Function at 0x417a90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bc266
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4e5a68]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e5a68]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor esi, esi
push 0xfe
lea eax, [esp + 0x62]
push esi
push eax
mov word [esp + 0x68], si
call fcn.00432df0
push 0xfe
lea ecx, [esp + 0x16e]
push esi
push ecx
mov word [esp + 0x174], si
call fcn.00432df0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x18
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x417b60
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
push 0x4c13f8
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], pe_nt_image_headers32
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
jne 0x417bb1
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push str.registration_code
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], pe_nt_image_headers32
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x417d18
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x417d18
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x60]
push edx
mov eax, edx
push eax
push 0xafd
call fcn.0040ceb0
add esp, 0x10
test eax, eax
je 0x417d18
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00405e70
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x28]
push edx
mov ecx, 0x4f0fd8
mov dword [esp + 0x274], esi
call fcn.00405120
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x268], 0xffffffff
jb 0x417c45
mov eax, dword [esp + 0x24]
push eax
call fcn.00431ad1
add esp, 4
lea ecx, [esp + 0x15c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00405e70
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x28]
push edx
mov ecx, 0x4f0ff4
mov dword [esp + 0x274], 1
call fcn.00405120
cmp dword [esp + 0x38], 0x10
jb 0x417c87
mov eax, dword [esp + 0x24]
push eax
call fcn.00431ad1
add esp, 4
lea ecx, [esp + 0x14]
push ecx
xor eax, eax
push 0x20019
push esi
push str.SoftwarePdaNetAndroid
push connect
mov word [esp + 0x50], si
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov dword [esp + 0x62], eax
mov dword [esp + 0x66], eax
mov dword [esp + 0x6a], eax
mov word [esp + 0x6e], ax
call edi
test eax, eax
jne 0x417cfd
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push str.data
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], pe_nt_image_headers32
call ebx
mov eax, dword [esp + 0x14]
push eax
call ebp
push str.9600
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x417d18
mov eax, 1
jmp 0x417d1a
xor eax, eax
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0043236c
add esp, 0x258
ret