Function at 0x417de0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b6876
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de8bc]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor esi, esi
push 0xfe
lea eax, [esp + 0x62]
push esi
push eax
mov word [esp + 0x68], si
call fcn.0042f980
push 0xfe
lea ecx, [esp + 0x16e]
push esi
push ecx
mov word [esp + 0x174], si
call fcn.0042f980
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x18
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x417eb0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
push 0x4bb4e8
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], pe_nt_image_headers32
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
jne 0x417f01
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push str.registration_code
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], pe_nt_image_headers32
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x418068
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x418068
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x60]
push edx
mov eax, edx
push eax
push 0xafd
call fcn.0040d2a0
add esp, 0x10
test eax, eax
je 0x418068
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00406160
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x28]
push edx
mov ecx, 0x4e9eb0
mov dword [esp + 0x274], esi
call fcn.004054b0
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x268], 0xffffffff
jb 0x417f95
mov eax, dword [esp + 0x24]
push eax
call fcn.0042e631
add esp, 4
lea ecx, [esp + 0x15c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00406160
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x28]
push edx
mov ecx, 0x4e9ecc
mov dword [esp + 0x274], 1
call fcn.004054b0
cmp dword [esp + 0x38], 0x10
jb 0x417fd7
mov eax, dword [esp + 0x24]
push eax
call fcn.0042e631
add esp, 4
lea ecx, [esp + 0x14]
push ecx
xor eax, eax
push 0x20019
push esi
push str.SoftwarePdaNetAndroid
push connect
mov word [esp + 0x50], si
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov dword [esp + 0x62], eax
mov dword [esp + 0x66], eax
mov dword [esp + 0x6a], eax
mov word [esp + 0x6e], ax
call edi
test eax, eax
jne 0x41804d
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push str.data
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], pe_nt_image_headers32
call ebx
mov eax, dword [esp + 0x14]
push eax
call ebp
push str.9600
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x418068
mov eax, 1
jmp 0x41806a
xor eax, eax
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0042e636
add esp, 0x258
ret