Function at 0x42f26c
Capabilities:
Delete registry key
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff224
mov eax, 0x455ca0
call fcn.00403b30
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x5a0], ecx
push 4
push 0x455d44
push 0x1b5f
push 0
mov eax, dword [ebp - 0x5a0]
push eax
call fcn.0041e8d0
add esp, 0x14
cmp eax, 6
je 0x42f2c1
mov edx, dword [ebp - 0x59c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x42f728
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1e68], 1
cmp dword [0x45b47c], 0
jne 0x42f3af
mov word [ebp - 0x58c], 8
lea eax, [ebp - 0x578]
push eax
call fcn.0040dfbc
pop ecx
add dword [ebp - 0x580], 5
mov word [ebp - 0x58c], 0x14
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
push ecx
lea eax, [ebp - 0x578]
push eax
call fcn.0040e55c
sub dword [ebp - 0x580], 5
add dword [ebp - 0x580], 5
dec dword [ebp - 0x580]
add esp, 8
mov dword [ebp - 0x4f0], 0x4535ac
cmp dword [ebp - 0x4d0], 0
je 0x42f34b
mov edx, dword [ebp - 0x4d0]
push edx
call fcn.0040b2e8
pop ecx
sub dword [ebp - 0x580], 2
add dword [ebp - 0x580], 2
dec dword [ebp - 0x580]
mov dword [ebp - 0x55c], 0x4535ac
cmp dword [ebp - 0x53c], 0
je 0x42f37f
mov ecx, dword [ebp - 0x53c]
push ecx
call fcn.0040b2e8
pop ecx
dec dword [ebp - 0x580]
lea eax, [ebp - 0x578]
mov dword [ebp - 0x578], 0x453968
push eax
call fcn.004308d4
pop ecx
push 0
push 0
lea edx, [ebp - 0x578]
push edx
call fcn.004303cc
add esp, 0xc
lea ecx, [ebp - 0x5a4]
push ecx
push 0xf003f
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x48c
push edx
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x42f44d
xor ecx, ecx
mov dword [ebp - 0x5a8], ecx
mov dword [ebp - 0x5ac], pe_nt_image_headers32
jmp 0x42f40f
lea eax, [ebp - 0x6d4]
push eax
mov edx, dword [ebp - 0x5a4]
push edx
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [ebp - 0x5ac], pe_nt_image_headers32
inc dword [ebp - 0x5a8]
lea ecx, [ebp - 0x5b4]
lea eax, [ebp - 0x5ac]
push ecx
push 0
push 0
push 0
push eax
lea edx, [ebp - 0x6d4]
push edx
mov ecx, dword [ebp - 0x5a8]
push ecx
mov eax, dword [ebp - 0x5a4]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x42f3ec
mov edx, dword [ebp - 0x5a4]
push edx
call sub.ADVAPI32.dll_RegCloseKey
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x48c
push eax
push 0x80000001
call sub.ADVAPI32.dll_RegDeleteKeyA
lea edx, [ebp - 0x5a4]
push edx
push 0xf003f
push 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x48c
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x42f500
xor edx, edx
mov dword [ebp - 0x5b8], edx
mov dword [ebp - 0x5bc], pe_nt_image_headers32
jmp 0x42f4c2
lea ecx, [ebp - 0x7d4]
push ecx
mov eax, dword [ebp - 0x5a4]
push eax
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [ebp - 0x5bc], pe_nt_image_headers32
inc dword [ebp - 0x5b8]
lea edx, [ebp - 0x5c4]
lea ecx, [ebp - 0x5bc]
push edx
push 0
push 0
push 0
push ecx
lea eax, [ebp - 0x7d4]
push eax
mov edx, dword [ebp - 0x5b8]
push edx
mov ecx, dword [ebp - 0x5a4]
push ecx
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x42f49f
mov eax, dword [ebp - 0x5a4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x48c
push ecx
push 0x80000002
call sub.ADVAPI32.dll_RegDeleteKeyA
xor eax, eax
lea edx, [ebp - 0x8d8]
mov dword [ebp - 0x5c8], eax
push 0x104
push edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x284
push eax
call sub.KERNEL32.dll_GetShortPathNameA
push 0
lea edx, [ebp - 0x5c8]
push edx
push 0
push 0x10
call sub.USER32.dll_SystemParametersInfoA
cmp dword [ebp - 0x5c8], 0
je 0x42f5cd
push 0x455d63
lea ecx, [ebp - 0x9dc]
push 0x104
push ecx
push 0x455d30
push 0x455d56
push 0x455d51
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x9dc]
push eax
call fcn.00401348
pop ecx
test eax, eax
je 0x42f5cd
lea edx, [ebp - 0x8d8]
push edx
lea ecx, [ebp - 0x9dc]
push ecx
call fcn.004014d0
add esp, 8
test eax, eax
jne 0x42f5cd
push 3
push 0
push 0
push 0x11
call sub.USER32.dll_SystemParametersInfoA
push 0x455d63
push 0x455d30
push 0x455d56
push 0x455d51
call sub.KERNEL32.dll_WritePrivateProfileStringA
xor eax, eax
lea edx, [ebp - 0xddc]
mov dword [ebp - 0x5cc], eax
push 0x104
push edx
push 0x1be0
push 0xfffffffffffffffa
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call sub.USER32.dll_GetWindowLongA
push eax
call sub.USER32.dll_LoadStringA
push 0x455d6e
lea edx, [ebp - 0xddc]
push edx
call fcn.0040123c
add esp, 8
lea ecx, [ebp - 0xddc]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x59]
add edx, 0x284
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042f988
add esp, 0xc
test eax, eax
je 0x42f63c
mov dword [ebp - 0x5cc], 1
lea eax, [ebp - 0xddc]
push eax
push 0x455d70
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x59]
add ecx, 0x284
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0042f72c
add esp, 0x10
test eax, eax
je 0x42f66f
mov dword [ebp - 0x5cc], 1
lea edx, [ebp - 0xddc]
push edx
push 0x455d75
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x59]
add eax, 0x284
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042f72c
add esp, 0x10
test eax, eax
je 0x42f6a1
mov dword [ebp - 0x5cc], 1
cmp dword [ebp - 0x5cc], 0
je 0x42f6d0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0xddc]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x5d0], eax
push 0x30
push 0x455d7a
push edx
mov ecx, dword [ebp - 0x5d0]
push ecx
call sub.USER32.dll_MessageBoxA
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
call sub.USER32.dll_GetParent
test eax, eax
je 0x42f6f8
push 0
push 0
push 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call sub.USER32.dll_GetParent
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 2
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call sub.USER32.dll_DestroyWindow
mov dword [ebp - 0x5d4], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x59c]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret