Function at 0x402376
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10e4
call fcn.00437190
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
mov dword [ebp - 0x1c], ecx
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402595
push edi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0xc], esi
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40258b
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x40258b
add eax, 2
push eax
push 0x40
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x18], edi
je 0x40258b
push ebx
push dword [ebp - 0x10]
push esi
push edi
call fcn.004369c0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push esi
push str.PendingFileRenameOperations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402581
cmp dword [ebp - 0xc], 7
jne 0x402581
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
test eax, eax
jle 0x402581
mov ebx, str.autoup.ini
push ebx
push edi
call fcn.00437119
pop ecx
test eax, eax
pop ecx
jne 0x40247d
push edi
call esi
lea edi, [edi + eax + 1]
push ebx
push edi
call fcn.00437119
pop ecx
test eax, eax
pop ecx
jne 0x40247d
push edi
call esi
lea edi, [edi + eax + 1]
push edi
call esi
test eax, eax
jg 0x402449
jmp 0x402581
and byte [ebp - 0x80], 0
push 0x18
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
push 0x44d48c
push str.PendingState
push str.AhnLab
call esi
lea eax, [ebp - 0x80]
push eax
push str._Autoup__Update__Exist_PendingFileRenameOperations_autoup.ini___PendingState_s
push 1
call fcn.00408bf4
mov ebx, 0x44d420
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0043706a
add esp, 0x14
test eax, eax
jne 0x402581
and byte [ebp - 0xe4], al
push 0x18
pop ecx
lea edi, [ebp - 0xe3]
rep stosd dword es:[edi], eax
and byte [ebp - 0x10e4], 0
mov ecx, 0x3ff
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x10e3]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10e4]
push 0x1000
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
cmp eax, 7
jbe 0x40257a
mov eax, dword [ebp - 0x1c]
push dword [ebp + 8]
lea edi, [eax + 0xfd8]
lea eax, [ebp - 0xe4]
push 0x64
push eax
push 0x44d48c
push str.PendingState
mov ecx, edi
call fcn.00406a8a
push eax
call esi
lea eax, [ebp - 0xe4]
push eax
push dword [edi]
push str._Autoup__Update__Exist_PendingAppName__s___PendingState_s
push 1
call fcn.00408bf4
lea eax, [ebp - 0xe4]
push ebx
push eax
call fcn.0043706a
add esp, 0x18
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [ebp - 8], ecx
jmp 0x402581
mov dword [ebp - 8], 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 8]
pop esi
leave
ret 4