Function at 0x417e2c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x417e47
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov byte [esi], 0
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
neg eax
push edi
sbb eax, eax
and eax, 6
add eax, 0x20019
push eax
push edi
push edi
push edi
push str.SOFTWARENullsoftWinamp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x418036
cmp dword [ebp + 8], edi
push ebx
je 0x417f40
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
inc eax
push eax
push esi
push 1
push edi
push str.regname
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x20
push dword [ebp + 0x10]
lea eax, [ebp - 0x2b]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor edi, edi
inc edi
cmp byte [ebp - 0x2b], 0
mov byte [ebp - 0x2c], 0x7e
je 0x417f1d
mov dword [ebp + 8], 0x1b
lea esi, [ebp + edi - 0x2c]
movsx eax, byte [esi]
push eax
call dword [sym.imp.NSCRT.dll_toupper]
cmp al, 0x41
pop ecx
jl 0x417eed
cmp al, 0x5a
jg 0x417eed
movsx eax, al
lea eax, [eax + edi - 0x41]
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x41
mov byte [esi], dl
jmp 0x417f11
cmp al, 0x30
jl 0x417f0a
cmp al, 0x39
jg 0x417f0a
mov ecx, dword [ebp + 8]
movsx eax, al
lea eax, [eax + ecx - 0x30]
push 0xa
cdq
pop ecx
idiv ecx
add dl, 0x61
jmp 0x417ee9
cmp al, 0x2d
jne 0x417f11
mov byte [esi], 0x2f
add dword [ebp + 8], 0x1b
inc edi
cmp byte [ebp + edi - 0x2c], 0
jne 0x417ec2
lea eax, [ebp - 0x2c]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0
push str.regkey
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x41802c
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp + 8]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.regname
push dword [ebp - 4]
xor ebx, ebx
inc ebx
mov dword [ebp - 8], 0x200
mov dword [ebp + 8], ebx
call edi
test eax, eax
jne 0x417f70
cmp dword [ebp + 8], ebx
je 0x417f73
mov byte [esi], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 8]
push eax
push 0
push str.regkey
push dword [ebp - 4]
mov dword [ebp - 8], 0x21
mov dword [ebp + 8], ebx
call edi
test eax, eax
jne 0x418026
cmp dword [ebp + 8], ebx
jne 0x418026
cmp byte [ebp - 0x2c], 0x7e
jne 0x418015
cmp byte [ebp - 0x2b], al
je 0x418010
push 0x1b
pop esi
lea ecx, [ebp + ebx - 0x2c]
mov al, byte [ecx]
cmp al, 0x41
jl 0x417fdd
cmp al, 0x5a
jg 0x417fdd
movsx eax, al
sub eax, ebx
sub eax, 0x41
push 0x1a
cdq
pop edi
idiv edi
test edx, edx
jge 0x417fd6
add edx, edi
add dl, 0x41
mov byte [ecx], dl
jmp 0x418005
cmp al, 0x61
jl 0x417ffe
cmp al, 0x6b
jg 0x417ffe
movsx eax, al
sub eax, esi
sub eax, 0x61
push 0xa
cdq
pop edi
idiv edi
test edx, edx
jge 0x417ff9
add edx, edi
add dl, 0x30
jmp 0x417fd9
cmp al, 0x2f
jne 0x418005
mov byte [ecx], 0x2d
inc ebx
add esi, 0x1b
cmp byte [ebp + ebx - 0x2c], 0
jne 0x417fb4
lea eax, [ebp - 0x2b]
jmp 0x418018
lea eax, [ebp - 0x2c]
push 0x20
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x41802c
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret