Function at 0x413010
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], eax
mov byte [ebp - 4], dl
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x24]
mov ecx, eax
lea eax, [ebp - 0x3c]
mov edx, eax
mov eax, 1
call fcn.00404e40
call fcn.00404f40
push eax
test eax, eax
jne 0x413292
cmp byte [ebp - 4], 0
jne 0x413057
jmp 0x413156
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x44]
mov eax, edx
call fcn.00404f70
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1cc]
mov eax, dword [0x436130]
call fcn.0041b0b0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41309d
mov eax, 0x43b790
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
je 0x4130b1
jmp 0x413151
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415740
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x436150]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415720
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x436170]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415600
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x436180]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415530
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x4361a0]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0xc]
call sub.advapi32.dll_RegCloseKey
jmp 0x413292
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1d8]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1d4]
call edx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x48]
mov eax, edx
call fcn.00404f70
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1cc]
mov eax, dword [str.Software_]
call fcn.0041b0b0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x4131a8
mov eax, 0x43b790
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4131bc
jmp 0x413292
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x4361e0]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4131ec
jmp 0x4131fa
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415580
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x436200]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x41321c
jmp 0x41322a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415650
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x436210]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x41324c
jmp 0x41325a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415c00
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x436230]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x41327c
jmp 0x41328a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00415790
push dword [ebp - 0xc]
call sub.advapi32.dll_RegCloseKey
call fcn.00405040
lea edx, [ebp - 0x48]
mov eax, edx
call fcn.00404f70
mov dword [ebp - 0x48], 0
lea edx, [ebp - 0x44]
mov eax, edx
call fcn.00404f70
mov dword [ebp - 0x44], 0
pop eax
test eax, eax
je 0x4132c3
call fcn.004050d0
leave
ret