Function at 0x401fb0
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1870
call fcn.0040b600
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.BCDFGHJKMPQRTVWXY2346789]
mov al, byte [0x4141b8]
push 0x1e
movdqu xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x1868], 0x800
movq xmm0, qword [0x4141b0]
movq qword [ebp - 0x10], xmm0
mov byte [ebp - 8], al
call fcn.004044b3
add esp, 4
mov dword [ebp - 0x186c], eax
test eax, eax
je 0x402212
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x1864]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call esi
test eax, eax
je 0x402041
mov eax, 0x41421a
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004041d7
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1868]
push eax
lea eax, [ebp - 0x820]
push eax
push 0
push 0
push str.DigitalProductId
push dword [ebp - 0x1864]
call edi
test eax, eax
je 0x402106
lea eax, [ebp - 0x1864]
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call esi
test eax, eax
jne 0x4020f1
lea eax, [ebp - 0x1868]
push eax
lea eax, [ebp - 0x820]
push eax
push 0
push 0
push str.DigitalProductId
push dword [ebp - 0x1864]
call edi
test eax, eax
je 0x402106
lea eax, [ebp - 0x1864]
push eax
push 0x201
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call esi
test eax, eax
jne 0x4020f1
lea eax, [ebp - 0x1868]
push eax
lea eax, [ebp - 0x820]
push eax
push 0
push 0
push str.DigitalProductId
push dword [ebp - 0x1864]
call edi
test eax, eax
je 0x402106
pop edi
mov eax, 0x41421a
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004041d7
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x1868]
xor esi, esi
cmp edi, 1
jbe 0x402152
xor ecx, ecx
jmp 0x402120
movzx edx, word [ebp + ecx - 0x820]
lea esi, [esi + 1]
mov ecx, edx
shr cx, 8
mov eax, ecx
mov word [ebp + esi*4 - 0x1822], cx
shl eax, 8
lea ecx, [esi + esi]
sub edx, eax
lea eax, [ecx + 1]
mov word [ebp + esi*4 - 0x1824], dx
cmp eax, edi
jb 0x402120
mov ecx, 0x34
lea edx, [ebp - 0x1860]
lea ecx, [ecx]
movzx eax, word [ebp + ecx*2 - 0x1820]
lea edx, [edx + 4]
inc ecx
mov dword [edx - 4], eax
cmp ecx, 0x43
jl 0x402160
mov ecx, dword [ebp - 0x186c]
mov eax, 1
sub eax, ecx
push ebx
mov ebx, 0x1c
mov dword [ebp - 0x1870], eax
lea esi, [ecx + 0x1c]
mov ecx, 6
add eax, esi
cdq
idiv ecx
test edx, edx
je 0x4021ea
xor ecx, ecx
mov edi, 0xe
jmp 0x4021b0
shl ecx, 8
mov eax, 0x2aaaaaab
or ecx, dword [ebp + edi*4 - 0x1860]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp + edi*4 - 0x1860], eax
lea eax, [eax + eax*2]
shl eax, 3
sub ecx, eax
dec edi
mov al, byte [ebp + ecx - 0x20]
jns 0x4021b0
mov byte [esi], al
mov ecx, 6
jmp 0x4021ed
mov byte [esi], 0x2d
mov eax, dword [ebp - 0x1870]
dec esi
dec ebx
jns 0x402195
mov eax, dword [ebp - 0x186c]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov byte [eax + 0x1d], 0
pop esi
call fcn.004041d7
mov esp, ebp
pop ebp
ret
cmp dword [0x417ea0], 1
jne 0x40222f
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]