Function at 0x432bef
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x442c07
call fcn.0041e7a1
mov edi, ecx
test dword [0x47a0c0], 0x200
je 0x432c20
push edi
push 0x409258
push dword [0x47a0cc]
push dword [0x47a0c8]
call fcn.00427501
xor ebx, ebx
mov byte [0x47a168], 1
cmp dword [edi + 0x5c], ebx
je 0x432c38
push 0x1c084d
call fcn.00419830
cmp byte [edi + 0x13b], bl
je 0x432c4a
push 0x1c084e
call fcn.00419830
mov byte [edi + 0x13b], bl
cmp dword [edi + 0x38], ebx
je 0x432c5f
push 0x1c084f
call fcn.00419830
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x30
pop esi
push esi
mov dword [edi + 0x38], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0x4334af
mov dword [ebp - 0x38], 0x409024
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test ax, ax
jne 0x432ca6
mov ebx, 0x80004005
jmp 0x433186
push ebx
mov byte [edi + 0x138], 1
call fcn.00434c3a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x40a1d8
push 0x80000001
call esi
test eax, eax
jne 0x432d0e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x40a180
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x432d00
mov dword [ebp - 0x14], 0x3a98
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x432d13
mov eax, 0x3a98
mov ecx, 0x2710
mov dword [edi + 0x238], eax
cmp eax, ecx
jae 0x432d28
mov dword [edi + 0x238], ecx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x40a1d8
push 0x80000001
call esi
test eax, eax
jne 0x432d7e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x40a238
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x7530
test eax, eax
je 0x432d70
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x432d85
mov esi, 0x7530
mov eax, esi
mov dword [edi + 0x234], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x40a1d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432de0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x40a290
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x432dd2
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x432de2
mov eax, ebx
mov dword [edi + 0x23c], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x40a1d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432e3d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x40a2d8
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x432e2f
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x432e3f
mov eax, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x8000000
mov dword [edi + 0x240], eax
mov eax, 0x409024
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x5c], eax
test eax, eax
je 0x432c9c
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x40a358
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432ebe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x40a320
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x432eb2
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x40a358
push 0x80000001
mov dword [edi + 0x190], esi
mov dword [edi + 0x194], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432f23
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x40a3a8
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x432f15
mov dword [ebp - 0x10], 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x432f28
mov eax, 0x1f4
mov dword [edi + 0x188], eax
mov dword [edi + 0x18c], ebx
cmp byte [0x478d0c], bl
je 0x432fa3
push ebx
push dword [edi + 0x5c]
call fcn.0043319e
test al, al
je 0x432c9c
mov eax, dword [edi + 0x190]
cmp dword [edi + 0x194], ebx
ja 0x43303c
jb 0x432f6a
cmp eax, 0xffffffff
ja 0x43303c
push 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xfff
pop eax
cmp byte [edi + 0x13c], bl
je 0x432f84
mov eax, 0x105
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0043ceee
add esp, 0x10
test eax, eax
jne 0x432fa3
push 0x1c0852
call fcn.00419830
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0xffffffffffffffeb
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x432fc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x432c9c
push 7
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 0x2710
pop eax
cmp byte [edi + 0x13c], bl
je 0x432fe6
mov eax, 0x107
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0043ceee
add esp, 0x10
test eax, eax
jne 0x43300c
push 0x1c0853
call fcn.00419830
mov ecx, edi
call fcn.0043431c
push edi
lea ecx, [ebp - 0x30]
call fcn.00434b1c
mov dword [ebp - 4], ebx
cmp dword [edi + 0x60], ebx
je 0x43304b
cmp dword [edi + 0x64], ebx
je 0x43304b
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00433c2b
mov eax, dword [ebp - 0x30]
shr eax, 0xb
test al, 1
je 0x433041
mov eax, dword [edi + 0x60]
jmp 0x433044
call fcn.00430e64
mov eax, dword [edi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
mov word [edi + 0x139], 0x101
call fcn.00434b48
mov esi, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push ebx
call esi
push 1
mov dword [edi + 0x198], eax
call esi
mov dword [edi + 0x19c], eax
cmp dword [edi + 0x198], ebx
je 0x433085
test eax, eax
jne 0x43308f
push 0x1c0854
call fcn.00419830
mov eax, dword [edi + 0x198]
test eax, eax
je 0x433130
cmp dword [edi + 0x19c], ebx
je 0x43312e
push 0x10
call fcn.00421653
test eax, eax
je 0x4330c0
push edi
mov ecx, eax
call fcn.004349c2
mov esi, eax
jmp 0x4330c2
mov esi, ebx
test esi, esi
jne 0x4330f6
push 0x1c0855
call fcn.00419830
mov eax, dword [edi + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x4330e7
push 0x1c0856
call fcn.00419830
test esi, esi
je 0x433154
lea eax, [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x433154
mov edx, dword [edi + 0x58]
lea eax, [edi + 0x1a0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [edx]
lea ecx, [esi + 8]
push ecx
push 0x2101
push edx
call dword [eax + 0x14]
test eax, eax
js 0x4330d0
mov eax, dword [edi + 0x1a0]
mov ecx, dword [eax]
push 0xffffffffffffffff
push dword [edi + 0x198]
push eax
call dword [ecx + 0x6c]
jmp 0x4330e7
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x433141
push eax
call esi
mov dword [edi + 0x198], ebx
mov eax, dword [edi + 0x19c]
test eax, eax
je 0x433154
push eax
call esi
mov dword [edi + 0x19c], ebx
push dword [0x47a0a0]
push ebx
push 0x434c8f
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x244], eax
test eax, eax
jne 0x433186
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x433186
push 0x24a759
call fcn.00419830
cmp byte [edi + 0x13a], 0
jne 0x433196
mov ecx, edi
call fcn.0043298b
mov eax, ebx
call fcn.0041e879
ret