Function at 0x41aee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x4a4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x475]
call fcn.00409d90
lea eax, [esp + 0x278]
mov edx, str.6ZCFy9_exc_Sz8mEyMve
call fcn.004224a0
mov edx, eax
lea eax, [esp + 0x490]
call fcn.00401bc0
movzx edi, byte [esp + 0x49a]
movzx esi, byte [esp + 0x49b]
movzx ebx, byte [esp + 0x49c]
movzx ecx, byte [esp + 0x49d]
movzx edx, byte [esp + 0x49e]
movzx eax, byte [esp + 0x49f]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x4b1]
push eax
movzx edx, byte [esp + 0x4b4]
push edx
movzx ecx, byte [esp + 0x4b7]
push ecx
movzx ebx, byte [esp + 0x4ba]
push ebx
movzx esi, byte [esp + 0x4bd]
push esi
movzx edi, byte [esp + 0x4c0]
push edi
movzx eax, byte [esp + 0x4c3]
push eax
movzx edx, byte [esp + 0x4c6]
push edx
movzx ecx, byte [esp + 0x4c9]
push ecx
movzx ebx, byte [esp + 0x4cc]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x444]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x278]
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxPLt69T2tjF3MPOz9jZ1PaP2fbp39jYz8Te1PnP3vbSzcuHmdyc9tzP2A
call fcn.004224a0
lea ecx, [esp + 0x378]
lea edx, [esp + 0x400]
push edx
push eax
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x278]
mov edx, str.4cTF3cT53MnZ
call fcn.004224a0
mov ebx, eax
cmp dword [esp + 0x20], 0
mov dword [esp + 0x4a0], 0x80
jne 0x41b313
mov byte [esp + 0x2f8], 0
lea edi, [esp + 0x378]
lea esi, [esp + 0x78]
mov dword [esp + 0x20], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41b070
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x41b037
mov ebx, dword [esp + 0x20]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x41b09a
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x48c]
push eax
push ecx
push 0
lea esi, [esp + 0x84]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b11a
lea esi, [esp + 0x2f8]
lea eax, [esp + 0x4a0]
push eax
xor edx, edx
push esi
push edx
push edx
push ebx
push dword [esp + 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x41b127
mov dword [esi], 0x12d78
jmp 0x41b127
lea esi, [esp + 0x2f8]
mov dword [esi], 0x12d78
mov word [esp + 0x427], 0x21
mov byte [esp + 0x450], 0
mov word [esp + 0x44e], 0x8efd
movsx eax, byte [esp + 0x2f8]
test eax, eax
je 0x41b2e8
cmp eax, 0x78
je 0x41b356
lea edx, [esp + 0x488]
lea eax, [esp + 0x44e]
push eax
push edx
push str._d:_38s
push esi
call dword [sym.imp.MSVCR80.dll_sscanf]
add esp, 0x10
cmp eax, 2
je 0x41b192
mov eax, 6
add esp, 0x4a4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x488]
movdqa xmm0, xmmword [0x53ef10]
mov dword [esp + 0x3fc], eax
mov dword [esp + 0x3f8], eax
movaps xmmword [esp + 0x490], xmm0
lea eax, [esp + 0x20]
call fcn.004252d0
lea eax, [esp + 0x20]
mov edx, str.cj_a_
mov ecx, 5
call fcn.00401c90
lea eax, [esp + 0x20]
lea edx, [esp + 0x3f8]
mov ecx, 4
call fcn.00401c90
lea eax, [esp + 0x20]
mov edx, str..mov_.qt.avi
mov ecx, 0xc
call fcn.00401c90
lea eax, [esp + 0x490]
lea edx, [esp + 0x20]
call fcn.00408c90
movzx edi, byte [esp + 0x49a]
movzx esi, byte [esp + 0x49b]
movzx ebx, byte [esp + 0x49c]
movzx ecx, byte [esp + 0x49d]
movzx edx, byte [esp + 0x49e]
movzx eax, byte [esp + 0x49f]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x4b1]
push eax
movzx edx, byte [esp + 0x4b4]
push edx
movzx ecx, byte [esp + 0x4b7]
push ecx
movzx ebx, byte [esp + 0x4ba]
push ebx
movzx esi, byte [esp + 0x4bd]
push esi
movzx edi, byte [esp + 0x4c0]
push edi
movzx eax, byte [esp + 0x4c3]
push eax
movzx edx, byte [esp + 0x4c6]
push edx
movzx ecx, byte [esp + 0x4c9]
push ecx
movzx ebx, byte [esp + 0x4cc]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x46b]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea edi, [esp + 0x44e]
lea esi, [esp + 0x427]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x41b2df
test dl, dl
je 0x41b2db
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x41b2df
add edi, 2
add esi, 2
test dl, dl
jne 0x41b2bf
xor eax, eax
jmp 0x41b2e4
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b2fa
mov eax, 6
add esp, 0x4a4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x3fc]
xor eax, 0x372bb2e9
add esp, 0x4a4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00422e10
test eax, eax
je 0x41b020
mov edi, dword [esp + 0x4a0]
mov dword [esp + 0x14], 0x540fb8
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
lea esi, [esp + 0x2f8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
lea edx, [esp + 0x378]
call fcn.00405390
jmp 0x41b127
mov eax, 7
add esp, 0x4a4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret