Function at 0x402cb8
Capabilities:
Delete registry key
Read file on windows

Disassembly:
cwde
add edi, 2
mov dword [0x42c61b], 0
mov esi, dword [0x42c61b]
push esi
xor edi, edi
push edi
mov dword [0x42ca25], 0
mov eax, dword [0x42ca25]
push eax
mov edi, 0x3479e3
mov edx, edi
mov eax, 0xd2625
add edx, eax
push dword [edx]
pop dword [0x42b1e4]
mov edx, dword [0x42b1e4]
call edx
or eax, eax
jne 0x40145b
ret
lea edi, [edi + 0x64]
add ebx, esi
xor esi, dword [0x42deda]
mov eax, esi
mov edx, 0x3252dc2
mov eax, edx
push eax
mov dword [0x42c99e], 0
mov edx, dword [0x42c99e]
push edx
push 0x2daee3
pop edx
mov ecx, 0x13f295
add edx, ecx
push dword [edx]
pop dword [0x42b7f5]
mov edx, dword [0x42b7f5]
call edx
inc eax
jne 0x4014e6
mov eax, 0x22
push eax
xor eax, eax
push eax
push 0xa7
pop edi
push edi
mov esi, 0xcf
mov ebx, esi
push ebx
mov dword [0x42bb32], 0
mov esi, dword [0x42bb32]
push esi
mov ebx, 1
mov esi, ebx
push esi
mov ebx, 0x9db52
mov ecx, ebx
add ecx, 0x37c60a
mov ecx, dword [ecx]
call ecx
or eax, eax
jne 0x401546
jmp 0x401538
dec ebx
lea ebx, [7]
add esi, ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
lea ecx, [eax + 0x42b966]
add ecx, 0x5d6
js 0x40193f
add dword [0x42c722], ecx
sub dword [0x42b4b5], ecx
rol ecx, 5
add ecx, eax
dec ecx
sub ecx, dword [0x42b37b]
add ecx, edi
shr ecx, 1
add dword [0x42bba0], ecx
xor esi, esi
push esi
mov ecx, 0
mov edx, ecx
push edx
mov dword [0x42b87e], 0
mov ecx, dword [0x42b87e]
push ecx
mov dword [0x42b460], 0
mov ebx, dword [0x42b460]
push ebx
mov edi, 4
push edi
mov eax, 0x22
mov edi, eax
push edi
push 0x19
pop eax
push eax
push 5
pop esi
push esi
mov edx, dword [sym.imp.GDI32.DLL_ExtTextOutW]
call edx
or eax, eax
jne 0x4016d7
ret
inc esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov esi, 0x30dbca
add esi, 0x10c472
push dword [esi]
mov ebx, 0x42b9a3
mov edi, ebx
pop dword [edi]
mov esi, dword [0x42b9a3]
call esi
or eax, eax
je 0x40182c
push 0x22ef0d
pop eax
mov ecx, 0x1fd69b
add eax, ecx
push eax
mov dword [0x42c2e1], 0
mov eax, dword [0x42c2e1]
push eax
mov edx, dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
call edx
or eax, eax
je 0x401546
leave
ret
push ebp
pop eax
mov edx, eax
push edx
mov dword [0x42b033], esp
mov ebp, dword [0x42b033]
sub esp, 0x3c
push edi
push esi
push 0x2fa32
lea eax, [0x42bbca]
push eax
push esi
lea eax, [0x42be13]
push eax
lea eax, [0x42bf8d]
push eax
call fcn.00401248
mov dword [ebp - 4], eax
or eax, eax
je 0x402cf8
mov ecx, ebx
inc edi
push 0xe42b1
push esi
lea eax, [0x42bdee]
push eax
lea eax, [0x42bb5a]
push eax
add edi, ebx
mov dword [ebp - 0x3c], edi
add eax, esi
add eax, edi
push 0
call fcn.004012dc
mov dword [ebp - 8], eax
or eax, eax
jne 0x402d25
add esi, eax
push 0
push 0xf003f
push 0
push 0
push 0x42c0d6
push 0x80000002
mov ecx, 0x1a0083
mov eax, 0x27a119
add ecx, eax
push dword [ecx]
pop ecx
call ecx
push 0
call fcn.00401288
mov dword [0x42c119], eax
or eax, eax
je 0x402d5e
and esi, esi
dec edi
push 0xbe8
pop edi
inc edi
add edi, 0x2fe
je 0x402d6f
rol edi, 1
mov dword [ebp - 0x2c], edi
sub edi, ebx
dec edi
sub edi, 0xf71
add edi, dword [0x42bcdd]
sub edi, dword [0x42b529]
add dword [0x42c7e7], edi
inc edi
add dword [0x42c37a], edi
push 0x9f2c3
add eax, edi
add ebx, eax
push 0xdac3e
inc esi
