Function at 0x4091b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
push str.Rewriting_activation_information...._n
call fcn.0040b8e0
xor ebx, ebx
push ebx
xor edi, edi
call fcn.00418e8e
add esp, 8
push 0x10000
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x40942e
push esi
call fcn.00409150
mov esi, eax
cmp esi, ebx
je 0x40941e
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.RegUserInfo
push esi
mov dword [esp + 0x30], 0x8000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40923a
cmp dword [esp + 0x20], 3
jne 0x40923a
mov edx, dword [esp + 0x18]
push edx
push ebp
push str.UserInfo
push esi
call fcn.00414bc0
lea eax, [esp + 0x14]
push eax
push str.ExpiryDate
push esi
mov dword [esp + 0x20], ebx
call fcn.00414ac0
mov edi, 1
cmp eax, edi
jne 0x409267
mov ecx, dword [esp + 0x14]
push ecx
push str.DateExpiry
push esi
call fcn.00414b40
cmp dword [esp + 0x14], 0x56857428
jbe 0x40927d
push edi
push str.LifeType
push esi
call fcn.00414b40
lea edx, [esp + 0x10]
push edx
push str.InstallDate
push esi
mov dword [esp + 0x1c], ebx
call fcn.00414ac0
cmp eax, edi
jne 0x4092b6
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4092a2
cmp eax, 0xffffffff
jne 0x4092aa
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
push eax
push str.DateInstallation
push esi
call fcn.00414b40
lea eax, [esp + 0x10]
push eax
push str.SDateOfActivation
push esi
mov dword [esp + 0x1c], ebx
call fcn.00414ac0
cmp eax, edi
jne 0x4092de
mov ecx, dword [esp + 0x10]
push ecx
push str.DateActivation
push esi
call fcn.00414b40
lea edx, [esp + 0x10]
push edx
push str.SubsType
push esi
mov dword [esp + 0x1c], ebx
call fcn.00414ac0
cmp eax, edi
jne 0x409343
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409312
cmp eax, 2
jne 0x409307
mov eax, edi
jmp 0x409333
sub eax, edi
neg eax
sbb eax, eax
and eax, 0xfffffffe
jmp 0x409330
lea eax, [esp + 0x10]
push eax
push str.TrialVersion
push esi
mov dword [esp + 0x1c], ebx
call fcn.00414ac0
mov eax, dword [esp + 0x10]
sub eax, edi
neg eax
sbb eax, eax
add eax, 2
push eax
push str.SubscriptionType
push esi
mov dword [esp + 0x1c], eax
call fcn.00414b40
lea ecx, [esp + 0x10]
push ecx
push str.Registered
push esi
mov dword [esp + 0x1c], ebx
call fcn.00414ac0
cmp eax, edi
jne 0x409385
cmp dword [esp + 0x10], edi
jne 0x409373
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x14]
sbb eax, eax
and eax, 0xfffffff7
add eax, 0xa
jmp 0x409375
xor eax, eax
push eax
push str.SubscriptionStatus
push esi
mov dword [esp + 0x1c], eax
call fcn.00414b40
push 0x104
push ebp
push str.PCName
push esi
mov byte [ebp], bl
call fcn.00414a70
cmp eax, edi
jne 0x4093a9
push ebp
push str.UserPCName
push esi
call fcn.00414b10
push str.RegUserInfo
push esi
call fcn.00414c60
push str.SubsType
push esi
call fcn.00414c60
push str.SubsDays
push esi
call fcn.00414c60
push str.ExpiryDate
push esi
call fcn.00414c60
push str.InstallDate
push esi
call fcn.00414c60
push str.SDateOfInstall
push esi
call fcn.00414c60
push str.SDateOfActivation
push esi
call fcn.00414c60
push str.SDateOfExpiry
push esi
call fcn.00414c60
push str.Registered
push esi
call fcn.00414c60
push str.RegUserInstId
push esi
call fcn.00414c60
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret