Function at 0x423410
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x854], ecx
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00425230
add esp, 0xc
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.00425230
add esp, 0xc
mov byte [ebp - 0x528], 0
push 0x103
push 0
lea edx, [ebp - 0x527]
push edx
call fcn.00425230
add esp, 0xc
mov byte [ebp - 0x848], 0
push 0x103
push 0
lea eax, [ebp - 0x847]
push eax
call fcn.00425230
add esp, 0xc
mov byte [ebp - 0x740], 0
push 0x103
push 0
lea ecx, [ebp - 0x73f]
push ecx
call fcn.00425230
add esp, 0xc
mov byte [ebp - 0x630], 0
push 0x103
push 0
lea edx, [ebp - 0x62f]
push edx
call fcn.00425230
add esp, 0xc
mov byte [ebp - 0x631], 0
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00425230
add esp, 0xc
push 0x43a914
push str.Software_s
lea edx, [ebp - 0x420]
push edx
call fcn.00426d9c
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x420]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423693
mov dword [ebp - 0x850], 0x104
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x84c]
push ecx
push 0
push str.Game
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x850], 0x104
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x84c]
push edx
push 0
push str.Version
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x850], 0x104
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x528]
push edx
lea eax, [ebp - 0x84c]
push eax
push 0
push str.ParentProcessName
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x850], 0x104
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x84c]
push ecx
push 0
push str.SetupName
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x850], 0x104
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0x740]
push ecx
lea edx, [ebp - 0x84c]
push edx
push 0
push 0x43a98c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x850], 0x104
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x630]
push edx
lea eax, [ebp - 0x84c]
push eax
push 0
push str.InstallTime
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x850], 0x104
lea edx, [ebp - 0x850]
push edx
mov eax, dword [ebp + 0x20]
push eax
lea ecx, [ebp - 0x84c]
push ecx
push 0
push str.RunCount
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423693
mov byte [ebp - 0x631], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x110]
push ecx
call fcn.004275a0
add esp, 4
test eax, eax
jbe 0x4236ee
cmp dword [ebp + 0x24], 0
je 0x4236ee
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push str.Software
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4236e4
push 0x43a9d4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x110]
push edx
mov ecx, dword [ebp + 8]
call fcn.00420180
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00420180
lea ecx, [ebp - 0x528]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00420180
lea edx, [ebp - 0x848]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00420180
lea eax, [ebp - 0x740]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.00420180
lea ecx, [ebp - 0x630]
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.00420180
mov al, byte [ebp - 0x631]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret 0x20