Function at 0x41d2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x564
mov dword [esp + 0x20], eax
lea eax, [esp + 0x52c]
call fcn.00409d90
movsd xmm0, qword [0x53ed7c]
movsd qword [esp + 0x550], xmm0
movzx esi, word [0x53ed84]
mov word [esp + 0x558], si
mov al, byte [0x53ed86]
mov byte [esp + 0x55a], al
pxor xmm0, xmm0
movaps xmmword [esp + 0x540], xmm0
lea eax, [esp + 0x4c8]
call fcn.004252d0
lea eax, [esp + 0x4c8]
mov edx, 0x53fb00
mov ecx, 3
call fcn.00401c90
lea eax, [esp + 0x4c8]
lea edx, [esp + 0x550]
mov ecx, 0xb
call fcn.00401c90
lea eax, [esp + 0x4c8]
mov edx, 0x53fb00
mov ecx, 3
call fcn.00401c90
lea edx, [esp + 0x52c]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x41d392
mov eax, edx
add edx, ecx
call fcn.00425520
lea edx, [esp + 0x52c]
mov ecx, eax
lea eax, [esp + 0x4c8]
call fcn.00401c90
lea eax, [esp + 0x540]
lea edx, [esp + 0x4c8]
call fcn.00408c90
movzx edi, byte [esp + 0x54a]
movzx esi, byte [esp + 0x54b]
movzx ebx, byte [esp + 0x54c]
movzx ecx, byte [esp + 0x54d]
movzx edx, byte [esp + 0x54e]
movzx eax, byte [esp + 0x54f]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x561]
push eax
movzx edx, byte [esp + 0x564]
push edx
movzx ecx, byte [esp + 0x567]
push ecx
movzx ebx, byte [esp + 0x56a]
push ebx
movzx esi, byte [esp + 0x56d]
push esi
movzx edi, byte [esp + 0x570]
push edi
movzx eax, byte [esp + 0x573]
push eax
movzx edx, byte [esp + 0x576]
push edx
movzx ecx, byte [esp + 0x579]
push ecx
movzx ebx, byte [esp + 0x57c]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x2bc]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea eax, [esp + 0x2f8]
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxM7F3dmK48TZ3svGxor86PLU9unf2NjPxN7U_M_Y2cPFxPbjxNney8bG1ObFyfbSzcuHm4eP2fb8z9jZw8XEipmE0g
call fcn.004224a0
lea esi, [esp + 0x378]
lea edx, [esp + 0x278]
push edx
push eax
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
cmp dword [esp + 0x20], 0
mov dword [esp + 0x560], 0x80
jne 0x41d7dd
mov byte [esp + 0x3f8], 0
lea ebx, [esp + 0x78]
push 0x5428fc
push esi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov edi, eax
test edi, edi
je 0x41d4e6
sub edi, esi
push edi
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add ebx, edi
push ebx
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea esi, [edi + esi + 1]
jmp 0x41d4ad
mov edx, esi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x41d50c
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x55c]
push eax
push ecx
push 0
lea ebx, [esp + 0x84]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41d593
lea ebx, [esp + 0x3f8]
lea eax, [esp + 0x560]
push eax
xor edx, edx
push ebx
push edx
push edx
push 0x53fba4
push dword [esp + 0x570]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
push dword [esp + 0x55c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41d5a3
mov byte [ebx + 2], 0
mov word [ebx], 0x879
jmp 0x41d5a3
lea ebx, [esp + 0x3f8]
mov byte [ebx + 2], 0
mov word [ebx], 0x879
movsx eax, byte [esp + 0x3f8]
test eax, eax
jne 0x41d5c6
mov eax, 0xfffffffe
mov edx, 0xffffffff
add esp, 0x564
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov word [esp + 0x478], 0x2d
mov word [esp + 0x49f], 0x2b
cmp eax, 0x79
je 0x41d81e
lea edx, [esp + 0x53c]
lea eax, [esp + 0x49f]
push eax
push edx
push str._ld:_38s
push ebx
call dword [sym.imp.MSVCR80.dll_sscanf]
add esp, 0x10
cmp eax, 2
je 0x41d61e
mov eax, 0xfffffffe
mov edx, 0xffffffff
add esp, 0x564
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x53c]
movdqa xmm0, xmmword [0x53ef20]
cdq
mov dword [esp + 0x528], eax
mov dword [esp + 0x520], eax
mov dword [esp + 0x524], edx
movaps xmmword [esp + 0x540], xmm0
lea eax, [esp + 0x20]
call fcn.004252d0
lea eax, [esp + 0x20]
mov edx, str.ck_a_
mov ecx, 5
call fcn.00401c90
lea eax, [esp + 0x20]
lea edx, [esp + 0x520]
mov ecx, 4
call fcn.00401c90
lea edx, [esp + 0x52c]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x41d6a7
mov eax, edx
add edx, ecx
call fcn.00425520
lea edx, [esp + 0x52c]
mov ecx, eax
lea eax, [esp + 0x20]
call fcn.00401c90
lea eax, [esp + 0x540]
lea edx, [esp + 0x20]
call fcn.00408c90
movzx edi, byte [esp + 0x54a]
movzx esi, byte [esp + 0x54b]
movzx ebx, byte [esp + 0x54c]
movzx ecx, byte [esp + 0x54d]
movzx edx, byte [esp + 0x54e]
movzx eax, byte [esp + 0x54f]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x561]
push eax
movzx edx, byte [esp + 0x564]
push edx
movzx ecx, byte [esp + 0x567]
push ecx
movzx ebx, byte [esp + 0x56a]
push ebx
movzx esi, byte [esp + 0x56d]
push esi
movzx edi, byte [esp + 0x570]
push edi
movzx eax, byte [esp + 0x573]
push eax
movzx edx, byte [esp + 0x576]
push edx
movzx ecx, byte [esp + 0x579]
push ecx
movzx ebx, byte [esp + 0x57c]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x4bc]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea edi, [esp + 0x478]
lea esi, [esp + 0x49f]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x41d79d
test dl, dl
je 0x41d799
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x41d79d
add edi, 2
add esi, 2
test dl, dl
jne 0x41d77d
xor eax, eax
jmp 0x41d7a2
sbb eax, eax
or eax, 1
test eax, eax
je 0x41d7bd
mov eax, 0xfffffffe
mov edx, 0xffffffff
add esp, 0x564
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x528]
mov edx, dword [esp + 0x524]
xor eax, 0x69603c7f
add esp, 0x564
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00422e10
test eax, eax
je 0x41d4a1
mov edi, dword [esp + 0x560]
mov dword [esp + 0x14], 0x53fba0
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, esi
lea ebx, [esp + 0x3f8]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
mov ecx, 0x53fba4
call fcn.00405390
jmp 0x41d5a3
mov eax, 0xffffffff
mov edx, eax
add esp, 0x564
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret