Function at 0x4012b0
Capabilities:
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
sub esp, 0x110
mov eax, dword [0x44c7f0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
push esi
push edi
mov ebp, 0xc8
push ebp
lea eax, [esp + 0x4c]
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], ebp
call fcn.00425200
add esp, 0xc
push 0
mov byte [esp + 0x13], 0
call fcn.00423a95
add esp, 4
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea ecx, [esp + 0x14]
push ecx
push 3
push 0
push str.SoftwareMicrosoftActiveMovie
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push str.sysVal1
push ecx
mov dword [esp + 0x28], ebp
call edi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push str.sysVal1
push ecx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
je 0x401393
call esi
mov edx, dword [esp + 0x14]
push 2
push 0x442184
push 1
push 0
push str.sysVal1
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push str.sysVal2
push edx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
je 0x401418
push ebp
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.00425200
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00423ae6
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x38]
push 0xa
lea ecx, [esp + 0x54]
push ecx
push eax
call fcn.004396bc
lea eax, [esp + 0x5c]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013f5
sub eax, edx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push 1
push 0
push str.sysVal2
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
lea ecx, [esp + 0x4c]
push 0
push ecx
call fcn.00425200
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push str.sysVal2
push ecx
mov dword [esp + 0x28], ebp
call edi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00423ae6
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0x50]
not esi
and esi, dword [esp + 0x38]
push ecx
call fcn.004238fb
add esp, 0xc
cmp eax, esi
je 0x401477
mov byte [esp + 0xf], 1
push ebp
lea edx, [esp + 0x4c]
push 0
push edx
call fcn.00425200
mov edx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push str.sysVal1
push edx
mov dword [esp + 0x28], ebp
call edi
mov ecx, 0x442324
lea eax, [esp + 0x48]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4014d0
test dl, dl
je 0x4014cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4014d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4014b0
xor eax, eax
jmp 0x4014d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4014ef
push eax
push eax
push 0x4421a4
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 3
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea eax, [esp + 0x48]
push eax
call fcn.004238fb
add esp, 4
cmp byte [esp + 0xf], 0
mov esi, eax
je 0x401506
dec esi
test esi, esi
jge 0x40150c
xor esi, esi
push 0xa
lea ecx, [esp + 0x4c]
push ecx
push esi
call fcn.004396bc
lea eax, [esp + 0x54]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401523
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push 1
push 0
push str.sysVal1
push eax
call edi
test esi, esi
jne 0x40157a
lea ecx, [esp + 0x20]
push ecx
push 2
push esi
push str.SoftwareMicrosoftActiveMovie
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x20]
push 2
push 0x442184
push 1
push esi
push str.sysVal21
push edx
call edi
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004238d6
add esp, 0x110
ret