Function at 0x401d40
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x2aa8
call fcn.00412900
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x2aa4], eax
push ebx
push ebp
push esi
push edi
push 0x224
xor ebx, ebx
push ebx
push 0x453500
call fcn.00412880
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x3c
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [str.Courier_New]
mov edx, dword [0x4348b8]
mov eax, dword [0x4348bc]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov eax, 0xffffff
mov ecx, 0xf
lea esi, [esp + 0x1c]
mov edi, 0x45352c
mov dword [esp + 0x2c], 0x190
mov dword [esp + 0x1c], 0xfffffff3
mov dword [esp + 0x20], ebx
rep movsd dword es:[edi], dword [esi]
mov edx, 0x64
mov ecx, 0x80ff80
mov ebp, 0xff8080
mov edi, 0xffff80
mov esi, 0x80ffff
mov dword [0x453508], edx
mov dword [0x453504], edx
mov dword [0x45350c], 0x1f4
mov dword [0x453510], 0x12c
mov byte [0x453525], bl
mov byte [0x453524], 1
mov byte [0x45359d], 1
mov byte [0x453526], 1
mov byte [0x453529], bl
mov byte [0x453594], 1
mov byte [0x45356a], 1
mov byte [0x45356b], 1
mov byte [0x4536cc], 1
mov byte [0x453568], bl
mov byte [0x453569], 1
mov dword [0x453598], ebx
mov byte [0x45359c], bl
mov byte [0x4536a2], bl
mov byte [0x45359e], bl
mov dword [0x45356c], eax
mov dword [0x453580], 0xff
mov dword [0x453570], eax
mov dword [0x453584], 0xff0080
mov dword [0x453574], eax
mov dword [0x453588], 0x4080ff
mov dword [0x453578], eax
mov dword [0x45358c], 0x808040
mov dword [0x45357c], eax
mov dword [0x453590], 0xff8000
mov dword [0x4536a4], ebx
mov dword [0x4536b8], ebp
mov dword [0x4536a8], ebx
mov dword [0x4536bc], ecx
mov dword [0x4536ac], ebx
mov dword [0x4536c0], edi
mov dword [0x4536b0], ebx
mov dword [0x4536c4], ecx
mov dword [0x4536b4], ebx
mov dword [0x4536c8], esi
mov dword [0x4536d0], eax
mov dword [0x4536f8], 0xff
mov dword [0x4536d4], eax
mov dword [0x4536fc], 0xff0080
mov dword [0x4536d8], eax
mov dword [0x453700], 0x4080ff
push 0x505
push ebx
push 0x449220
mov dword [0x4536dc], eax
mov dword [0x453704], 0x808040
mov dword [0x4536e0], eax
mov dword [0x453708], 0xff8000
mov dword [0x4536e4], ebx
mov dword [0x45370c], ebp
mov dword [0x4536e8], ebx
mov dword [0x453710], ecx
mov dword [0x4536ec], ebx
mov dword [0x453714], edi
mov dword [0x4536f0], ebx
mov dword [0x453718], ecx
mov dword [0x4536f4], ebx
mov dword [0x45371c], esi
mov dword [0x453514], 0x23
mov dword [0x453518], edx
mov dword [0x45351c], 0x12c
mov dword [0x453520], ebx
call fcn.00412880
push 0x1415
lea ecx, [esp + 0x16ac]
push ebx
push ecx
mov byte [esp + 0x294], 0x2a
mov byte [esp + 0x295], bl
mov byte [esp + 0x296], bl
mov byte [esp + 0x79c], bl
mov byte [esp + 0xca4], bl
call fcn.00412880
push 0x500
push ebx
push 0x44f480
call fcn.00412880
push 0x500
push ebx
push 0x44ba20
call fcn.00412880
push 0x500
push ebx
push 0x44fb00
call fcn.00412880
push 0x1400
push ebx
push 0x450f20
call fcn.00412880
add esp, 0x48
push str.SoftwareSystems_InternalsDbgView
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea edx, [esp + 0x14]
push edx
push str.SoftwareSysinternalsDbgView
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov byte [esp + 0x1194], bl
mov eax, 0x449220
mov byte [eax], bl
add eax, 0x101
cmp eax, 0x449725
jl 0x402051
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x5c]
push ecx
push ebx
push ebx
push str.Settings
push edx
mov dword [esp + 0x30], 0x224
mov dword [esp + 0x70], ebx
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1198]
push ecx
push ebx
push ebx
push str.Recent
mov edi, 0x506
push edx
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x280]
push ecx
push ebx
push ebx
push str.InFilters
push edx
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x788]
push ecx
push ebx
push ebx
push str.ExFilters
push edx
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc90]
push ecx
push ebx
push ebx
push str.HiFilters
push edx
mov dword [esp + 0x28], edi
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x16a0]
push ecx
push ebx
push ebx
push str.HiCurFilters
push edx
mov dword [esp + 0x28], 0x1415
call esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x58], 0x190
jne 0x402152
mov ecx, 0x89
lea esi, [esp + 0x58]
mov edi, 0x453500
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x453520]
movzx eax, byte [0x45359d]
movzx edx, byte [0x453524]
mov dword [0x440c20], ecx
movzx ecx, byte [0x453526]
mov byte [0x43d375], al
movzx eax, byte [0x453528]
mov byte [0x43d374], cl
movzx ecx, byte [0x453529]
mov byte [0x43d367], dl
movzx edx, byte [0x453527]
mov byte [0x440c06], al
movzx eax, byte [0x453568]
mov byte [0x43d376], cl
movzx ecx, byte [0x453569]
mov byte [0x43d378], dl
movzx edx, byte [0x4536cc]
mov byte [0x440c07], al
movzx eax, byte [0x45359c]
mov byte [0x43d379], cl
movzx ecx, byte [0x4536cd]
mov byte [0x43d366], dl
movzx edx, byte [0x453594]
mov byte [0x440c08], al
movzx eax, byte [0x4536a2]
mov byte [0x440c09], cl
movzx ecx, byte [0x453720]
mov byte [0x43d377], dl
mov edx, dword [0x453598]
mov byte [0x440c04], al
mov dword [0x440c0c], edx
mov byte [0x440c05], cl
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x45359e]
mov byte [eax + 0x4523a0], cl
inc eax
cmp cl, bl
jne 0x402220
mov ecx, 0xf
mov esi, 0x45352c
mov edi, 0x452340
push 0x452340
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dl, byte [0x45356a]
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x449728], eax
mov al, byte [0x45356b]
mov byte [0x4490f0], dl
mov byte [0x44972c], al
xor esi, esi
mov eax, dword [esi + 0x453580]
mov ecx, dword [esi + 0x45356c]
push eax
mov dword [esi + 0x4490a0], ecx
mov dword [esi + 0x44f420], eax
call edi
mov dword [esi + 0x44e3c0], eax
add esi, 4
cmp esi, 0x14
jl 0x402270
xor esi, esi
jmp 0x4022a0
mov eax, dword [esi + 0x4536b8]
mov edx, dword [esi + 0x4536a4]
push eax
mov dword [esi + 0x4490b4], edx
mov dword [esi + 0x44f434], eax
call edi
mov dword [esi + 0x44e3d4], eax
add esi, 4
cmp esi, 0x14
jl 0x4022a0
xor esi, esi
jmp 0x4022d0
mov eax, dword [esi + 0x4536d0]
mov dword [esi + 0x4490c8], eax
mov eax, dword [esi + 0x4536f8]
push eax
mov dword [esi + 0x44f448], eax
call edi
mov dword [esi + 0x44e3e8], eax
add esi, 4
cmp esi, 0x28
jl 0x4022d0
lea esi, [esp + 0x1194]
cmp byte [esp + 0x1194], bl
je 0x402343
mov edi, 0x449220
mov edi, edi
mov edx, edi
mov ecx, esi
add edi, 0x101
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x402320
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402330
sub eax, edx
cmp byte [esi + eax + 1], bl
lea esi, [esi + eax + 1]
jne 0x402310
lea esi, [esp + 0x27c]
cmp byte [esp + 0x27c], bl
je 0x402393
mov edi, 0x44ba20
jmp 0x402360
mov edx, edi
mov ecx, esi
add edi, 0x100
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x402370
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402380
sub eax, edx
cmp byte [esi + eax + 1], bl
lea esi, [esi + eax + 1]
jne 0x402360
lea esi, [esp + 0x784]
cmp byte [esp + 0x784], bl
je 0x4023e3
mov edi, 0x44f480
jmp 0x4023b0
mov edx, edi
mov ecx, esi
add edi, 0x100
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4023c0
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4023d0
sub eax, edx
cmp byte [esi + eax + 1], bl
lea esi, [esi + eax + 1]
jne 0x4023b0
lea esi, [esp + 0xc8c]
cmp byte [esp + 0xc8c], bl
je 0x402433
mov edi, 0x44fb00
jmp 0x402400
mov edx, edi
mov ecx, esi
add edi, 0x100
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x402410
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402420
sub eax, edx
cmp byte [esi + eax + 1], bl
lea esi, [esi + eax + 1]
jne 0x402400
xor eax, eax
jmp 0x402440
mov cl, byte [eax + 0x44ba20]
mov byte [eax + 0x44fa00], cl
inc eax
cmp cl, bl
jne 0x402440
push 0x44fa00
call fcn.00412bdd
add esp, 4
xor eax, eax
mov cl, byte [eax + 0x44f480]
mov byte [eax + 0x44b900], cl
inc eax
cmp cl, bl
jne 0x402460
push 0x44b900
call fcn.00412bdd
add esp, 4
lea edi, [esp + 0x169c]
xor ebp, ebp
jmp 0x402490
lea eax, [ebp + 0x450f20]
mov esi, eax
mov ecx, edi
sub esi, edi
lea esp, [esp]
mov dl, byte [ecx]
mov byte [ecx + esi], dl
inc ecx
cmp dl, bl
jne 0x4024a0
lea esi, [ebp + 0x44cf80]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x4024b4
push esi
call fcn.00412bdd
mov eax, edi
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4024d0
sub eax, edx
add ebp, 0x100
cmp ebp, 0x1400
lea edi, [edi + eax + 1]
jl 0x402490
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4e
call esi
cmp dword [0x453504], eax
jle 0x40250b
push 0x4e
call esi
sub eax, 0xc8
mov dword [0x453504], eax
push 0x4f
call esi
cmp dword [0x453508], eax
jle 0x402525
push 0x4f
call esi
sub eax, 0xc8
mov dword [0x453508], eax
mov ecx, dword [esp + 0x2ab4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004126a4
add esp, 0x2aa8
ret