Function at 0x41af00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x484c42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x868
mov eax, dword [0x4aadb8]
push ebx
push ebp
push esi
mov dword [esp + 0x1c], ecx
push edi
lea ecx, [esp + 0x254]
mov dword [esp + 0x870], eax
call fcn.0040c960
push 0x48ab04
xor ebp, ebp
push str.DatPl.dat
mov dword [esp + 0x888], ebp
call fcn.004606c3
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x41b22c
mov dl, byte [0x48dcc8]
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [str.superdgs]
mov ecx, dword [0x48dcc4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x38], ecx
push eax
lea ecx, [esp + 0x258]
mov byte [esp + 0x40], dl
call fcn.0040cee0
push esi
mov edi, 1
push edi
lea ecx, [esp + 0x7c]
push 0xa0
push ecx
call fcn.004602e5
add esp, 0x10
push ebp
push 0xa0
lea edx, [esp + 0x7c]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x264]
call fcn.0040d2d0
xor eax, eax
mov cl, byte [esp + eax + 0x74]
mov byte [esp + eax + 0x1b4], cl
inc eax
test cl, cl
jne 0x41afd0
push esi
push edi
lea ecx, [esp + 0x7c]
push 0xa0
push ecx
call fcn.004602e5
add esp, 0x10
push ebp
push 0xa0
lea edx, [esp + 0x7c]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x264]
call fcn.0040d2d0
xor eax, eax
mov cl, byte [esp + eax + 0x74]
mov byte [esp + eax + 0x114], cl
inc eax
test cl, cl
jne 0x41b010
push esi
call fcn.0046013a
add esp, 4
lea ecx, [esp + 0x24]
call fcn.0043a290
mov byte [esp + 0x880], 1
call fcn.00477b74
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x880], 2
call fcn.00477b74
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x880], 3
call fcn.00477b74
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push str.http:__ns1.ivansms.com:8888_Client_user_count.asp_type0phone
lea ecx, [esp + 0x20]
mov byte [esp + 0x884], 4
call fcn.00402080
mov ebx, 5
lea eax, [esp + 0x1b4]
mov byte [esp + 0x880], bl
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b0b0
sub eax, ecx
push eax
lea eax, [esp + 0x1b8]
push eax
lea ecx, [esp + 0x24]
call fcn.00401db0
xor esi, esi
lea ecx, [ecx]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
push ebp
lea ecx, [esp + 0x38]
inc esi
call fcn.0043aa80
cmp esi, 6
jg 0x41b11c
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebp
jl 0x41b0d0
push str.200_OK
push eax
call fcn.00460994
add esp, 8
cmp eax, ebp
je 0x41b0d0
mov ecx, dword [esp + 0x14]
sub eax, ecx
cmp eax, 0xffffffff
je 0x41b0d0
jmp 0x41b120
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], ebp
jl 0x41b183
push str.200_OK
push ecx
call fcn.00460994
add esp, 8
cmp eax, ebp
je 0x41b183
sub eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x41b183
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebp
jle 0x41b183
push 0xa
push ebp
push eax
call fcn.00461213
add esp, 0xc
cmp eax, ebp
mov dword [0x4a9448], eax
mov dword [esp + 0x880], ebx
jle 0x41b183
lea edx, [esp + 0x1b4]
push edx
mov ecx, 0x4ac2cc
mov dword [0x4ac284], edi
mov dword [0x4a944c], edi
call fcn.00402000
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x880], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b1a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x880], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b1cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x880], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b1f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x880], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b21b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x24]
mov byte [esp + 0x880], 0
call fcn.0043a2a0
mov eax, dword [0x4ac2cc]
mov eax, dword [eax - 0xc]
cmp eax, 0xb
je 0x41b29c
push 0x48ab04
push str.DatPh.dat
call fcn.004606c3
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x41b29c
push esi
push 1
lea ecx, [esp + 0x11c]
push 0xb
push ecx
call fcn.004602e5
push esi
call fcn.0046013a
lea eax, [esp + 0x128]
add esp, 0x14
mov byte [esp + 0x11f], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b280
sub eax, edx
push eax
lea edx, [esp + 0x118]
push edx
mov ecx, 0x4ac2cc
call fcn.00401b80
cmp dword [0x4ac284], ebp
jne 0x41b36b
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push 0x2001f
push ebp
push str.Software
mov dword [0x4ac288], ebp
add edi, 0xc94
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov dword [edi], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x41b337
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 0x4ac288
lea edx, [esp + 0x20]
push edx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.Config
push esi
mov dword [esp + 0x28], 4
call ebp
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push 0
push str.Monfig
push esi
mov dword [esp + 0x28], 4
call ebp
test esi, esi
je 0x41b335
push esi
call ebx
xor esi, esi
xor ebp, ebp
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi]
cmp eax, ebp
mov cx, word [esp + 0x26]
jbe 0x41b359
cmp eax, 0xc
ja 0x41b359
movzx edx, cx
cmp eax, edx
je 0x41b364
movzx eax, cx
mov dword [edi], eax
mov dword [0x4ac288], ebp
cmp esi, ebp
je 0x41b36b
push esi
call ebx
mov edi, dword [esp + 0x20]
push 0x48ab04
add edi, 0xea0
push str.DatIvanBoo.dat
mov dword [edi], ebp
call fcn.004606c3
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x41b3a3
push esi
push 1
push 4
push edi
call fcn.004602e5
push esi
call fcn.0046013a
add esp, 0x14
lea ecx, [esp + 0x254]
mov dword [esp + 0x880], 0xffffffff
call fcn.0040c970
mov ecx, dword [esp + 0x878]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x864]
pop ebx
call fcn.0045f776
add esp, 0x874
ret