Function at 0x404270
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x30c]
push eax
push str.SYSTEMCurrentControlSetControlClass
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40455f
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x314], 0
jmp 0x4042ee
mov ecx, dword [ebp - 0x314]
add ecx, 1
mov dword [ebp - 0x314], ecx
mov edx, dword [ebp - 0x314]
cmp edx, dword [ebp - 4]
jae 0x40455f
push 0xff
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x314]
push ecx
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40455a
push str.SYSTEMCurrentControlSetControlClass_
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x304]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40454d
lea edx, [ebp - 0x420]
push edx
push 0
lea eax, [ebp - 0x424]
push eax
push 0
push str.Class
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40454d
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push str.Class
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x428], str.DiskDrive
lea edx, [ebp - 0x104]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
mov cl, byte [eax]
mov byte [ebp - 0x42d], cl
mov edx, dword [ebp - 0x428]
cmp cl, byte [edx]
jne 0x404451
cmp byte [ebp - 0x42d], 0
je 0x404445
mov eax, dword [ebp - 0x42c]
mov cl, byte [eax + 1]
mov byte [ebp - 0x42e], cl
mov edx, dword [ebp - 0x428]
cmp cl, byte [edx + 1]
jne 0x404451
add dword [ebp - 0x42c], 2
add dword [ebp - 0x428], 2
cmp byte [ebp - 0x42e], 0
jne 0x4043f3
mov dword [ebp - 0x434], 0
jmp 0x40445c
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
mov dword [ebp - 0x438], ecx
cmp dword [ebp - 0x438], 0
jne 0x40454d
lea edx, [ebp - 0x420]
push edx
push 0
lea eax, [ebp - 0x424]
push eax
push 0
push str.Filtersdata
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40454d
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x418]
push eax
push 0
push 0
push str.Filtersdata
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x304]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [ebp - 0x420]
push ecx
lea edx, [ebp - 0x418]
push edx
push 7
push 0
push str.UpperFilters
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.Filtersdata
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x310]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x30c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x40456e
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4042df
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret