Function at 0x405258
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x190
cmp dword [0x47b49c], 0
mov dword [ebp + 0x68], str.Winamp.File
jne 0x405728
push esi
mov esi, dword [ebp + 0x78]
cmp byte [esi], 0
je 0x405727
push ebx
mov ebx, dword [sym.imp.NSCRT.dll__stricmp]
push 0x468398
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x405726
push edi
push 0
push esi
call fcn.004026c1
mov edi, eax
push edi
call fcn.00431882
push edi
mov dword [ebp + 0x64], eax
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x10
cmp dword [ebp + 0x64], 0
je 0x4052c8
mov dword [ebp + 0x68], str.Winamp.PlayList
push 0x468394
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4052f2
push 0x468390
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4052f2
push 0x46838c
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x4052f9
mov dword [ebp + 0x68], str.Winamp.SkinZip
push esi
mov esi, 0x80
push 0x4683c8
mov eax, esi
lea edi, [ebp - 0x1c]
call fcn.0040258b
xor edi, edi
cmp dword [ebp + 0x7c], edi
pop ecx
pop ecx
je 0x4055c0
push 0x468388
push dword [ebp + 0x78]
call ebx
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop ecx
pop ecx
mov edi, 0x104
jne 0x405391
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
push 0
push 0x468380
lea eax, [ebp - 0x120]
push eax
push str.video_x_asx
call fcn.0040572d
push 0
push 0x468380
lea eax, [ebp - 0x120]
push eax
push str.video_asx
call fcn.0040572d
push 0
push 0x468380
lea eax, [ebp - 0x120]
push eax
push str.video_x_ms_asf
call fcn.0040572d
add esp, 0x30
push 0x468390
push dword [ebp + 0x78]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x4053cc
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
push 0
push str..wal
lea eax, [ebp - 0x120]
push eax
push str.interface_x_winamp3_skin
call fcn.0040572d
add esp, 0x10
push 0x468394
push dword [ebp + 0x78]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x405407
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
push 0
push str..wsz
lea eax, [ebp - 0x120]
push eax
push str.interface_x_winamp_skin
call fcn.0040572d
add esp, 0x10
push 0x468330
push dword [ebp + 0x78]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x40545a
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
push 0
push 0x468328
lea eax, [ebp - 0x120]
push eax
push str.audio_x_scpls
call fcn.0040572d
push 0
push 0x468328
lea eax, [ebp - 0x120]
push eax
push str.audio_scpls
call fcn.0040572d
add esp, 0x20
push 0x468308
push dword [ebp + 0x78]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x4054ad
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
push 1
push 0x468300
lea eax, [ebp - 0x120]
push eax
push str.audio_x_ms_wma
call fcn.0040572d
push 1
push 0x468300
lea eax, [ebp - 0x120]
push eax
push str.application_x_msdownload
call fcn.0040572d
add esp, 0x20
push 0x4682d0
push dword [ebp + 0x78]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x405500
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
push 0
push 0x4682c8
lea eax, [ebp - 0x120]
push eax
push str.audio_x_mpegurl
call fcn.0040572d
push 0
push 0x4682c8
lea eax, [ebp - 0x120]
push eax
push str.audio_mpegurl
call fcn.0040572d
add esp, 0x20
push 0x4682a4
push dword [ebp + 0x78]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x4055a4
push edi
lea eax, [ebp - 0x120]
push eax
push dword [0x480940]
call esi
xor edi, edi
inc edi
push edi
mov esi, str..mp3
push esi
lea eax, [ebp - 0x120]
push eax
push str.audio_x_mpeg
call fcn.0040572d
push edi
push esi
lea eax, [ebp - 0x120]
push eax
push str.audio_x_mp3
call fcn.0040572d
push edi
push esi
lea eax, [ebp - 0x120]
push eax
push str.audio_x_mpg
call fcn.0040572d
push edi
push esi
lea eax, [ebp - 0x120]
push eax
push str.audio_mp3
call fcn.0040572d
add esp, 0x40
push edi
push esi
lea eax, [ebp - 0x120]
push eax
push str.audio_mpg
call fcn.0040572d
push edi
push esi
lea eax, [ebp - 0x120]
push eax
push str.audio_mpeg
call fcn.0040572d
add esp, 0x20
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, 0x80
xor edi, edi
jmp 0x4055d3
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, edi
jne 0x405725
cmp dword [ebp + 0x7c], edi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
push dword [ebp + 0x6c]
mov dword [ebp + 0x64], esi
je 0x40566b
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp + 0x68]
jne 0x40564e
lea eax, [ebp - 0x1c]
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x405717
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x1c]
push eax
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
push str.Winamp_Back
push dword [ebp + 0x6c]
call ebx
push dword [ebp + 0x68]
call esi
inc eax
push eax
push dword [ebp + 0x68]
push 1
push edi
push edi
push dword [ebp + 0x6c]
call ebx
jmp 0x405717
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x68]
push 1
push edi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x405717
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebx
test eax, eax
jne 0x405717
push dword [ebp + 0x68]
lea eax, [ebp - 0x1c]
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x405717
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push str.Winamp_Back
push dword [ebp + 0x6c]
mov dword [ebp + 0x64], esi
call ebx
test eax, eax
jne 0x4056dd
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x405717
push str.Winamp_Back
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x405717
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x78]
mov dword [ebp + 0x6c], edi
push 0x4683c8
mov eax, esi
lea edi, [ebp - 0x1c]
call fcn.0040258b
mov eax, edi
push eax
push SysReAllocString
call fcn.0040511f
add esp, 0x10
xor edi, edi
cmp dword [ebp + 0x6c], edi
je 0x405725
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
add ebp, 0x70
leave
ret