Function at 0x46c2e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d87a8
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
sub esp, 0x288
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0x111
ja 0x46ca77
je 0x46c4cb
cmp eax, 0x4e
je 0x46c492
cmp eax, 0x110
jne case.0x46c98b.2389
mov esi, dword [ebp + 8]
push 0
push 0x801f
push 0x801f
push esi
mov byte [0x532978], 1
call fcn.0046c2e0
push 0x966
push esi
call fcn.004271f0
push 0x967
push esi
mov ebx, eax
call fcn.004271f0
mov dword [ebp + 8], eax
mov eax, dword [0x52fe2c]
add eax, 0x1b4
push eax
lea ecx, [ebp - 0x294]
push str._s_0
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
test ebx, ebx
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextW]
je 0x46c3b0
push 0
push 0x10966
push 0x111
push esi
mov ecx, edi
mov byte [0x532978], 0
call fcn.0046c2e0
mov byte [0x532978], 1
jmp 0x46c423
push str.ConEmu_Inside
push 0x966
push esi
call ebx
push str.shell
push 0x951
push esi
call ebx
push str.powershell__cur_console:n
push 0x952
push esi
call ebx
push str.powershell.exe
push 0x950
push esi
call ebx
mov eax, dword [0x52fe2c]
cmp dword [eax + 0x40a4], 0
je 0x46c405
mov edx, dword [eax + 0x40a4]
cmp byte [edx + 9], 0
je 0x46c405
mov eax, 1
jmp 0x46c407
xor eax, eax
push eax
push 0x95d
push esi
call fcn.0045c140
add esp, 0xc
push 0x4e5034
push 0x9af
push esi
call ebx
cmp dword [ebp + 8], 0
je 0x46c450
push 0
push 0x10967
push 0x111
push esi
mov ecx, edi
mov byte [0x532978], 0
call fcn.0046c2e0
mov byte [0x532978], 0
jmp case.0x46c98b.2389
push str.ConEmu_Here
push 0x967
push esi
call ebx
push 0x4e5034
push 0x956
push esi
call ebx
push str.cmd__cur_console:n
push 0x957
push esi
call ebx
lea eax, [ebp - 0x294]
push eax
push 0x955
push esi
call ebx
mov byte [0x532978], 0
jmp case.0x46c98b.2389
mov eax, dword [ebp + 0x14]
cmp dword [eax + 8], 0xfffffdee
jne case.0x46c98b.2389
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [0x52fe34]
push 0x4e
push edx
call fcn.0045b120
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x10]
mov eax, ebx
shr eax, 0x10
xor esi, esi
sub eax, esi
je 0x46c973
sub eax, 1
je 0x46c556
sub eax, 0x2ff
jne case.0x46c98b.2389
mov eax, 0x9af
cmp bx, ax
jne case.0x46c98b.2389
mov eax, dword [0x52fe2c]
cmp dword [eax + 0x40a4], esi
je case.0x46c98b.2389
mov ecx, dword [eax + 0x40a4]
mov eax, dword [ecx + 0xc]
cmp eax, esi
je 0x46c531
push eax
call fcn.0044c4f0
mov edx, dword [0x52fe2c]
mov eax, dword [edx + 0x40a4]
add esp, 4
mov dword [eax + 0xc], esi
mov ecx, dword [ebp + 8]
push 0x9af
push ecx
call fcn.004271f0
mov edx, dword [0x52fe2c]
mov ecx, dword [edx + 0x40a4]
add esp, 8
mov dword [ecx + 0xc], eax
jmp case.0x46c98b.2389
movzx ebx, bx
lea edx, [ebx - 0x966]
cmp edx, 1
ja case.0x46c98b.2389
cmp byte [0x532978], 0
jne case.0x46c98b.2389
mov eax, dword [ebp + 8]
push esi
push esi
push 0x147
push ebx
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edi, eax
cmp edi, esi
jl 0x46c872
mov ecx, dword [ebp + 8]
push 0
push edi
push 0x149
push ebx
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov dword [ebp + 0x14], eax
sub eax, 0xffffff80
push 2
push eax
mov dword [ebp - 0x10], eax
call fcn.0044c490
add esp, 8
cmp dword [ebp + 0x14], 0
mov esi, eax
jle 0x46c872
test esi, esi
je 0x46c872
mov edx, dword [ebp - 0x10]
push str.Directory_shell_
push edx
push esi
call fcn.00401730
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46c5f0
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2]
push eax
push edi
push 0x148
push ebx
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x24]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
mov dword [ebp - 0x24], 0
call edi
test eax, eax
jne 0x46c872
push 1
push 0x412
mov dword [ebp - 0x4c], 0x410
call fcn.0044c490
mov edx, dword [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 8
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
push esi
lea ecx, [ebp - 0x28]
push ecx
push 0
push str.Icon
push edx
mov dword [ebp + 0xc], esi
call ebx
test eax, eax
jne 0x46c67d
cmp dword [ebp - 0x28], 1
je 0x46c68f
test esi, esi
je 0x46c68f
push esi
call fcn.0044c4f0
add esp, 4
xor esi, esi
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x4fa9c0
push ecx
mov dword [ebp - 0x10], 0
call edi
test eax, eax
jne 0x46c85f
push 1
push 0x1042
mov dword [ebp - 0x2c], 0x1040
call fcn.0044c490
mov ecx, dword [ebp - 0x10]
add esp, 8
mov edi, eax
lea edx, [ebp - 0x2c]
push edx
push edi
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x1c], edi
call ebx
test eax, eax
jne 0x46c841
cmp dword [ebp - 0x28], 1
jne 0x46c841
lea ecx, [ebp - 0x48]
mov dword [ebp + 0x14], edi
mov dword [ebp - 0x30], edi
call fcn.00407080
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp + 0x14]
push ecx
mov dword [ebp - 4], 0
call fcn.00407360
add esp, 0xc
test eax, eax
jne 0x46c830
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x46c730
mov eax, dword [ebp - 0x44]
cmp word [eax], 0x2f
jne 0x46c7d7
push str._inside
push eax
call esi
test eax, eax
je 0x46c7d7
mov edx, dword [ebp - 0x44]
push 8
push 0x4edaf4
push edx
call fcn.0044d3f0
add esp, 0xc
test eax, eax
jne 0x46c779
push eax
mov eax, dword [ebp - 0x44]
add eax, 0x10
push eax
call fcn.0044c570
add esp, 8
mov dword [ebp - 0x18], eax
jmp 0x46c7d7
mov ecx, dword [ebp - 0x44]
push str._config
push ecx
call esi
test eax, eax
jne 0x46c7b3
push eax
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp + 0x14]
push eax
call fcn.00407360
add esp, 0xc
test eax, eax
jne 0x46c830
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.0044c570
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x46c7d7
mov edx, dword [ebp - 0x44]
push str._dir
push edx
call esi
test eax, eax
jne 0x46c804
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp + 0x14]
push ecx
call fcn.00407360
add esp, 0xc
test eax, eax
jne 0x46c830
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp + 0x14]
push ecx
call fcn.00407360
add esp, 0xc
test eax, eax
je 0x46c730
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.004070a0
jmp 0x46c855
mov edx, dword [ebp - 0x44]
push str._cmd
push edx
call esi
test eax, eax
jne 0x46c82a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004070a0
jmp 0x46c855
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.004070a0
jmp 0x46c855
test esi, esi
je 0x46c855
push esi
call fcn.0044c4f0
add esp, 4
mov dword [ebp + 0xc], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
jne 0x46c877
mov eax, 0x4e5034
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor edx, edx
mov ecx, 0x966
cmp si, cx
setne dl
push eax
dec edx
and edx, 0xfffffffb
add edx, 0x956
push edx
push ebx
call edi
cmp dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
jne 0x46c8ad
mov eax, 0x4e5034
push eax
xor ecx, ecx
mov eax, 0x966
cmp si, ax
setne cl
dec ecx
and ecx, 0xfffffffb
add ecx, 0x957
push ecx
push ebx
call edi
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0xc]
jne 0x46c8d7
mov eax, 0x4e5034
push eax
xor eax, eax
mov edx, 0x966
cmp si, dx
setne al
dec eax
and eax, 0xfffffffb
add eax, 0x955
push eax
push ebx
call edi
mov ecx, 0x966
cmp si, cx
mov esi, dword [ebp - 0x18]
jne 0x46c935
mov eax, esi
test esi, esi
jne 0x46c90a
mov eax, 0x4e5034
push eax
push 0x9af
push ebx
call edi
test esi, esi
je 0x46c924
cmp word [esi], 0
je 0x46c924
mov eax, 1
jmp 0x46c926
xor eax, eax
push eax
push 0x95d
push ebx
call fcn.0045c140
add esp, 0xc
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x46c945
push eax
call fcn.0044c4f0
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46c955
push eax
call fcn.0044c4f0
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x46c965
push eax
call fcn.0044c4f0
add esp, 4
test esi, esi
je case.0x46c98b.2389
push esi
jmp 0x46cdea
movzx eax, bx
add eax, 0xfffff6ad
cmp eax, 0xa
ja case.0x46c98b.2389
movzx edx, byte [eax + 0x46ce18]
jmp dword [edx*4 + 0x46ce08]
mov eax, dword [0x52fe2c]
cmp dword [eax + 0x40a4], esi
je case.0x46c98b.2389
mov ecx, dword [ebp + 8]
push ebx
push ecx
call fcn.0045c160
add esp, 8
test eax, eax
mov eax, dword [0x52fe2c]
mov ecx, dword [eax + 0x40a4]
setne dl
mov byte [ecx + 9], dl
jmp case.0x46c98b.2389
mov edx, 0x953
cmp bx, dx
sete al
push esi
movzx ecx, al
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.00464bf0
push 0
push 0x801f
push 0x801f
push esi
mov ecx, edi
call fcn.0046c2e0
mov edx, 0x954
cmp bx, dx
jne case.0x46c98b.2389
push 0
push 0x10966
push 0x111
push esi
mov ecx, edi
call fcn.0046c2e0
jmp case.0x46c98b.2389
mov eax, 0x958
cmp bx, ax
sete cl
push esi
mov esi, dword [ebp + 8]
movzx edx, cl
push edx
push 1
push esi
mov ecx, edi
call fcn.00464bf0
push 0
push 0x801f
push 0x801f
push esi
mov ecx, edi
call fcn.0046c2e0
mov eax, 0x959
cmp bx, ax
jne case.0x46c98b.2389
push 0
