Function at 0x402450
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x24]
mov esi, 1
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dbg.parse_registry_key
test eax, eax
je 0x402529
cmp dword [ebp + 8], 3
jle 0x402800
mov dword [ebp - 0x38], 0
mov edi, 3
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp + 0xc], ebx
lea eax, [edi*4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + edi*4]
movzx eax, word [ebx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x4024f9
lea esi, [ebx + 2]
mov dword [esp + 4], 0x4090fc
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x402708
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x402538
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0x69
call dbg.output_message
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsupr]
mov dword [esp], 0x6a
mov dword [esp + 4], eax
call dbg.output_message
mov esi, 1
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x2c], 1
add edi, 1
cmp dword [ebp + 8], edi
jg 0x4024b7
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
setne al
mov edi, eax
movzx eax, byte [ebp - 0x2c]
or al, byte [ebp - 0x34]
je 0x402567
mov eax, edi
test al, al
jne 0x4024fc
mov ecx, dword [ebp - 0x34]
mov eax, ecx
and eax, 1
cmp dword [ebp - 0x38], 0x300
mov byte [ebp - 0x30], al
je 0x4024fc
test byte [ebp - 0x2c], cl
jne 0x4024fc
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dbg.get_long_key
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4028ce
lea eax, [ebp - 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], ebx
or eax, 0x2001b
mov dword [esp], edx
mov dword [esp + 0xc], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
mov esi, eax
test eax, eax
jne 0x402925
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x20]
test eax, eax
jne 0x402888
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x402888
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40294d
mov dword [section..data], 0
mov dword [esp], 0x200
mov edi, 0x100
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x2c], esi
mov esi, eax
jmp 0x402655
cmp eax, 0xea
jne 0x402989
lea ebx, [edi + edi]
shl edi, 2
mov dword [esp], esi
mov dword [esp + 4], edi
mov edi, ebx
call dword [sym.imp.ucrtbase.dll_realloc]
mov esi, eax
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
jne 0x402630
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x402652
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x44]
push ecx
mov dword [esp + 4], eax
mov dword [esp], 0x12f
call dbg.output_message
cmp ebx, 2
jne 0x402978
cmp dword [section..data], 0
je 0x402a24
mov dword [esp], 0x6e
call dbg.output_message
jmp 0x402524
mov dword [esp + 4], 0x409102
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x402740
mov ebx, dword [ebp - 0x34]
test ebx, ebx
jne 0x4024f9
mov dword [ebp - 0x34], 1
jmp 0x40253f
mov dword [esp + 4], 0x409108
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x402770
mov eax, dword [ebp - 0x38]
test ah, 2
jne 0x4024f9
or ah, 2
mov dword [ebp - 0x38], eax
jmp 0x40253f
mov dword [esp + 4], 0x409116
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x4027a0
mov eax, dword [ebp - 0x38]
test ah, 1
jne 0x4024f9
or ah, 1
mov dword [ebp - 0x38], eax
jmp 0x40253f
movzx eax, word [ebx + 2]
test ax, ax
je 0x4024f9
cmp word [ebx + 4], 0
jne 0x4024f9
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towlower]
cmp ax, 0x66
je 0x402871
cmp ax, 0x76
jne 0x4024f9
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
jne 0x4024f9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x30]
add edi, 1
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x40253f
jmp 0x4024f9
mov eax, dword [ebp - 0x24]
xor edi, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dbg.get_long_key
mov dword [ebp - 0x34], 0
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x44]
mov dword [esp], 0x12e
mov dword [ebp - 0x40], edx
mov dword [esp + 4], eax
call dbg.ask_confirm
mov edx, dword [ebp - 0x40]
mov esi, eax
test esi, esi
jne 0x4025aa
mov dword [esp], 0x6d
call dbg.output_message
jmp 0x402529
mov edx, dword [ebp - 0x40]
test edx, edx
jne 0x4024f9
mov dword [ebp - 0x40], 1
jmp 0x40253f
mov dword [section..data], 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40260d
mov eax, edi
test al, al
jne 0x40299f
cmp byte [ebp - 0x30], 0
jne 0x40299f
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [esp], 0x6c
call dbg.output_message
jmp 0x402529
mov eax, edi
test al, al
jne 0x4028da
cmp byte [ebp - 0x30], 0
je 0x4028fa
mov eax, dword [ebp - 0x3c]
mov dword [esp], 0x12c
mov dword [ebp - 0x40], edx
mov dword [esp + 4], eax
call dbg.ask_confirm
mov edx, dword [ebp - 0x40]
mov esi, eax
jmp 0x402858
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40283d
mov eax, dword [ebp - 0x44]
mov dword [esp], 0x12d
mov dword [ebp - 0x40], edx
mov dword [esp + 4], eax
call dbg.ask_confirm
mov edx, dword [ebp - 0x40]
mov esi, eax
jmp 0x402858
cmp eax, 2
jne 0x402978
cmp dword [section..data], 0
je 0x4029bf
mov dword [esp], 0x6e
mov esi, 1
call dbg.output_message
jmp 0x402529
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov esi, eax
push edx
push edx
test eax, eax
je 0x4029d5
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
cmp esi, 2
je 0x40292a
mov dword [esp], 0x6b
call dbg.output_message
jmp 0x402524
mov edx, esi
mov esi, dword [ebp - 0x2c]
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov ebx, dword [ebp - 0x20]
jmp 0x4028b1
mov eax, dword [ebp - 0x3c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov ebx, eax
push edx
push edx
test eax, eax
jne 0x402a09
mov ebx, dword [ebp - 0x20]
jmp 0x4028b1
mov dword [esp], 0x6f
mov esi, 1
call dbg.output_message
jmp 0x402529
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0x409124
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
push eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
mov dword [esp], 0x6c
call dbg.output_message
jmp 0x402529
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
cmp ebx, 2
je 0x40292a
jmp 0x402978
mov dword [esp], 0x6f
call dbg.output_message
jmp 0x402524