Function at 0x401ed0
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x4a8]
sub esp, 0x4a8
push 0xffffffffffffffff
push 0x438400
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4495f8]
xor eax, ebp
mov dword [ebp + 0x4a4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
call fcn.00408535
mov eax, dword [esi + 0xbc]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [esi + 0x20]
push 1
push 0x80
push eax
call edi
mov eax, dword [esi + 0xbc]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0x80
push ecx
call edi
cmp dword [0x44aaa4], 0
mov dword [ebp - 4], 0
jne 0x401f66
call fcn.00401a50
cmp dword [0x44aaa4], 0
je 0x4021fa
push 0x94
lea edx, [ebp]
push 0
mov ebx, 1
push edx
mov edi, ebx
call fcn.004228d0
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 0x10], 2
jbe 0x401f9b
xor ebx, ebx
xor edi, edi
push 0x44aaa0
push 0x43fb1c
push 1
push 0
push 0x43fa6c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esi + 0x20]
push 0
push 0x1f4
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
je 0x401fcf
mov byte [esi + 0x74], 1
mov ecx, dword [0x44aaa4]
lea edx, [ebp - 0x14]
push edx
test edi, edi
je 0x40204b
lea eax, [ebp + 0x29c]
push eax
push 0
push 0
push str.ExePath
push ecx
mov dword [ebp - 0x14], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4020b3
lea edx, [ebp + 0x29c]
push 0x5c
push edx
call fcn.0042368d
add esp, 8
test eax, eax
je 0x4020b3
lea edx, [ebp + 0x29c]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [ebp + 0x94]
push str._sidmmkb.dll
push eax
call fcn.00401780
add esp, 0xc
lea ecx, [ebp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x4020ad
lea eax, [ebp + 0x198]
push eax
push 0
push 0
push 0x43aa84
push ecx
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4020b3
lea edx, [ebp + 0x198]
push 0x5c
push edx
call fcn.00423660
add esp, 8
test eax, eax
je 0x4020b3
mov byte [eax], 0
lea eax, [ebp + 0x198]
push eax
lea ecx, [ebp + 0x3a0]
push 0x43aa74
push ecx
call fcn.0042294a
add esp, 0xc
lea edx, [ebp + 0x3a0]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xb0], eax
cmp dword [esi + 0xb0], 0
jne 0x4020cd
push str.idmmkb.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xb0], eax
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x4021ed
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NeedForce
push eax
call edi
mov dword [0x44aa88], eax
mov eax, dword [esi + 0xb0]
push str.InstallMouseHook
push eax
call edi
mov dword [0x44aa94], eax
mov ecx, dword [esi + 0xb0]
push str.RemoveMouseHook
push ecx
call edi
mov dword [0x44aa90], eax
test ebx, ebx
je 0x402148
mov ecx, dword [0x44aa94]
test ecx, ecx
je 0x4021f3
test eax, eax
je 0x4021f3
cmp dword [0x44aa88], 0
je 0x4021f3
call ecx
mov dword [esi + 0xb8], eax
jmp 0x4021f3
mov edx, dword [esi + 0xb0]
push str.InstallHook
push edx
call edi
mov dword [0x44aa9c], eax
mov eax, dword [esi + 0xb0]
push str.RemoveHook
push eax
call edi
mov dword [0x44aa98], eax
mov ecx, dword [esi + 0xb0]
push str.NeedPrevent
push ecx
call edi
mov ecx, dword [0x44aa9c]
mov dword [0x44aa8c], eax
test ecx, ecx
je 0x4021a8
cmp dword [0x44aa98], 0
je 0x4021a8
test eax, eax
jne 0x4021a0
cmp dword [0x44aa88], eax
je 0x4021a8
call ecx
mov dword [esi + 0xb4], eax
mov eax, dword [0x44aa94]
test eax, eax
je 0x4021f3
cmp dword [0x44aa90], 0
je 0x4021f3
call eax
mov dword [esi + 0xb8], eax
jmp 0x4021f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 4
push 0
mov ecx, esi
call fcn.004104b8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4a4]
xor ecx, ebp
call fcn.00422396
add ebp, 0x4a8
mov esp, ebp
pop ebp
ret