Function at 0x4021e6
Capabilities:
Delete registry value
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push 0x40a2e0
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40922c
lea ecx, [ebp - 0x2f8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x1f4]
push edx
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffff
jne 0x40223d
xor eax, eax
jmp 0x4027a3
mov ecx, dword [ebp - 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x1d4]
mov dword [ebp - 0x314], edx
mov eax, dword [ebp - 0x314]
add eax, 8
mov dword [ebp - 0x30c], eax
mov ecx, dword [ebp - 0x30c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0
jne 0x40228a
xor eax, eax
jmp 0x4027a3
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jne 0x4022ba
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4027a3
mov ecx, dword [ebp - 0xb4]
add ecx, 8
mov dword [ebp - 8], ecx
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [ebp - 0x2f8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x300], eax
push 0
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x314]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x300]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x300]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 1
je 0x402340
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4027a3
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x1e0]
mov dword [ecx], edx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x1dc]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x308]
push edx
push 0xf003f
push 0
push 0x40923c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x402391
xor eax, eax
jmp 0x4027a3
mov dword [ebp - 0xac], 0
push 0x94
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.00404cb0
add esp, 0xc
mov dword [ebp - 0x9c], 0x94
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x8c], 2
jne 0x40246a
cmp dword [ebp - 0x98], 4
jne 0x40246a
mov dword [ebp - 0xa4], 4
mov dword [ebp - 0x314], 4
mov dword [ebp - 0x2fc], 1
push 0x409280
lea edx, [ebp - 0x2f8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x314]
push eax
lea ecx, [ebp - 0x2fc]
push ecx
mov edx, dword [ebp - 0xa4]
push edx
push 0
lea eax, [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x402460
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4027a3
mov dword [ebp - 0xac], 1
cmp dword [ebp - 0xac], 0
jne 0x4024c5
push 0x409284
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x2f8]
push ecx
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x4024c5
cmp dword [ebp - 0xa0], 2
je 0x4024c5
mov eax, dword [ebp - 0x308]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4027a3
mov dword [ebp - 0xa4], 3
push 0x409288
lea ecx, [ebp - 0x2f8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xac], 0
lea edx, [ebp - 0xac]
push edx
push 0
lea eax, [ebp - 0xa4]
push eax
push 0
lea ecx, [ebp - 0x2f8]
push ecx
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x4026e3
mov eax, dword [ebp - 0xac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x402570
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4027a3
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
jne 0x4025c7
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x308]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4027a3
push 0x409290
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x310]
push edx
lea eax, [ebp - 0xa4]
push eax
push 0
lea ecx, [ebp - 0x2f8]
push ecx
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x40265b
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4027a3
mov edx, dword [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x4026c9
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x308]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
jmp 0x4027a3
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0xa4], 3
push 0x409298
lea edx, [ebp - 0x2f8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x30c]
push eax
mov ecx, dword [ebp - 0xb4]
push ecx
mov edx, dword [ebp - 0xa4]
push edx
push 0
lea eax, [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x402760
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xa0], 0
je 0x402794
xor eax, eax
jmp 0x4027a3
mov dword [0x40a3ec], 1
mov eax, 1
mov esp, ebp
pop ebp
ret