Function at 0x41d2a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45085b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x178
mov eax, dword [0x46718c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x467bf8]
test eax, eax
js 0x41d2f2
setne al
jmp 0x41d671
xorps xmm0, xmm0
mov dword [ebp - 0x144], 0
push 0x20
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x140], 0xf
movups xmmword [ebp - 0x154], xmm0
call fcn.0040a7b0
movups xmm0, xmmword [str.SOFTWAREMICROSOFTDIRECTX]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x144], 0x1a
mov dword [ebp - 0x140], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x46002c]
movq qword [eax + 0x10], xmm0
mov cx, word [0x460034]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
push ecx
cmovae eax, dword [ebp - 0x154]
push 0x20019
push 0
push eax
push 0x80000002
mov dword [0x467bf8], 1
call dword [0x467088]
test eax, eax
jne 0x41d617
push eax
push eax
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x184]
push eax
push 0
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x41d60b
mov ecx, dword [ebp - 0x16c]
test ecx, ecx
je 0x41d60b
xorps xmm0, xmm0
mov dword [ebp - 0x128], eax
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], al
mov byte [ebp - 4], 1
mov dword [ebp - 0x168], eax
test ecx, ecx
je 0x41d600
nop
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x160], 0x104
push ecx
lea ecx, [ebp - 0x120]
push ecx
push eax
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41d5e7
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
mov ecx, dword [ebp - 0x124]
cmovae eax, dword [ebp - 0x154]
mov edi, dword [ebp - 0x144]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x178], ecx
cmp edi, ecx
ja 0x41d4af
cmp ecx, 0x10
mov dword [ebp - 0x128], edi
push edi
lea esi, [ebp - 0x138]
cmovae esi, dword [ebp - 0x138]
push eax
push esi
call fcn.0042ce50
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x41d567
cmp edi, 0x7fffffff
ja 0x41d694
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x41d4cf
mov esi, 0x7fffffff
jmp 0x41d4ed
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x41d4e5
mov esi, 0x7fffffff
jmp 0x41d4ed
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040a7b0
push edi
push dword [ebp - 0x170]
mov dword [ebp - 0x124], esi
mov esi, eax
push esi
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x128], edi
call fcn.0042ce50
mov ecx, dword [ebp - 0x178]
add esp, 0xc
mov byte [esi + edi], 0
cmp ecx, 0x10
jb 0x41d561
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41d554
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d68f
push ecx
push edx
lfence
call fcn.0042acd3
add esp, 8
mov dword [ebp - 0x138], esi
push 0x5c
lea ecx, [ebp - 0x138]
call fcn.0040b2c0
push dword [ebp - 0x160]
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.00415180
cmp dword [ebp - 0x124], 0x10
lea ecx, [ebp - 0x17c]
push ecx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], 0
push ecx
push 0
push 0x10
lea eax, [ebp - 0x138]
mov dword [ebp - 0x17c], 4
cmovae eax, dword [ebp - 0x138]
push str.DeviceId
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x41d5e7
cmp dword [ebp - 0x164], 0x8c
jne 0x41d655
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp eax, dword [ebp - 0x16c]
jb 0x41d420
lea ecx, [ebp - 0x138]
call fcn.0040a810
push dword [ebp - 0x15c]
call dword [0x467084]
cmp dword [0x467bf8], 0
mov ecx, dword [ebp - 0x140]
setne al
mov byte [ebp - 0x155], al
cmp ecx, 0x10
jb 0x41d671
mov edx, dword [ebp - 0x154]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41d661
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d68f
jmp 0x41d661
mov dword [0x467bf8], 0
jmp 0x41d600
push ecx
push edx
call fcn.0042acd3
mov al, byte [ebp - 0x155]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042ac9b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00430704
call fcn.00402e90
int3