Function at 0x41ada0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa38
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0xa34], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x636]
push ebx
push eax
mov dword [esp + 0x20], ecx
mov word [esp + 0x63c], bx
call fcn.0042cac0
push 0x206
lea ecx, [esp + 0x232]
push ebx
push ecx
mov word [esp + 0x238], bx
call fcn.0042cac0
push 0x206
lea edx, [esp + 0x446]
push ebx
push edx
mov word [esp + 0x44c], bx
call fcn.0042cac0
push 0x206
lea eax, [esp + 0x862]
push ebx
push eax
mov word [esp + 0x868], bx
call fcn.0042cac0
push 0x206
lea ecx, [esp + 0x4e]
push ebx
push ecx
mov word [esp + 0x54], bx
call fcn.0042cac0
add esp, 0x3c
xor eax, eax
jmp 0x41ae50
movzx ecx, word [eax + str.SOFTWARE_]
mov word [esp + eax + 0x18], cx
add eax, 2
cmp cx, bx
jne 0x41ae50
lea edi, [esp + 0x18]
add edi, 0xfffffffe
jmp 0x41ae70
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x41ae70
mov ecx, 7
mov esi, str.PeopleCalendar
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x18]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x41ae91
mov edx, dword [0x47fe18]
lea eax, [esp + 0xc]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x24]
push ecx
push reloc.WS2_32.dll_bind
mov dword [edi], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41af3e
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x634]
push eax
push ebx
push ebx
push str.OnlyIdentifier1
push ecx
mov dword [esp + 0x28], 0x104
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x224]
push eax
push ebx
push ebx
push str.OnlyIdentifier2
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x42c]
push eax
push ebx
push ebx
push str.OnlyIdentifier3
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x83c]
push eax
push ebx
push ebx
push str.OnlyIdentifier4
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x630]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41af53
sub eax, edx
sar eax, 1
push ebp
mov ebp, eax
lea eax, [esp + 0x224]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41af70
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 0x42c]
lea edx, [eax + 2]
jmp 0x41af90
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41af90
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0x83c]
lea edx, [eax + 2]
jmp 0x41afb0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41afb0
sub eax, edx
sar eax, 1
cmp ebp, ebx
pop ebp
je 0x41b07e
cmp edi, ebx
je 0x41b07e
cmp esi, ebx
je 0x41b07e
cmp eax, ebx
je 0x41b07e
mov esi, dword [esp + 0x14]
mov edx, dword [esi]
lea ecx, [esp + 0x630]
lea ecx, [ecx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x41aff0
mov ecx, dword [esi]
lea edx, [esp + 0x220]
add ecx, 0x208
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
cmp ax, bx
jne 0x41b010
mov ecx, dword [esi]
lea edx, [esp + 0x428]
add ecx, 0x410
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
cmp ax, bx
jne 0x41b030
mov ecx, dword [esi]
lea edx, [esp + 0x838]
add ecx, 0x618
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
cmp ax, bx
jne 0x41b050
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xa34]
xor ecx, esp
call fcn.0042caa2
add esp, 0xa38
ret
mov ecx, dword [esp + 0xa40]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042caa2
add esp, 0xa38
ret