add esp, 8
push 0xc
push 0x40c07c
call fcn.00402077
add esp, 8
push 0x144
push 0x40c0ac
call fcn.00402077
add esp, 8
push 0x3de
push ebp
call fcn.00402077
add esp, 8
push 2
push 0x40c094
call fcn.00402077
add esp, 8
push 2
push 0x40c096
call fcn.00402077
add esp, 8
push 2
push 0x40c09a
call fcn.00402077
add esp, 8
push 2
push 0x40c098
call fcn.00402077
add esp, 8
push 4
push 0x40ece4
call fcn.00402077
add esp, 8
push 4
push 0x40f678
call fcn.00402077
add esp, 8
push 4
push 0x40ece8
call fcn.00402077
add esp, 8
call fcn.004019a0
test eax, eax
je 0x402397
push 0x40c440
push dword [esp + 4]
call sub.ADVAPI32.dll_RegDeleteValueA
mov eax, 1
jmp 0x402405
call fcn.00401c74
mov eax, dword [0x40c088]
mov ecx, 0x3e8
cdq
idiv ecx
mov byte [0x40c078], al
mov ecx, 0x3e8
mov eax, dword [0x40c088]
cdq
idiv ecx
mov dword [0x40c088], edx
push 0x40c445
push 0x40ec7c
call fcn.00407c7c
add esp, 8
mov ebx, eax
test eax, eax
je 0x4023fd
push ebx
push 1
push 4
push 0x40f678
call fcn.00407ef4
add esp, 0x10
push ebx
push 1
push 4
push 0x40ece0
call fcn.00407ef4
add esp, 0x10
inc dword [0x40ece0]
xor eax, eax
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret