Function at 0x401c10
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x2ae4
call fcn.00410aa0
push ebx
push ebp
mov eax, 0x80ff80
push esi
push edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
mov ecx, 0x88
xor eax, eax
mov edi, 0x436880
rep stosd dword es:[edi], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x20], 0xff
push eax
push 0x3c
push 0xd
mov dword [esp + 0x30], 0xff0080
mov dword [esp + 0x34], 0x4080ff
mov dword [esp + 0x38], 0x808040
mov dword [esp + 0x3c], 0xff8000
mov dword [esp + 0x40], 0xff8080
mov dword [esp + 0x48], 0xffff80
mov dword [esp + 0x50], 0x80ffff
mov dword [esp + 0x54], 0xc00000
mov dword [esp + 0x58], 0xc0c000
mov dword [esp + 0x5c], 0xc0c0c0
mov dword [esp + 0x60], 0xc04000
mov dword [esp + 0x64], 0xc08000
mov dword [esp + 0x68], 0xc0c040
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [str.Courier]
mov edx, dword [0x41d804]
mov ebp, 0x190
xor ebx, ebx
mov dword [esp + 0x7c], ecx
mov ecx, 0xf
lea esi, [esp + 0x60]
mov edi, 0x4368ac
mov dword [esp + 0x70], ebp
mov dword [esp + 0x60], 0xfffffff3
mov dword [esp + 0x64], ebx
mov dword [esp + 0x80], edx
mov al, 1
mov edx, 0x64
rep movsd dword es:[edi], dword [esi]
mov byte [0x4368a4], al
mov byte [0x43691d], al
mov byte [0x4368a6], al
mov byte [0x4368a9], al
mov byte [0x436914], al
mov byte [0x4368ea], al
mov byte [0x4368eb], al
mov byte [0x436a4c], al
mov byte [0x4368e9], al
mov al, byte [0x425850]
mov esi, 0x12c
mov byte [0x43691e], al
mov dword [0x436888], edx
mov dword [0x436884], edx
mov dword [0x43688c], 0x1f4
mov dword [0x436890], esi
mov byte [0x4368a5], bl
mov byte [0x4368e8], bl
mov dword [0x436918], ebx
mov byte [0x43691c], bl
mov byte [0x436a22], bl
xor eax, eax
mov ecx, 0xffffff
mov edi, dword [esp + eax + 0x20]
mov dword [eax + 0x4368ec], ecx
mov dword [eax + 0x436900], edi
add eax, 4
cmp eax, 0x14
jl 0x401d81
xor eax, eax
mov edi, dword [esp + eax + 0x34]
mov dword [eax + 0x436a24], ecx
mov dword [eax + 0x436a38], edi
add eax, 4
cmp eax, 0x14
jl 0x401d9b
xor eax, eax
mov edi, dword [esp + eax + 0x20]
mov dword [eax + 0x436a50], ecx
mov dword [eax + 0x436a78], edi
add eax, 4
cmp eax, 0x28
jl 0x401db5
mov ecx, 0x141
xor eax, eax
mov edi, 0x433280
push str.SoftwareSystems_InternalsDbgView
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x505
xor eax, eax
lea edi, [esp + 0x16e0]
push reloc.WS2_32.dll_accept
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x140
xor eax, eax
mov edi, 0x430da0
mov dword [0x436894], 0x23
rep stosd dword es:[edi], eax
mov ecx, 0x140
mov edi, 0x432680
rep stosd dword es:[edi], eax
mov ecx, 0x140
mov edi, 0x432ca0
rep stosd dword es:[edi], eax
mov ecx, 0x500
mov edi, 0x42e920
rep stosd dword es:[edi], eax
mov dword [0x436898], edx
mov dword [0x43689c], esi
mov dword [0x4368a0], ebx
mov byte [esp + 0x2c4], 0x2a
mov byte [esp + 0x2c5], bl
mov byte [esp + 0x2c6], bl
mov byte [esp + 0x11dc], bl
mov byte [esp + 0xcd4], bl
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x14]
push ecx
push str.SoftwareSysinternalsDbgView
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov byte [esp + 0x7c4], bl
mov eax, 0x433280
mov byte [eax], bl
add eax, 0x101
cmp eax, 0x433785
jl 0x401e90
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x9c]
push edx
push eax
push ebx
push ebx
push str.Settings
push ecx
mov dword [esp + 0x34], 0x220
mov dword [esp + 0xb4], ebx
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x7c4]
push edx
push eax
push ebx
push ebx
mov edi, 0x506
push str.Recent
push ecx
mov dword [esp + 0x28], edi
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x2bc]
push edx
push eax
push ebx
push ebx
push str.InFilters
push ecx
mov dword [esp + 0x28], edi
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x11d4]
push edx
push eax
push ebx
push ebx
push str.ExFilters
push ecx
mov dword [esp + 0x28], edi
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0xccc]
push edx
push eax
push ebx
push ebx
push str.HiFilters
