Function at 0x41ed50
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431b06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x10b4
call fcn.00424090
mov dword [ebp - 0x10c0], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x41ed88
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x41ed99
mov edx, dword [ebp - 0x10c0]
mov dword [edx], 0xffffffff
jmp 0x41f381
lea eax, [ebp - 0x10]
push eax
push 0
push str.BE5369BF50ACC2BD7AAFFDBC0B3A517ECE842CDFC6D9
call fcn.00422d00
add esp, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x420], eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00422810
add esp, 8
push eax
push str.Software_s
lea eax, [ebp - 0x414]
push eax
call fcn.00423db8
add esp, 0xc
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x418]
push edx
push 0
push 0xf003f
push 0
push 0x435780
push 0
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x420], 0
jne 0x41eeda
mov edx, dword [ebp - 0x10c0]
mov eax, dword [ebp - 0x418]
mov dword [edx], eax
mov dword [ebp - 0x41c], 2
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x830], 0x400
mov dword [ebp - 0x1020], 0x7d0
lea ecx, [ebp - 0x1020]
push ecx
lea edx, [ebp - 0x101c]
push edx
lea eax, [ebp - 0x1024]
push eax
push 0
lea ecx, [ebp - 0x830]
push ecx
lea edx, [ebp - 0x82c]
push edx
mov eax, dword [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x41eebe
mov edx, dword [ebp - 0x1024]
push edx
mov eax, dword [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x82c]
push edx
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3a0
mov eax, dword [ebp - 0x428]
add eax, 1
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x424], 0
je 0x41ee3e
cmp dword [ebp - 0x41c], 1
jne 0x41f00b
mov ecx, dword [ebp - 0x10c0]
mov edx, dword [ebp - 0x418]
mov dword [ecx], edx
cmp dword [ebp + 0x10], 0
je 0x41ef00
jmp 0x41f381
push 0
push 0x435784
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0xffffffffffffffff
push 0x435788
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0
push 0x43578c
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0
push 0x435790
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 3
push 0x435794
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 1
push 0x435798
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x47
mov ecx, 0x46e9a8
call fcn.00421660
push eax
push 0x43579c
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3f0
push 0x3c
mov ecx, 0x46e9a8
call fcn.00421660
push eax
push 0x4357a0
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3f0
mov byte [0x46e328], 0
mov byte [0x46e368], 0
push 3
push 0x46e288
call fcn.00423b90
add esp, 4
add eax, 1
push eax
push 0x46e288
push 0x4357a4
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3a0
push 0x4357a8
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f4a0
mov dword [0x46e308], eax
push 0x4357ac
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f4a0
mov dword [0x45a32c], eax
jmp 0x41f230
cmp dword [ebp - 0x41c], 2
jne 0x41f230
mov eax, dword [ebp - 0x10c0]
mov ecx, dword [ebp - 0x418]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x41f031
jmp 0x41f381
push 1
push 0x4357b0
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x4357b4
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
je 0x41f069
push 0xa
push 0x4357b8
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 3
push 0x4357bc
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
lea ecx, [ebp - 0x1038]
call fcn.0041fca0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1030]
call fcn.0041fca0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x1038]
push edx
push 0x4357c0
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f510
lea eax, [ebp - 0x1030]
push eax
push 0x4357c4
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f510
cmp dword [ebp - 0x1038], 0
je 0x41f0f0
push 0x40
mov ecx, dword [ebp - 0x1038]
push ecx
push 0x46e328
call fcn.00423e80
add esp, 0xc
mov byte [0x46e367], 0
cmp dword [ebp - 0x1030], 0
je 0x41f116
push 0x40
mov edx, dword [ebp - 0x1030]
push edx
push 0x46e368
call fcn.00423e80
add esp, 0xc
mov byte [0x46e3a7], 0
push 0x4357c8
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f4a0
mov dword [0x46e308], eax
mov dword [ebp - 0x1028], 0x80
push 0
push 0
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x10bc]
push ecx
push 0x4357cc
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f5d0
test eax, eax
jne 0x41f17d
cmp dword [ebp - 0x10bc], 0
je 0x41f178
lea edx, [ebp - 0x10bc]
push edx
push 0x46e288
call fcn.00423c20
add esp, 8
jmp 0x41f20f
push 3
push 0x46e288
call fcn.00423b90
add esp, 4
add eax, 1
push eax
push 0x46e288
push 0x4357d0
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3a0
test eax, eax
je 0x41f1c4
push 0
push 0x4357d4
push 0x4357e8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00423b4b
mov dword [ebp - 0x1028], 0x80
push 0
push 0
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x10bc]
push ecx
push 0x4357f4
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f5d0
test eax, eax
je 0x41f20f
push 0
push str.Unable_to_proceed
push str.RBTU_Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00423b4b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1030]
call fcn.0041fda0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.0041fda0
push 0x435818
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f256
push 0
push 0x43581c
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x435820
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f27c
push 0xffffffffffffffff
push 0x435824
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x435828
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f2a2
push 0
push 0x43582c
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x435830
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f2c8
push 0
push 0x435834
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x435838
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f2ee
push 3
push 0x43583c
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x435840
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f314
push 1
push 0x435844
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f450
push 0x435848
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f350
push 3
push 0x46e288
call fcn.00423b90
add esp, 4
add eax, 1
push eax
push 0x46e288
push 0x43584c
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3a0
push 0x435850
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f9d0
test eax, eax
jne 0x41f381
push 0x3c
mov ecx, 0x46e9a8
call fcn.00421660
push eax
push 0x435854
mov ecx, dword [ebp - 0x10c0]
call fcn.0041f3f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc