Function at 0x41d640
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fd6b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x178
mov eax, dword [0x463184]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x463be0]
test eax, eax
js 0x41d692
setne al
jmp 0x41da11
xorps xmm0, xmm0
mov dword [ebp - 0x144], 0
push 0x20
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x140], 0xf
movups xmmword [ebp - 0x154], xmm0
call fcn.0040a960
movups xmm0, xmmword [str.SOFTWAREMICROSOFTDIRECTX]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x144], 0x1a
mov dword [ebp - 0x140], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x45b5f8]
movq qword [eax + 0x10], xmm0
mov cx, word [0x45b600]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
push ecx
cmovae eax, dword [ebp - 0x154]
push 0x20019
push 0
push eax
push 0x80000002
mov dword [0x463be0], 1
call dword [0x463080]
test eax, eax
jne 0x41d9b7
push eax
push eax
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x184]
push eax
push 0
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x41d9ab
mov ecx, dword [ebp - 0x16c]
test ecx, ecx
je 0x41d9ab
xorps xmm0, xmm0
mov dword [ebp - 0x128], eax
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], al
mov byte [ebp - 4], 1
mov dword [ebp - 0x168], eax
test ecx, ecx
je 0x41d9a0
nop
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x160], 0x104
push ecx
lea ecx, [ebp - 0x120]
push ecx
push eax
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41d987
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
mov ecx, dword [ebp - 0x124]
cmovae eax, dword [ebp - 0x154]
mov edi, dword [ebp - 0x144]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x178], ecx
cmp edi, ecx
ja 0x41d84f
cmp ecx, 0x10
mov dword [ebp - 0x128], edi
push edi
lea esi, [ebp - 0x138]
cmovae esi, dword [ebp - 0x138]
push eax
push esi
call fcn.0042d0b0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x41d907
cmp edi, 0x7fffffff
ja 0x41da34
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x41d86f
mov esi, 0x7fffffff
jmp 0x41d88d
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x41d885
mov esi, 0x7fffffff
jmp 0x41d88d
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040a960
push edi
push dword [ebp - 0x170]
mov dword [ebp - 0x124], esi
mov esi, eax
push esi
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x128], edi
call fcn.0042d0b0
mov ecx, dword [ebp - 0x178]
add esp, 0xc
mov byte [esi + edi], 0
cmp ecx, 0x10
jb 0x41d901
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41d8f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41da2f
push ecx
push edx
lfence
call fcn.0042b073
add esp, 8
mov dword [ebp - 0x138], esi
push 0x5c
lea ecx, [ebp - 0x138]
call fcn.0040b580
push dword [ebp - 0x160]
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.004154b0
cmp dword [ebp - 0x124], 0x10
lea ecx, [ebp - 0x17c]
push ecx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], 0
push ecx
push 0
push 0x10
lea eax, [ebp - 0x138]
mov dword [ebp - 0x17c], 4
cmovae eax, dword [ebp - 0x138]
push str.DeviceId
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x41d987
cmp dword [ebp - 0x164], 0x8c
jne 0x41d9f5
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp eax, dword [ebp - 0x16c]
jb 0x41d7c0
lea ecx, [ebp - 0x138]
call fcn.0040a9c0
push dword [ebp - 0x15c]
call dword [0x46307c]
cmp dword [0x463be0], 0
mov ecx, dword [ebp - 0x140]
setne al
mov byte [ebp - 0x155], al
cmp ecx, 0x10
jb 0x41da11
mov edx, dword [ebp - 0x154]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41da01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41da2f
jmp 0x41da01
mov dword [0x463be0], 0
jmp 0x41d9a0
push ecx
push edx
call fcn.0042b073
mov al, byte [ebp - 0x155]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042b03b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00430964
call fcn.00402eb0
int3