push ecx
mov dword [esp + 0x28], edi
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x16dc]
push edx
push eax
push ebx
push ebx
push str.HiCurFilters
push ecx
mov dword [esp + 0x28], 0x1415
call esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x9c], ebp
jne 0x401f99
mov ecx, 0x88
lea esi, [esp + 0x9c]
mov edi, 0x436880
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4368a0]
mov cl, byte [0x4368a4]
mov dword [0x4247ec], eax
mov al, byte [0x4368a6]
mov byte [0x41d55e], cl
mov cl, byte [0x4368a7]
mov byte [0x41d55f], al
mov al, byte [0x4368a9]
mov byte [0x41d563], cl
mov cl, byte [0x436a4c]
mov byte [0x41d561], al
mov al, byte [0x4368e9]
mov byte [0x41d55d], cl
mov cl, byte [0x436914]
mov byte [0x41d564], al
mov al, byte [0x436a4d]
mov byte [0x41d562], cl
mov ecx, dword [0x436918]
mov byte [0x4247d2], al
mov dword [0x4247d4], ecx
mov edi, 0x43691e
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [0x43691d]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [0x41d560], dl
mov eax, ecx
mov esi, edi
mov edi, 0x432b80
mov dl, byte [0x4368a8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov byte [0x4247cf], dl
mov dl, byte [0x4368e8]
mov ecx, eax
mov byte [0x4247d0], dl
mov dl, byte [0x43691c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [0x4247d1], dl
mov dl, byte [0x436a22]
mov ecx, 0xf
mov esi, 0x4368ac
mov edi, 0x436820
push 0x436820
rep movsd dword es:[edi], dword [esi]
mov byte [0x4247ce], dl
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov cl, byte [0x4368ea]
mov dl, byte [0x4368eb]
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x43265c], eax
mov byte [0x430d48], cl
mov byte [0x42fd30], dl
xor esi, esi
mov eax, dword [esi + 0x4368ec]
mov dword [esi + 0x4331c0], eax
mov eax, dword [esi + 0x436900]
push eax
mov dword [esi + 0x433220], eax
call edi
mov dword [esi + 0x4357a0], eax
add esi, 4
cmp esi, 0x14
jl 0x4020a9
xor esi, esi
mov eax, dword [esi + 0x436a38]
mov ecx, dword [esi + 0x436a24]
push eax
mov dword [esi + 0x4331d4], ecx
mov dword [esi + 0x433234], eax
call edi
mov dword [esi + 0x4357b4], eax
add esi, 4
cmp esi, 0x14
jl 0x4020d4
xor esi, esi
mov eax, dword [esi + 0x436a78]
mov edx, dword [esi + 0x436a50]
push eax
mov dword [esi + 0x4331e8], edx
mov dword [esi + 0x433248], eax
call edi
mov dword [esi + 0x4357c8], eax
add esi, 4
cmp esi, 0x28
jl 0x4020ff
mov al, byte [esp + 0x7c4]
lea edx, [esp + 0x7c4]
cmp al, bl
je 0x402182
mov ebp, 0x433280
mov dword [esp + 0x18], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x101
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x40213f
mov al, byte [esp + 0x2bc]
lea edx, [esp + 0x2bc]
cmp al, bl
je 0x4021dc
mov ebp, 0x432680
mov dword [esp + 0x18], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x402199
mov al, byte [esp + 0x11d4]
lea edx, [esp + 0x11d4]
cmp al, bl
je 0x402236
mov ebp, 0x430da0
mov dword [esp + 0x18], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x4021f3
mov al, byte [esp + 0xccc]
lea edx, [esp + 0xccc]
cmp al, bl
je 0x402290
mov ebp, 0x432ca0
mov dword [esp + 0x18], ebp
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
cmp al, bl
jne 0x40224d
mov edi, 0x432680
or ecx, 0xffffffff
xor eax, eax
push 0x432400
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x432400
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00419916
mov edi, 0x430da0
or ecx, 0xffffffff
xor eax, eax
push 0x4312a0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4312a0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00419916
add esp, 8
lea ebp, [esp + 0x16dc]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x42e920]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebx + 0x42c4e0]
mov edx, ecx
mov esi, edi
mov edi, eax
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00419916
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebx, 0x100
cmp ebx, 0x1400
lea ebp, [ecx + ebp + 1]
jl 0x4022f8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ae4
ret