Function at 0x401390
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x344
mov al, byte [0x403020]
push ebx
push ebp
push edi
mov byte [esp + 0x24c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x24d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x354]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov ebp, 0xff
push ecx
push 0xf013f
push ebx
push edx
push 0x80000002
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebp
stosw word es:[edi], ax
mov dword [esp + 0x30], ebp
mov byte [esp + 0x23], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x401436
cmp eax, 2
pop edi
pop ebp
pop ebx
sete al
add esp, 0x344
ret
lea eax, [esp + 0x44]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x48]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x4c]
push ecx
lea eax, [esp + 0x4c]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x48]
push ebx
lea eax, [esp + 0x270]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4015a7
lea edx, [eax*4]
push esi
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, eax
mov eax, dword [esp + 0x18]
add esp, 4
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x1c], ecx
jbe 0x4014c1
mov edi, ecx
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [edi], eax
mov eax, dword [esp + 0x14]
inc esi
add edi, 4
cmp esi, eax
jb 0x4014a6
mov ecx, dword [esp + 0x1c]
xor edi, edi
cmp eax, ebx
jbe 0x40153c
mov ebp, ecx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x150]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x30]
push ebx
lea ecx, [esp + 0x60]
push eax
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov eax, dword [ebp]
lea ecx, [esp + 0x50]
mov esi, 0xff
mov dl, byte [ecx]
cmp dl, bl
je 0x40150d
mov byte [eax], dl
inc eax
inc ecx
dec esi
jne 0x4014fe
jmp 0x401511
cmp esi, ebx
jne 0x401512
dec eax
mov byte [eax], bl
mov eax, 0xff
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
inc edi
add ebp, 4
cmp edi, eax
mov byte [esp + 0x50], bl
mov byte [esp + 0x150], bl
jb 0x4014c9
mov ecx, dword [esp + 0x1c]
xor edi, edi
cmp eax, ebx
jbe 0x401570
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call ebp
test eax, eax
jne 0x40155c
mov dword [esi], ebx
jmp 0x401560
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x14]
inc edi
add esi, 4
cmp edi, eax
jb 0x40154a
mov ecx, dword [esp + 0x1c]
xor edi, edi
cmp eax, ebx
jbe 0x401599
mov esi, ecx
mov eax, dword [esi]
cmp eax, ebx
je 0x40158b
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [esi], ebx
mov eax, dword [esp + 0x14]
inc edi
add esi, 4
cmp edi, eax
jb 0x401578
cmp ecx, ebx
pop esi
je 0x4015a7
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0xf]
pop edi
pop ebp
pop ebx
add esp, 0x344
ret