Function at 0x434f8c
Capabilities:
Delete registry key
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov dword [ebp - 4], edx
push 4
push 0x45a720
push 0x1b61
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00426a20
add esp, 0x14
cmp eax, 6
jne 0x4352cd
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x48c
push ecx
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x43503e
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], pe_nt_image_headers32
jmp 0x43500f
lea edx, [ebp - 0x138]
push edx
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [ebp - 0x10], pe_nt_image_headers32
inc dword [ebp - 0xc]
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x10]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x138]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x434ff5
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x48c
push edx
push 0x80000001
call sub.ADVAPI32.dll_RegDeleteKeyA
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x48c
push edx
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4350d2
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], pe_nt_image_headers32
jmp 0x4350a3
lea eax, [ebp - 0x238]
push eax
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [ebp - 0x20], pe_nt_image_headers32
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x20]
push ecx
push 0
push 0
push 0
push eax
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x1c]
push ecx
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x435089
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegCloseKey
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x48c
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegDeleteKeyA
xor edx, edx
lea ecx, [ebp - 0x33c]
mov dword [ebp - 0x2c], edx
push 0x104
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x284
push edx
call sub.KERNEL32.dll_GetShortPathNameA
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0x10
call sub.USER32.dll_SystemParametersInfoA
cmp dword [ebp - 0x2c], 0
je 0x435196
push 0x45a73f
lea eax, [ebp - 0x440]
push 0x104
push eax
push 0x45a70c
push 0x45a732
push 0x45a72d
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebp - 0x440]
push edx
call fcn.0040a25c
pop ecx
test eax, eax
je 0x435196
lea ecx, [ebp - 0x33c]
push ecx
lea eax, [ebp - 0x440]
push eax
call fcn.0040a3e4
add esp, 8
test eax, eax
jne 0x435196
push 3
push 0
push 0
push 0x11
call sub.USER32.dll_SystemParametersInfoA
push 0x45a73f
push 0x45a70c
push 0x45a732
push 0x45a72d
call sub.KERNEL32.dll_WritePrivateProfileStringA
xor edx, edx
lea ecx, [ebp - 0x840]
mov dword [ebp - 0x30], edx
push 0x104
push ecx
push 0x1be0
push 0xfffffffffffffffa
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
call sub.USER32.dll_GetWindowLongA
push eax
call sub.USER32.dll_LoadStringA
push 0x45a74a
lea ecx, [ebp - 0x840]
push ecx
call fcn.0040a150
add esp, 8
lea eax, [ebp - 0x840]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x284
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00435530
add esp, 0xc
test eax, eax
je 0x4351ff
mov dword [ebp - 0x30], 1
lea edx, [ebp - 0x840]
push edx
push 0x45a74c
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x284
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004352d4
add esp, 0x10
test eax, eax
je 0x43522e
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x840]
push ecx
push 0x45a751
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x284
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004352d4
add esp, 0x10
test eax, eax
je 0x43525e
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], 0
je 0x435284
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x840]
mov edx, dword [eax + 4]
mov dword [ebp - 0x34], edx
push 0x30
push 0x45a756
push ecx
mov eax, dword [ebp - 0x34]
push eax
call sub.USER32.dll_MessageBoxA
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
push ecx
call sub.USER32.dll_GetParent
test eax, eax
je 0x4352ac
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
call sub.USER32.dll_GetParent
push eax
call sub.USER32.dll_SendMessageA
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], 2
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
call sub.USER32.dll_DestroyWindow
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret