Function at 0x424060
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x474e6e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [0x48e540]
push 0
push 0xc
call edi
push eax
push 0xb
call edi
mov ebx, dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push 0x80
push esi
call ebx
mov esi, dword [ebp + 8]
push eax
push 1
mov dword [esi + 0x8c8], eax
mov eax, dword [esi + 4]
push 0x80
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x48e540]
push 0
push 0x32
mov dword [esp + 0x20], ecx
call edi
push eax
push 0x31
call edi
mov edx, dword [esp + 0x20]
push eax
push 1
push 0x80
push edx
call ebx
push eax
push 0
mov dword [esi + 0x8cc], eax
mov eax, dword [esi + 4]
push 0x80
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 4]
mov dword [0x48ffc4], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [0x491824]
add ebx, 0x10
push ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x490038]
lea ecx, [esp + 0x18]
call fcn.00450260
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esi, 0x90
mov dword [esp + 0x18], esi
lea esi, [edi + 4]
lea ebx, [esp + 0x18]
call fcn.00452a00
mov esi, dword [ebp + 8]
lea edi, [esi + 0x94]
xor ebx, ebx
lea ecx, [esi + 0x24]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 4], 3
mov dword [edi + 8], 0x8006
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov edx, dword [ecx]
mov eax, dword [edx]
push edi
call eax
mov edx, dword [edi]
mov ecx, edi
mov eax, dword [edx + 8]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push ebx
push ebx
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
push ebx
push ebx
mov ecx, edi
call eax
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x9d14
mov dword [esp + 0x44], ebx
call fcn.00454520
mov ecx, eax
add esp, 4
cmp ecx, ebx
je 0x4241f0
lea edx, [esp + 0x14]
push edx
mov eax, 0x9d14
call fcn.00454600
mov dword [esp + 0x40], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x424223
mov ecx, eax
lea edx, [ecx + 2]
mov dword [esp + 0x18], edx
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x424210
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov ebx, ecx
push eax
lea eax, [esi + 0xcc]
call fcn.00454860
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424257
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test byte [edi + 4], 2
mov ebx, 0x4918f0
mov dword [edi + 0x34], ebx
je 0x424290
call fcn.00457c80
mov ecx, dword [0x491900]
mov ebx, dword [edi + 0x34]
mov dword [esp + 0x18], ecx
call fcn.00457c80
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx + 0xc]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
push eax
push ebx
push edi
call edx
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x4242a5
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push 0
push 0
push 0
push edi
call edx
mov eax, dword [esi + 4]
push ecx
mov ecx, esp
push 0
push 0x50000000
push ecx
mov dword [ecx], 0
mov ecx, esp
push eax
push str.STATIC
lea edi, [esi + 0x11c]
push edi
mov dword [ecx], 0
call fcn.00445fe0
push esi
call fcn.00424ba0
cmp dword [0x48ffdc], 0
je 0x4242ff
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
mov edx, dword [edi]
mov dword [0x48ffd4], ecx
mov dword [0x48ffd0], edx
mov ebx, dword [esi + 4]
mov edi, 0x490608
call fcn.0043f640
xor ebx, ebx
cmp eax, ebx
mov eax, dword [0x48ffd0]
jne 0x42432f
cmp dword [0x48ffdc], ebx
jne 0x42432f
cmp dword [0x48ffd4], ebx
jne 0x42432f
cmp eax, ebx
je 0x42455f
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
test eax, eax
je 0x4243b7
mov ecx, dword [0x48ffd4]
push ecx
call edi
test eax, eax
je 0x4243b7
mov eax, dword [0x48ffd0]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x700
call fcn.004607ac
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], 2
cmp eax, ebx
je 0x42437f
push eax
call fcn.0040e3f0
jmp 0x424381
xor eax, eax
push ecx
mov dword [esp + 0x44], 0xffffffff
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov dword [ecx], ebx
mov ecx, esp
lea edx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x20], esp
mov dword [ecx], edx
call fcn.00427b00
xor edx, edx
mov esi, 0x490608
call fcn.00449bf0
jmp 0x4245f4
call fcn.0045c8c0
test eax, eax
jne 0x42455f
call fcn.00437880
test eax, eax
je 0x4244cd
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push ecx
mov dword [eax], ebx
mov eax, esp
add esi, 0x124
mov dword [esp + 0x20], esp
mov dword [eax], ebx
call fcn.00427a50
push str.lastreboottime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x40], 3
movzx ecx, word [esp + 0x2a]
movzx edx, word [esp + 0x26]
movzx eax, word [esp + 0x24]
push ecx
push edx
push eax
push 0x47abe8
lea edi, [esp + 0x24]
call fcn.004543e0
add esp, 0x10
call fcn.00437880
mov esi, dword [esp + 0x14]
test eax, eax
je 0x42446e
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax]
push ecx
push esi
push 1
push str.aiRestore
jmp 0x424486
call fcn.004403e0
test eax, eax
je 0x424496
mov eax, dword [esi - 0xc]
lea edx, [eax + eax]
push edx
push esi
push 1
push str.aiRestore0
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, 0x49139c
call fcn.0044b420
lea eax, [esi - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4245f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4245f4
push 0x49139c
call fcn.004376b0
cmp dword [0x490c34], ebx
jne 0x4244f2
mov ecx, dword [esi + 4]
push ebx
push ebx
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x424618
call fcn.0044b3e0
test eax, eax
je 0x42450e
mov edx, dword [esi + 4]
push ebx
push ebx
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x424618
mov edi, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], edi
cmp dword [0x48ffe0], ebx
je 0x424572
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.lastpopwndtime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x30], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
call fcn.00461565
sub eax, dword [esp + 0x18]
add esp, 4
cmp eax, 0x708
jae 0x4245b0
mov eax, dword [esi + 4]
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x424618
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push str.lastpopwndtime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x38], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
call fcn.00461565
sub eax, dword [esp + 0x18]
add esp, 4
cmp eax, 0x78
jb 0x4244df
push 0xb90
call fcn.004607ac
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], edi
cmp eax, ebx
je 0x4245d1
push eax
call fcn.00417280
jmp 0x4245d3
xor eax, eax
push ecx
mov dword [esp + 0x44], 0xffffffff
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov dword [ecx], ebx
mov ecx, esp
mov esi, eax
mov dword [esp + 0x20], esp
mov dword [ecx], ebx
call fcn.00427b60
mov edi, dword [ebp + 8]
mov edx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 1
push edx
call esi
mov eax, dword [edi + 4]
push 0
push 0x32
push 2
push eax
call esi
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4