Function at 0x41b200
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, eax
push ebx
shr ecx, 0x10
neg ecx
sbb ecx, ecx
push ebp
inc ecx
push esi
cmp ax, 1
push edi
mov dword [esp + 0x34], ecx
jb 0x41b477
cmp ax, 0x1a
ja 0x41b477
lea edx, [esp + 0x14]
xor ebx, ebx
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], 0xa
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b477
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
mov ebp, 4
push str.UseGlobalSettings
push eax
mov dword [esp + 0x34], ebp
call edi
test eax, eax
jne 0x41b382
cmp dword [esp + 0x18], ebp
jne 0x41b382
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x41b3d9
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x4a2354
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], ebp
call edi
test eax, eax
jne 0x41b2db
cmp dword [esp + 0x18], ebp
je 0x41b2e1
mov dword [esp + 0x24], ebx
jmp 0x41b2eb
cmp dword [esp + 0x24], ebx
jne 0x41b3d9
cmp dword [esp + 0x34], 1
jne 0x41b3d9
mov edx, dword [0x4bcc04]
push 0x4c1e78
push 0x4c7
mov dword [esp + 0x28], edx
call sub.hdm.dll__getMessage_4
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0047b553
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push 0x34
push 0x4c2278
push ecx
mov ecx, dword [esp + 0x44]
call fcn.00417940
cmp eax, 6
je 0x41b359
lea ecx, [esp + 0x20]
xor esi, esi
call fcn.0047e4e4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push ebp
push edx
push eax
push ebx
push str.UseGlobalSettings
push ecx
mov dword [esp + 0x40], ebx
call esi
test eax, eax
je 0x41b39e
lea ecx, [esp + 0x20]
call fcn.0047e4e4
mov eax, dword [esp + 0x14]
mov esi, 2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.Percent
push edx
mov dword [esp + 0x34], ebp
call edi
test eax, eax
je 0x41b3d0
cmp dword [esp + 0x18], ebp
je 0x41b3d0
mov dword [esp + 0x2c], 0xa
lea ecx, [esp + 0x20]
call fcn.0047e4e4
mov al, byte [esp + 0x40]
mov edx, dword [esp + 0x14]
add al, 0x60
push ebx
mov byte [esp + 0x16], al
lea eax, [esp + 0x34]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea ecx, [esp + 0x2a]
push ebx
push ecx
push edx
mov byte [esp + 0x37], bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41b382
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x34]
push ebp
push ecx
push ebp
push ebx
push str.NukeOnDelete
push edx
call esi
test eax, eax
je 0x41b44b
mov edx, dword [esp + 0x30]
mov esi, 2
push edx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
push ebp
push eax
push ebp
push ebx
push str.Percent
push ecx
call esi
mov edx, dword [esp + 0x30]
mov esi, 1
push edx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x2c
ret 4