Function at 0x408ee4
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], str.Winamp.File
cmp byte [esi], bl
je 0x4092cc
push 0x44e85c
push esi
call fcn.00447c00
pop ecx
mov edi, 0x44e858
test eax, eax
pop ecx
je 0x408f27
push edi
push esi
call fcn.00447c00
pop ecx
test eax, eax
pop ecx
jne 0x408f2e
mov dword [ebp - 8], str.Winamp.PlayList
push 0x44e854
push esi
call fcn.00447c00
pop ecx
test eax, eax
pop ecx
je 0x408f50
push 0x44e850
push esi
call fcn.00447c00
pop ecx
test eax, eax
pop ecx
jne 0x408f57
mov dword [ebp - 8], str.Winamp.SkinZip
push esi
lea eax, [ebp - 0x88]
push 0x44e764
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp + 0xc], ebx
je 0x409122
push edi
push esi
call fcn.00447c00
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop ecx
test eax, eax
pop ecx
mov edi, 0x104
jne 0x408fcf
lea eax, [ebp - 0x18c]
push edi
push eax
push dword [0x4618b0]
call esi
push ebx
lea eax, [ebp - 0x18c]
push 0x44e848
push eax
push str.audio_x_scpls
call fcn.0040933e
push ebx
lea eax, [ebp - 0x18c]
push 0x44e848
push eax
push str.audio_scpls
call fcn.0040933e
add esp, 0x20
push 0x44e828
push dword [ebp + 8]
call fcn.00447c00
pop ecx
test eax, eax
pop ecx
jne 0x409025
lea eax, [ebp - 0x18c]
push edi
push eax
push dword [0x4618b0]
call esi
push 1
lea eax, [ebp - 0x18c]
push str..wma
push eax
push str.audio_x_ms_wma
call fcn.0040933e
push 1
lea eax, [ebp - 0x18c]
push str..wma
push eax
push str.application_x_msdownload
call fcn.0040933e
add esp, 0x20
push 0x44e85c
push dword [ebp + 8]
call fcn.00447c00
pop ecx
test eax, eax
pop ecx
jne 0x409079
lea eax, [ebp - 0x18c]
push edi
push eax
push dword [0x4618b0]
call esi
push ebx
lea eax, [ebp - 0x18c]
push 0x44e7ec
push eax
push str.audio_x_mpegurl
call fcn.0040933e
push ebx
lea eax, [ebp - 0x18c]
push 0x44e7ec
push eax
push str.audio_mpegurl
call fcn.0040933e
add esp, 0x20
push 0x44e7c8
push dword [ebp + 8]
call fcn.00447c00
pop ecx
test eax, eax
pop ecx
jne 0x409122
lea eax, [ebp - 0x18c]
push edi
push eax
push dword [0x4618b0]
call esi
xor edi, edi
mov esi, str..mp3
inc edi
lea eax, [ebp - 0x18c]
push edi
push esi
push eax
push str.audio_x_mpeg
call fcn.0040933e
push edi
lea eax, [ebp - 0x18c]
push esi
push eax
push str.audio_x_mp3
call fcn.0040933e
push edi
lea eax, [ebp - 0x18c]
push esi
push eax
push str.audio_x_mpg
call fcn.0040933e
push edi
lea eax, [ebp - 0x18c]
push esi
push eax
push str.audio_mp3
call fcn.0040933e
add esp, 0x40
lea eax, [ebp - 0x18c]
push edi
push esi
push eax
push str.audio_mpg
call fcn.0040933e
push edi
lea eax, [ebp - 0x18c]
push esi
push eax
push str.audio_mpeg
call fcn.0040933e
add esp, 0x20
jmp 0x409125
xor edi, edi
inc edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x88]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4092cc
cmp dword [ebp + 0xc], ebx
je 0x4091e6
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
test eax, eax
jne 0x4091ca
lea eax, [ebp - 0x88]
push eax
call fcn.0043d450
pop ecx
test eax, eax
pop ecx
je 0x4092be
lea eax, [ebp - 0x88]
push eax
call fcn.0043d4e0
pop ecx
inc eax
push eax
lea eax, [ebp - 0x88]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push edi
push ebx
push str.Winamp_Back
push dword [ebp - 4]
call esi
push dword [ebp - 8]
call fcn.0043d4e0
pop ecx
inc eax
push eax
push dword [ebp - 8]
push edi
push ebx
push ebx
push dword [ebp - 4]
call esi
jmp 0x4092be
call fcn.0043d4e0
pop ecx
inc eax
push eax
push dword [ebp - 8]
push edi
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4092be
lea eax, [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp + 0xc], 0x80
call esi
test eax, eax
jne 0x4092be
push dword [ebp - 8]
lea eax, [ebp - 0x88]
push eax
call fcn.0043d450
pop ecx
test eax, eax
pop ecx
jne 0x4092be
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push str.Winamp_Back
push dword [ebp - 4]
call esi
test eax, eax
jne 0x40927f
lea eax, [ebp - 0x88]
push eax
call fcn.0043d4e0
pop ecx
inc eax
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4092be
push str.Winamp_Back
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4092be
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
lea eax, [ebp - 0x88]
mov dword [ebp - 4], ebx
push 0x44e764
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x88]
push eax
push SysReAllocStringLen
call fcn.004092d1
add esp, 0x14
cmp dword [ebp - 4], ebx
je 0x4092cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret