Function at 0x401890
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov dword [ebp - 0x224], 0x412abc
mov dword [ebp - 0x220], str..Default
mov word [ebp - 8], 2
mov word [ebp - 6], 1
mov dword [ebp - 0x114], 0
jmp 0x4018d4
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x20
jge 0x401a62
push 1
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411258
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
sub ecx, edx
sar ecx, 4
push ecx
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
push eax
call fcn.004011d0
add esp, 0xc
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x401a5d
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
mov edx, dword [ecx + 0x411264]
cmp dword [edx], 0
je 0x401a5d
push 2
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411248
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
sub eax, ecx
sar eax, 4
push eax
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
push edx
call fcn.004011d0
add esp, 0xc
test eax, eax
je 0x401a5d
push 1
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411248
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
sub eax, ecx
sar eax, 4
push eax
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
push edx
call fcn.004011d0
add esp, 0xc
test eax, eax
jne 0x401a0e
push 2
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411248
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
sub eax, ecx
sar eax, 4
push eax
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411208
push edx
call fcn.004010f0
add esp, 0xc
jmp 0x401a5d
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
mov ecx, dword [eax + 0x411254]
mov byte [ecx], 0
push 2
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411248
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
sub edx, eax
sar edx, 4
push edx
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
push ecx
call fcn.004010f0
add esp, 0xc
jmp 0x4018c5
mov dword [ebp - 0x114], 0
jmp 0x401a7d
mov edx, dword [ebp - 0x114]
add edx, 1
mov dword [ebp - 0x114], edx
cmp dword [ebp - 0x114], 0x20
jge 0x401da1
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
mov ecx, dword [eax + 0x411264]
cmp dword [ecx], 0
je 0x401ca0
push 0
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411238
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
sub edx, eax
sar edx, 4
push edx
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
push ecx
call fcn.004011d0
add esp, 0xc
test eax, eax
jne 0x401b04
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
mov eax, dword [edx + 0x411244]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00408e50
add esp, 8
jmp 0x401b49
mov dword [ebp - 4], 0x104
lea edx, [ebp - 0x228]
push edx
push str.AppEventsEventLabelsOpen
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x114]
xor edx, edx
mov dx, word [ecx*2 + 0x4111c8]
push edx
push 0x412afc
lea eax, [ebp - 0x10c]
push eax
call fcn.00408df6
add esp, 0xc
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x114]
xor ecx, ecx
mov cx, word [eax*2 + 0x4111c8]
push ecx
push 0x412b20
lea edx, [ebp - 0x10c]
push edx
call fcn.00408df6
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x118], 0
jmp 0x401c0a
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 2
jge 0x401c8e
mov eax, dword [ebp - 0x118]
mov cx, word [ebp + eax*2 - 8]
push ecx
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
add edx, 0x411248
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x70
add eax, 0x411208
sub edx, eax
sar edx, 4
push edx
mov ecx, dword [ebp - 0x114]
imul ecx, ecx, 0x70
add ecx, 0x411208
push ecx
call fcn.004011d0
add esp, 0xc
push 4
mov edx, dword [ebp - 0x114]
imul edx, edx, 0x70
mov eax, dword [edx + 0x411254]
push eax
push 1
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp + ecx*4 - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
jmp 0x401bfb
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401d9c
mov edx, dword [ebp - 0x114]
xor eax, eax
mov ax, word [edx*2 + 0x4111c8]
push eax
push str.AppEventsEventLabelsTPHOTKEY__04X
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00408df6
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x114]
xor ecx, ecx
mov cx, word [eax*2 + 0x4111c8]
push ecx
push 0x412b74
lea edx, [ebp - 0x10c]
push edx
call fcn.00408df6
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d8f
mov dword [ebp - 0x118], 0
jmp 0x401d3b
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov dword [ebp - 4], 0x104
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401d7b
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x401d2c
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401a6e
mov esp, ebp
pop ebp
ret