push 0x10967
push 0x111
push esi
mov ecx, edi
call fcn.0046c2e0
jmp case.0x46c98b.2389
sub eax, 0x801f
je 0x46cb38
sub eax, 1
jne case.0x46c98b.2389
cmp dword [ebp + 0x10], 0x8020
jne case.0x46c98b.2389
mov ebx, dword [ebp + 8]
push 0x96b
push ebx
xor esi, esi
call fcn.0045c160
add esp, 8
lea ecx, [ebp + 8]
push ecx
push 0x20019
push esi
push str.SoftwareMicrosoftCommand_Processor
push SysReAllocString
mov edi, eax
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46cb0b
mov edx, dword [ebp + 8]
push eax
push edx
call fcn.0045a750
mov esi, eax
add esp, 8
test esi, esi
je 0x46cafb
cmp word [esi], 0
je 0x46cafb
push str._GHWNDNEW
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edi, eax
neg edi
sbb edi, edi
neg edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
test esi, esi
jne 0x46cb10
mov eax, 0x4e5034
push eax
push 0x95a
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push edi
push 0x96b
push ebx
call dword [sym.imp.USER32.dll_CheckDlgButton]
test esi, esi
je case.0x46c98b.2389
push esi
jmp 0x46cdea
cmp dword [ebp + 0x10], 0x801f
jne case.0x46c98b.2389
push 2
xor ebx, ebx
push 0xffff
mov dword [ebp + 0x14], ebx
call fcn.0044c490
add esp, 8
mov dword [ebp - 0x14], eax
cmp eax, ebx
je case.0x46c98b.2389
mov edi, dword [ebp + 8]
push 0x966
push edi
call fcn.004271f0
push 0x967
push edi
mov dword [ebp + 0x10], eax
call fcn.004271f0
mov cl, byte [0x532978]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
add esp, 0x10
push ebx
push ebx
push 0x14b
push 0x966
push edi
mov dword [ebp + 0xc], eax
mov byte [ebp + 0xb], cl
mov byte [0x532978], 1
call esi
push ebx
push ebx
push 0x14b
push 0x967
push edi
call esi
lea edx, [ebp + 0x14]
push edx
push 0x20019
push ebx
push str.Directory_shell
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46cd57
mov dword [ebp - 0x10], ebx
nop
push 0x248
lea eax, [ebp - 0x294]
push ebx
push eax
call fcn.004c9b50
mov eax, dword [ebp - 0x10]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 0x294]
push edx
push eax
push ecx
mov dword [ebp - 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46cd4d
lea eax, [ebp - 0x294]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46cc30
push str.command
sub eax, edx
push 0x124
lea edx, [ebp - 0x294]
sar eax, 1
push edx
mov esi, eax
call fcn.004017b0
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
lea ecx, [ebp - 0x294]
push ecx
push edx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46cd3b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0x1c], 0x1fffa
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46cd31
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
push str._inside
xor ecx, ecx
push eax
mov word [ebp + esi*2 - 0x294], cx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edx, dword [ebp - 0x14]
push str.conemu
push edx
mov esi, eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x46cd31
lea eax, [ebp - 0x294]
push eax
mov ecx, esi
neg ecx
push ebx
sbb ecx, ecx
push 0x143
add ecx, 0x967
push ecx
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp + 0x10]
cmp esi, ebx
jne 0x46cd05
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x46cd31
push ebx
cmp esi, ebx
je 0x46cd1f
lea edx, [ebp - 0x294]
push edx
call fcn.0044c570
mov dword [ebp + 0x10], eax
jmp 0x46cd2e
lea eax, [ebp - 0x294]
push eax
call fcn.0044c570
mov dword [ebp + 0xc], eax
add esp, 8
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x200
jb 0x46cbe0
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x46cd63
mov eax, 0x4e5034
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push eax
push 0x966
push edi
call esi
cmp dword [ebp + 0x10], ebx
je 0x46cd90
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x46cd90
mov ecx, eax
push ecx
push 0x966
push edi
call fcn.0045c2f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x46cd9c
mov eax, 0x4e5034
push eax
push 0x967
push edi
call esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x46cdc0
cmp word [esi], bx
je 0x46cdc0
push esi
push 0x967
push edi
call fcn.0045c2f0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dl, byte [ebp + 0xb]
mov byte [0x532978], dl
cmp eax, ebx
je 0x46cdd9
push eax
call fcn.0044c4f0
add esp, 4
cmp esi, ebx
je 0x46cde6
push esi
call fcn.0044c4f0
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call fcn.0044c4f0
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10