lea eax, [0x42c764]
push eax
call fcn.004013d8
mov dword [0x42b52d], eax
push 0
push 0
push 0
push 0
mov edi, 0x20d0b8
shl edi, 1
call dword [edi]
push ebx
push 0xaa814
call fcn.00401320
mov dword [0x42b929], eax
lea eax, [0x42c4cd]
push eax
or si, di
inc eax
push eax
lea eax, [0x42ba5d]
push eax
call fcn.004010a8
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, 0x4a
push ebx
mov dword [ebp - 0x34], 0xe6
mov eax, dword [ebp - 0x34]
push eax
xor eax, eax
push eax
mov dword [ebp - 0x28], 0x20d00c
mov edx, dword [ebp - 0x28]
shl edx, 1
call dword [edx]
inc eax
jne 0x401826
inc esi
push 0
push 0
push ebx
sub ebx, eax
add ebx, eax
dec ebx
inc edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], esi
lea eax, [0x42c412]
push eax
push 0
call fcn.004011b4
mov dword [ebp - 0x34], eax
or eax, eax
jne 0x402e4c
dec esi
mov edx, 0xc8be2
mov dword [0x42b998], 0x3624b6
add edx, dword [0x42b998]
push edx
mov eax, 0
mov ebx, eax
push ebx
mov ecx, 0x194c00
mov dword [0x42bbd1], 0x2855a0
add ecx, dword [0x42bbd1]
push dword [ecx]
pop dword [0x42b5d9]
mov ecx, dword [0x42b5d9]
call ecx
or eax, eax
je 0x40191c
mov edx, 0
add edx, dword [0x42b4d0]
add edx, eax
mov dword [ebp - 0x34], edx
add edx, esi
inc edx
shl edx, 1
mov dword [ebp - 0x24], edx
add edx, 0xb0c
inc edx
shl edx, 2
sub dword [0x42ba18], edx
mov dword [ebp - 0x1c], 0x190b09
mov ecx, dword [ebp - 0x1c]
mov dword [0x42b092], 0x29a948
add ecx, dword [0x42b092]
push ecx
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
push eax
push 0x106346c
pop esi
mov dword [ebp - 0x24], 0xc492bc
sub esi, dword [ebp - 0x24]
call dword [esi]
or eax, eax
je 0x401699
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push 0
mov esi, 0x5637
mov edx, esi
mov eax, 0x414a19
add edx, eax
mov edx, dword [edx]
call edx
mov ecx, esi
mov ebx, ecx
ror ebx, 1
mov dword [ebp - 0x24], ebx
inc ebx
rol ebx, 1
add ebx, 0x508
dec ebx
sub ebx, 0x469
jns 0x402f3f
sub ebx, esi
add ebx, ecx
dec ebx
mov dword [ebp - 0x14], ebx
mov esi, 0x716
sub esi, 0xe6
rol esi, 1
inc esi
add esi, dword [0x42b6b5]
shl esi, 1
add esi, dword [0x42b9fe]
sub esi, 0xbbe
jb 0x402f6c
ror esi, 5
ror esi, 1
shr esi, 4
sub esi, ecx
sub dword [0x42b8a7], esi
sub eax, 0xffffffff
push eax
push eax
push 0x65
push eax
push eax
mov edx, 0x20d012
mov ebx, edx
shl ebx, 1
call dword [ebx]
mov edi, eax
ror edi, 2
sub edi, dword [0x42c958]
rol edi, 4
sub edi, esi
add edi, dword [0x42bcde]
shl edi, 1
sub edi, 0xa9d
js 0x402fb1
mov esi, edi
shr esi, 1
mov ebx, esi
add dword [0x42b2ef], ebx
sub eax, 0x10dd5c
lea edi, [edi + 0x42ca81]
cmp edi, 0x52a
jae 0x402fd1
mov dword [ebp - 0x30], edi
mov ecx, edi
inc ecx
add ecx, 0x806
sub ecx, esi
rol ecx, 1
sub ecx, 0x4ae
ja 0x402fec
sub ecx, 0x57c
dec ecx
sub ecx, eax
rol ecx, 1
add dword [0x42b403], ecx
sub eax, 0xffaef1df
mov dword [0x42bed3], eax
mov ecx, 7
push ecx
mov dword [ebp - 0x3c], 0x1c72dc
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x264ada
add edi, dword [ebp - 0x3c]
push edi
mov edx, 1
push edx
mov eax, dword [sym.imp.user32.dll_FrameRect]
call eax
or eax, eax
jne 0x401b16
push dword [0x42bed3]
mov dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, 0
push ecx
mov ebx, 0
push ebx
mov ecx, dword [sym.imp.GDI32.DLL_CreateDCA]
call ecx
or eax, eax
jne 0x40181a
ret