Function at 0x41e5b0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cf87
mov eax, dword fs:[0]
push eax
sub esp, 0xf98
mov eax, dword [0x43b050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x43d680], 1
je 0x41e5eb
xor eax, eax
jmp 0x41f1b8
xor eax, eax
jne 0x41e5db
cmp dword [ebp + 0xc], 0
jne 0x41e603
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
jmp 0x41f1b8
xor ecx, ecx
jne 0x41e5ef
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x41e622
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx]
neg eax
sbb eax, eax
neg eax
jmp 0x41f1b8
xor edx, edx
jne 0x41e607
xor eax, eax
jne 0x41e5ef
cmp dword [ebp + 0x10], 0
jne 0x41e63e
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
jmp 0x41f1b8
xor ecx, ecx
jne 0x41e62a
mov edx, dword [ebp + 0x10]
movzx eax, word [edx]
test eax, eax
jne 0x41e65d
mov ecx, dword [ebp + 0x10]
movzx eax, word [ecx]
neg eax
sbb eax, eax
neg eax
jmp 0x41f1b8
xor edx, edx
jne 0x41e642
xor eax, eax
jne 0x41e62a
cmp dword [ebp + 0x14], 0
jne 0x41e679
xor eax, eax
cmp dword [ebp + 0x14], 0
setne al
jmp 0x41f1b8
xor ecx, ecx
jne 0x41e665
mov edx, dword [ebp + 0x14]
movzx eax, word [edx]
test eax, eax
jne 0x41e698
mov ecx, dword [ebp + 0x14]
movzx eax, word [ecx]
neg eax
sbb eax, eax
neg eax
jmp 0x41f1b8
xor edx, edx
jne 0x41e67d
xor eax, eax
jne 0x41e665
cmp dword [ebp + 8], 1
jne 0x41ecc1
call fcn.0041d850
push eax
lea ecx, [ebp - 0xe60]
call fcn.00403e80
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x14]
push ecx
push 0x433444
mov edx, dword [ebp + 0x10]
push edx
push 0x433448
lea eax, [ebp - 0xe60]
push eax
lea ecx, [ebp - 0xeb4]
push ecx
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf18], eax
mov edx, dword [ebp - 0xf18]
mov dword [ebp - 0xf1c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xf1c]
push eax
lea ecx, [ebp - 0xeb8]
push ecx
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf20], eax
mov edx, dword [ebp - 0xf20]
mov dword [ebp - 0xf24], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xf24]
push eax
lea ecx, [ebp - 0xebc]
push ecx
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf28], eax
mov edx, dword [ebp - 0xf28]
mov dword [ebp - 0xf2c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xf2c]
push eax
lea ecx, [ebp - 0xec0]
push ecx
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf30], eax
mov edx, dword [ebp - 0xf30]
mov dword [ebp - 0xf34], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xf34]
push eax
lea ecx, [ebp - 0xe60]
call fcn.00403f50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec0]
call fcn.00403f30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xebc]
call fcn.00403f30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xeb8]
call fcn.00403f30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xeb4]
call fcn.00403f30
mov ecx, dword [ebp + 0xc]
push ecx
push 0x43344c
lea edx, [ebp - 0xe60]
push edx
lea eax, [ebp - 0xec4]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf38], eax
mov ecx, dword [ebp - 0xf38]
mov dword [ebp - 0xf3c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xf3c]
push edx
lea eax, [ebp - 0xec8]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf40], eax
mov ecx, dword [ebp - 0xf40]
mov dword [ebp - 0xf44], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xf44]
push edx
lea ecx, [ebp - 0xe60]
call fcn.00403f50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xec8]
call fcn.00403f30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xec4]
call fcn.00403f30
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0xe60]
call fcn.004043b0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 0
je 0x41e8d2
xor ecx, ecx
cmp dword [ebp - 0xe6c], 0
sete cl
mov dword [ebp - 0xecc], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.00403f30
mov eax, dword [ebp - 0xecc]
jmp 0x41f1b8
xor edx, edx
jne 0x41e89a
push 0
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0xe68]
call fcn.0041e0c0
mov byte [ebp - 4], 7
push 4
mov ecx, dword [ebp + 0x1c]
push ecx
push 4
push 0
push 0x433450
lea ecx, [ebp - 0xe68]
call fcn.0041e120
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 0
je 0x41e959
xor edx, edx
cmp dword [ebp - 0xe6c], 0
sete dl
mov dword [ebp - 0xed0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe68]
call fcn.0041e0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.00403f30
mov eax, dword [ebp - 0xed0]
jmp 0x41f1b8
xor eax, eax
jne 0x41e912
cmp dword [ebp + 0x18], 0
jne 0x41e999
mov dword [ebp - 0xed4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe68]
call fcn.0041e0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.00403f30
mov eax, dword [ebp - 0xed4]
jmp 0x41f1b8
mov ecx, dword [str.product]
mov dword [ebp - 0xe5c], ecx
mov edx, dword [0x433460]
mov dword [ebp - 0xe58], edx
mov eax, dword [0x433464]
mov dword [ebp - 0xe54], eax
mov ecx, dword [0x433468]
mov dword [ebp - 0xe50], ecx
push 0x1fa
push 0
lea edx, [ebp - 0xe4c]
push edx
call fcn.00421960
add esp, 0xc
mov eax, dword [str.guid]
mov dword [ebp - 0xc52], eax
mov ecx, dword [0x433470]
mov dword [ebp - 0xc4e], ecx
mov dx, word [0x433474]
mov word [ebp - 0xc4a], dx
push 0x200
push 0
lea eax, [ebp - 0xc48]
push eax
call fcn.00421960
add esp, 0xc
mov ecx, dword [str.email]
mov dword [ebp - 0xa48], ecx
mov edx, dword [0x43347c]
mov dword [ebp - 0xa44], edx
mov eax, dword [0x433480]
mov dword [ebp - 0xa40], eax
push 0x1fe
push 0
lea ecx, [ebp - 0xa3c]
push ecx
call fcn.00421960
add esp, 0xc
mov edx, dword [str.hashid]
mov dword [ebp - 0x83e], edx
mov eax, dword [0x433488]
mov dword [ebp - 0x83a], eax
mov ecx, dword [0x43348c]
mov dword [ebp - 0x836], ecx
mov dx, word [0x433490]
mov word [ebp - 0x832], dx
push 0x1fc
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.00421960
add esp, 0xc
mov ecx, dword [str.version]
mov dword [ebp - 0x634], ecx
mov edx, dword [0x433498]
mov dword [ebp - 0x630], edx
mov eax, dword [0x43349c]
mov dword [ebp - 0x62c], eax
mov ecx, dword [0x4334a0]
mov dword [ebp - 0x628], ecx
push 0x1fa
push 0
lea edx, [ebp - 0x624]
push edx
call fcn.00421960
add esp, 0xc
mov eax, dword [str.module]
mov dword [ebp - 0x42a], eax
mov ecx, dword [0x4334a8]
mov dword [ebp - 0x426], ecx
mov edx, dword [0x4334ac]
mov dword [ebp - 0x422], edx
mov ax, word [0x4334b0]
mov word [ebp - 0x41e], ax
push 0x1fc
push 0
lea ecx, [ebp - 0x41c]
push ecx
call fcn.00421960
add esp, 0xc
mov edx, dword [0x4334b4]
mov dword [ebp - 0x220], edx
mov eax, dword [0x4334b8]
mov dword [ebp - 0x21c], eax
push 0x202
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00421960
add esp, 0xc
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xe88], edx
mov eax, dword [ebp + 0x18]
add eax, 0x510
mov dword [ebp - 0xe84], eax
mov ecx, dword [ebp + 0x18]
add ecx, 0x4be
mov dword [ebp - 0xe80], ecx
mov edx, dword [ebp + 0x18]
add edx, 0x47c
mov dword [ebp - 0xe7c], edx
mov eax, dword [ebp + 0x18]
add eax, 0x2a
mov dword [ebp - 0xe78], eax
mov ecx, dword [ebp + 0x18]
add ecx, 0x68
mov dword [ebp - 0xe74], ecx
mov edx, dword [ebp + 0x18]
add edx, 0x272
mov dword [ebp - 0xe70], edx
mov dword [ebp - 0xe8c], 0
jmp 0x41ebc8
mov eax, dword [ebp - 0xe8c]
add eax, 1
mov dword [ebp - 0xe8c], eax
cmp dword [ebp - 0xe8c], 7
jae 0x41ec86
mov ecx, dword [ebp - 0xe8c]
mov edx, dword [ebp + ecx*4 - 0xe88]
mov dword [ebp - 0xf48], edx
mov eax, dword [ebp - 0xf48]
add eax, 2
mov dword [ebp - 0xf4c], eax
mov ecx, dword [ebp - 0xf48]
mov dx, word [ecx]
mov word [ebp - 0xf4e], dx
add dword [ebp - 0xf48], 2
cmp word [ebp - 0xf4e], 0
jne 0x41ebf7
mov eax, dword [ebp - 0xf48]
sub eax, dword [ebp - 0xf4c]
sar eax, 1
mov dword [ebp - 0xf54], eax
mov ecx, dword [ebp - 0xf54]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xe8c]
mov eax, dword [ebp + edx*4 - 0xe88]
push eax
push 1
push 0
mov ecx, dword [ebp - 0xe8c]
imul ecx, ecx, 0x20a
lea edx, [ebp + ecx - 0xe5c]
push edx
lea ecx, [ebp - 0xe68]
call fcn.0041e120
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 0
je 0x41ec81
jmp 0x41ebb9
jmp 0x41ebb9
mov dword [ebp - 0xed8], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe68]
call fcn.0041e0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.00403f30
mov eax, dword [ebp - 0xed8]
jmp 0x41f1b8
cmp dword [ebp + 8], 0
jne 0x41ee61
call fcn.0041d850
push eax
lea ecx, [ebp - 0xe94]
call fcn.00403e80
mov dword [ebp - 4], 8
mov eax, dword [ebp + 0x14]
push eax
push 0x4334bc
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4334c0
lea edx, [ebp - 0xe94]
push edx
lea eax, [ebp - 0xedc]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf58], eax
mov ecx, dword [ebp - 0xf58]
mov dword [ebp - 0xf5c], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0xf5c]
push edx
lea eax, [ebp - 0xee0]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf60], eax
mov ecx, dword [ebp - 0xf60]
mov dword [ebp - 0xf64], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xf64]
push edx
lea eax, [ebp - 0xee4]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf68], eax
mov ecx, dword [ebp - 0xf68]
mov dword [ebp - 0xf6c], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0xf6c]
push edx
lea eax, [ebp - 0xee8]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf70], eax
mov ecx, dword [ebp - 0xf70]
mov dword [ebp - 0xf74], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0xf74]
push edx
lea ecx, [ebp - 0xe94]
call fcn.00403f50
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xee8]
call fcn.00403f30
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xee4]
call fcn.00403f30
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xee0]
call fcn.00403f30
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xedc]
call fcn.00403f30
mov dword [ebp - 0xe90], 0
lea eax, [ebp - 0xe90]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0xe94]
call fcn.004043b0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xe98], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xe90]
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 0xeec], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe94]
call fcn.00403f30
mov eax, dword [ebp - 0xeec]
jmp 0x41f1b8
cmp dword [ebp + 8], 2
jne 0x41f1b6
call fcn.0041d850
push eax
lea ecx, [ebp - 0xea0]
call fcn.00403e80
mov dword [ebp - 4], 0xd
mov eax, dword [ebp + 0x14]
push eax
push 0x4334c4
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4334c8
lea edx, [ebp - 0xea0]
push edx
lea eax, [ebp - 0xef0]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf78], eax
mov ecx, dword [ebp - 0xf78]
mov dword [ebp - 0xf7c], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xf7c]
push edx
lea eax, [ebp - 0xef4]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf80], eax
mov ecx, dword [ebp - 0xf80]
mov dword [ebp - 0xf84], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0xf84]
push edx
lea eax, [ebp - 0xef8]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf88], eax
mov ecx, dword [ebp - 0xf88]
mov dword [ebp - 0xf8c], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xf8c]
push edx
lea eax, [ebp - 0xefc]
push eax
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf90], eax
mov ecx, dword [ebp - 0xf90]
mov dword [ebp - 0xf94], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0xf94]
push edx
lea ecx, [ebp - 0xea0]
call fcn.00403f50
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xefc]
call fcn.00403f30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xef8]
call fcn.00403f30
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xef4]
call fcn.00403f30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xef0]
call fcn.00403f30
mov eax, dword [ebp + 0xc]
push eax
push 0x4334cc
lea ecx, [ebp - 0xea0]
push ecx
lea edx, [ebp - 0xf00]
push edx
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0xf98]
mov dword [ebp - 0xf9c], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0xf9c]
push ecx
lea edx, [ebp - 0xf04]
push edx
call fcn.004042d0
add esp, 0xc
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0xfa0]
mov dword [ebp - 0xfa4], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0xfa4]
push ecx
lea ecx, [ebp - 0xea0]
call fcn.00403f50
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xf04]
call fcn.00403f30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xf00]
call fcn.00403f30
mov dword [ebp - 0xe9c], 0
push 0
lea edx, [ebp - 0xe9c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0xea0]
call fcn.004043b0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xeac], eax
cmp dword [ebp - 0xeac], 0
je 0x41f099
xor eax, eax
cmp dword [ebp - 0xeac], 0
sete al
mov dword [ebp - 0xf08], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea0]
call fcn.00403f30
mov eax, dword [ebp - 0xf08]
jmp 0x41f1b8
xor ecx, ecx
jne 0x41f061
push 0
mov edx, dword [ebp - 0xe9c]
push edx
lea ecx, [ebp - 0xea8]
call fcn.0041e0c0
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xeb0], 4
lea eax, [ebp - 0xeb0]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
push 0
push 0x4334d0
lea ecx, [ebp - 0xea8]
call fcn.0041e120
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xeac], eax
cmp dword [ebp - 0xeac], 0
je 0x41f132
xor edx, edx
cmp dword [ebp - 0xeac], 0
sete dl
mov dword [ebp - 0xf0c], edx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xea8]
call fcn.0041e0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea0]
call fcn.00403f30
mov eax, dword [ebp - 0xf0c]
jmp 0x41f1b8
xor eax, eax
jne 0x41f0eb
cmp dword [ebp + 0x18], 0
jne 0x41f16f
mov dword [ebp - 0xf10], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xea8]
call fcn.0041e0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea0]
call fcn.00403f30
mov eax, dword [ebp - 0xf10]
jmp 0x41f1b8
mov ecx, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0xea8]
call fcn.0041e120
push eax
call fcn.0041da80
add esp, 8
mov dword [ebp - 0xf14], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xea8]
call fcn.0041e0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea0]
call fcn.00403f30
mov eax, dword [ebp - 0xf14]
jmp 0x41f1b8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041f86b
mov esp, ebp
pop ebp
ret