Function at 0x414981
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov esi, eax
jne 0x41499b
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov byte [esi], 0
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
neg eax
push edi
sbb eax, eax
and eax, 6
add eax, 0x20019
push eax
push edi
push edi
push edi
push str.SOFTWARENullsoftWinamp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x414b8a
cmp dword [ebp + 8], edi
push ebx
je 0x414a94
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
inc eax
push eax
push esi
push 1
push edi
push str.regname
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x20
push dword [ebp + 0xc]
lea eax, [ebp - 0x2b]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor edi, edi
inc edi
cmp byte [ebp - 0x2b], 0
mov byte [ebp - 0x2c], 0x7e
je 0x414a71
mov dword [ebp + 8], 0x1b
lea esi, [ebp + edi - 0x2c]
movsx eax, byte [esi]
push eax
call dword [sym.imp.NSCRT.dll_toupper]
cmp al, 0x41
pop ecx
jl 0x414a41
cmp al, 0x5a
jg 0x414a41
movsx eax, al
lea eax, [eax + edi - 0x41]
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x41
mov byte [esi], dl
jmp 0x414a65
cmp al, 0x30
jl 0x414a5e
cmp al, 0x39
jg 0x414a5e
mov ecx, dword [ebp + 8]
movsx eax, al
lea eax, [eax + ecx - 0x30]
push 0xa
cdq
pop ecx
idiv ecx
add dl, 0x61
jmp 0x414a3d
cmp al, 0x2d
jne 0x414a65
mov byte [esi], 0x2f
add dword [ebp + 8], 0x1b
inc edi
cmp byte [ebp + edi - 0x2c], 0
jne 0x414a16
lea eax, [ebp - 0x2c]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0
push str.regkey
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x414b80
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp + 8]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.regname
push dword [ebp - 4]
xor ebx, ebx
inc ebx
mov dword [ebp - 8], 0x200
mov dword [ebp + 8], ebx
call edi
test eax, eax
jne 0x414ac4
cmp dword [ebp + 8], ebx
je 0x414ac7
mov byte [esi], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 8]
push eax
push 0
push str.regkey
push dword [ebp - 4]
mov dword [ebp - 8], 0x21
mov dword [ebp + 8], ebx
call edi
test eax, eax
jne 0x414b7a
cmp dword [ebp + 8], ebx
jne 0x414b7a
cmp byte [ebp - 0x2c], 0x7e
jne 0x414b69
cmp byte [ebp - 0x2b], al
je 0x414b64
push 0x1b
pop esi
lea ecx, [ebp + ebx - 0x2c]
mov al, byte [ecx]
cmp al, 0x41
jl 0x414b31
cmp al, 0x5a
jg 0x414b31
movsx eax, al
sub eax, ebx
sub eax, 0x41
push 0x1a
cdq
pop edi
idiv edi
test edx, edx
jge 0x414b2a
add edx, edi
add dl, 0x41
mov byte [ecx], dl
jmp 0x414b59
cmp al, 0x61
jl 0x414b52
cmp al, 0x6b
jg 0x414b52
movsx eax, al
sub eax, esi
sub eax, 0x61
push 0xa
cdq
pop edi
idiv edi
test edx, edx
jge 0x414b4d
add edx, edi
add dl, 0x30
jmp 0x414b2d
cmp al, 0x2f
jne 0x414b59
mov byte [ecx], 0x2d
inc ebx
add esi, 0x1b
cmp byte [ebp + ebx - 0x2c], 0
jne 0x414b08
lea eax, [ebp - 0x2b]
jmp 0x414b6c
lea eax, [ebp - 0x2c]
push 0x20
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x414b80
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret