Function at 0x42b9b0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5636d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5d26e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x444]
call fcn.00404160
movzx eax, byte [esi + 0x449]
cmp eax, 3
ja case.default.0x42b9f2
jmp dword [eax*4 + 0x42bfa8]
movzx eax, byte [esi + 0x440]
jmp 0x42ba20
movzx eax, byte [esi + 0x441]
jmp 0x42ba20
movzx eax, byte [esi + 0x442]
jmp 0x42ba20
movzx eax, byte [esi + 0x443]
jmp 0x42ba20
mov eax, dword [ebp + 8]
test eax, eax
jne 0x42bc2c
lea ecx, [ebp - 0x10]
or bl, 0xff
call fcn.00404e40
mov dword [ebp - 4], 0
cmp byte [esi + 0x450], 0
je 0x42bae6
push 1
push 0x58a919
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42bae6
cmp word [esi + 0x12], 0
jne 0x42bbba
lea eax, [ebp - 0x18]
push eax
push 0x14
lea edi, [esi + 0x14]
push edi
call fcn.00469d00
mov ebx, dword [ebp - 0x18]
shr ebx, 8
xor bl, 0x15
push 0
mov word [esi + 0x12], ax
and bl, 0x3f
call fcn.004d0877
push eax
call fcn.004d08c8
add esp, 8
call fcn.004d08da
movzx edx, byte [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor al, 0x15
and al, 0x3f
movzx cx, al
shl cx, 8
or cx, dx
movzx eax, cx
push 0
push eax
push 0x14
push 0x97ba
push edi
mov dword [ebp - 0x18], eax
call fcn.00469d60
mov word [esi + 0x12], ax
test ax, ax
jne 0x42bad8
mov dword [esi + 4], 0xffffffff
push 0
mov ecx, esi
call fcn.00428070
jmp 0x42bbba
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
push str.SoftwareDataEnvDesSolLtdManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42bbba
movzx eax, byte [esi + 0x449]
mov dword [ebp - 0x20], 4
cmp eax, 3
ja case.default.0x42bb1c
jmp dword [eax*4 + 0x42bfb8]
push str.LiteRet
jmp 0x42bb3d
push str.AmbRet
jmp 0x42bb3d
push str.SysRet
jmp 0x42bb3d
push str.Amb3DRet
lea ecx, [ebp - 0x10]
call fcn.00408150
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov bl, byte [ebp - 0x14]
xor bl, 0x15
and bl, 0x3f
test eax, eax
jne 0x42bb76
cmp bl, byte [esi + 0x44f]
jne 0x42bbcb
push 0
call fcn.004d0877
push eax
call fcn.004d08c8
add esp, 8
call fcn.004d08da
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x42bbba
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp bl, byte [esi + 0x44f]
jne 0x42bbcb
push 0
mov ecx, esi
call fcn.0042b430
movzx eax, byte [esi + 0x449]
cmp eax, 3
ja case.default.0x42bbd7
jmp dword [eax*4 + 0x42bfc8]
lea eax, [esi + 0x420]
jmp 0x42bc08
push str.AAAA_AAAA_AAAA_AAAA
lea ecx, [esi + 0x424]
push ecx
jmp 0x42bc0e
push str.AAAA_AAAA_AAAA_AAAA
lea edx, [esi + 0x41c]
push edx
jmp 0x42bc0e
lea eax, [esi + 0x428]
push str.AAAA_AAAA_AAAA_AAAA
push eax
call fcn.0041a6a0
add esp, 8
mov byte [esi + 0x449], 0xff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004022b0
lea ecx, [ebp + 8]
call fcn.00404e40
mov dword [ebp - 4], 1
movzx eax, byte [esi + 0x449]
cmp eax, 0xff
jg case.default.0x42bc54
je 0x42bcbb
cmp eax, 3
ja case.default.0x42bc54
jmp dword [eax*4 + 0x42bfd8]
lea ecx, [esi + 0x420]
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 0x19
call fcn.00420ac0
jmp case.default.0x42bc54
lea edx, [esi + 0x41c]
push edx
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 0x1e
call fcn.00420ac0
jmp case.default.0x42bc54
lea eax, [esi + 0x424]
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 0x23
call fcn.00420ac0
jmp case.default.0x42bc54
lea ecx, [esi + 0x428]
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 0x28
call fcn.00420ac0
jmp case.default.0x42bc54
lea edx, [ebp + 8]
push str.AAAA_AAAA_AAAA_AAAA
push edx
mov dword [ebp - 0x10], 0x19
call fcn.0041a6a0
add esp, 8
lea eax, [ebp - 0x34]
push eax
push ecx
lea edx, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x24], esp
push edx
call fcn.0041ba40
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00429a10
test al, al
jne 0x42bd21
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004022b0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x450], 0
je 0x42be85
push 1
push 0x58a919
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42be85
cmp word [esi + 0x12], 0
jne 0x42be77
xor eax, eax
cmp byte [esi + 0x449], 0xff
setne al
dec eax
and eax, 3
add eax, 1
je 0x42be77
lea ebx, [esi + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2a]
movzx edi, word [ebp - 0x10]
push 0
push eax
push edi
push 0x97ba
push ebx
call fcn.00469d60
mov word [esi + 0x12], ax
test ax, ax
je 0x42bda1
lea eax, [esi + 0x444]
push str.Failed_write
push eax
call fcn.0041a6a0
add esp, 8
mov ecx, dword [ebp - 0x2c]
push 0
push ecx
lea edx, [edi + 1]
push edx
push 0x97ba
push ebx
call fcn.00469d60
mov word [esi + 0x12], ax
test ax, ax
je 0x42bdd3
lea eax, [esi + 0x444]
push str.Failed_write
push eax
call fcn.0041a6a0
add esp, 8
mov eax, dword [ebp - 0x2e]
push 0
push eax
lea ecx, [edi + 2]
push ecx
push 0x97ba
push ebx
call fcn.00469d60
mov word [esi + 0x12], ax
test ax, ax
je 0x42be05
lea eax, [esi + 0x444]
push str.Failed_write
push eax
call fcn.0041a6a0
add esp, 8
mov edx, dword [ebp - 0x30]
push 0
push edx
lea eax, [edi + 3]
push eax
push 0x97ba
push ebx
call fcn.00469d60
mov word [esi + 0x12], ax
test ax, ax
je 0x42be37
lea eax, [esi + 0x444]
push str.Failed_write
push eax
call fcn.0041a6a0
add esp, 8
mov ecx, dword [ebp - 0x32]
push 0
push ecx
add edi, 4
push edi
push 0x97ba
push ebx
call fcn.00469d60
mov word [esi + 0x12], ax
test ax, ax
je 0x42be69
lea eax, [esi + 0x444]
push str.Failed_write
push eax
call fcn.0041a6a0
add esp, 8
add dword [ebp - 0x10], 5
sub dword [ebp - 0x20], 1
jne 0x42bd6e
push 0
mov ecx, esi
call fcn.00428070
jmp 0x42bf83
movzx eax, byte [esi + 0x449]
cmp eax, 3
ja case.default.0x42be95
jmp dword [eax*4 + 0x42bfe8]
mov esi, dword [esi + 0x420]
push str.TasManager.ini
push esi
push str.LiteKey
push str.Keys
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x42bf83
mov esi, dword [esi + 0x41c]
push str.TasManager.ini
push esi
push str.SysKey
push str.Keys
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x42bf83
mov esi, dword [esi + 0x424]
push str.TasManager.ini
push esi
push str.AmbKey
push str.Keys
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x42bf83
mov esi, dword [esi + 0x428]
push str.TasManager.ini
push esi
push str.Amb3DKey
push str.Keys
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x42bf83
mov eax, dword [esi + 0x420]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.TasManager.ini
push eax
push str.LiteKey
push str.Keys
call edi
mov eax, dword [esi + 0x41c]
push str.TasManager.ini
push eax
push str.SysKey
push str.Keys
call edi
mov eax, dword [esi + 0x424]
push str.TasManager.ini
push eax
push str.AmbKey
push str.Keys
call edi
mov esi, dword [esi + 0x428]
push str.TasManager.ini
push esi
push str.Amb3DKey
push str.Keys
call edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004022b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4