Function at 0x461590
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
push 0x2b8
mov eax, 0x4aff5d
call fcn.004a7770
mov dword [ebp - 0x2c0], edx
xor edi, edi
mov dword [ebp - method.CKANRegisterKey.virtual_0], vtable.CKANRegisterKey.0
mov dword [ebp - 0x2b4], edi
push 0x200
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x2ac]
call fcn.0040d765
mov esi, str.operation_
mov byte [ebp - 4], 1
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2ac]
call fcn.0040d7bf
mov dword [ebp - 0x2a8], 0x9310b022
mov esi, 0xf570b9cc
mov dword [ebp - 0x2a4], 0x3388ecd
mov edx, 0x7e2730cc
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x2a8], 0x935f07b1
mov dword [ebp - 0x2a4], 0xe46bd214
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x2a8], 0x593c1887
mov dword [ebp - 0x2a4], 0xa04e583c
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x2a8], 0xa117aebf
mov dword [ebp - 0x2a4], 0xdb7dc50f
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x2a8], 0xb7c039e1
mov dword [ebp - 0x2a4], 0x167987e6
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x2a8], 0xd1ee8e4e
mov dword [ebp - 0x2a4], 0x9e998324
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x2a8], 0xa9efbbbd
mov dword [ebp - 0x2a4], 0xee87b642
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a4], edx
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x2a8], 0x937fb051
mov dword [ebp - 0x2a4], 0x34c8eab
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0x933e07c6
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x2a4], 0xe40ed266
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0x595718db
mov dword [ebp - 0x2a4], 0xa0205855
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x254], ecx
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0xa164aed8
mov dword [ebp - 0x2a4], 0xdb1bc560
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x24c], ecx
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0xb79c3995
mov dword [ebp - 0x2a4], 0x16178787
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x244], ecx
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0xd1878e3a
mov dword [ebp - 0x2a4], 0x9ef08352
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x23c], ecx
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0xa99abbcf
mov dword [ebp - 0x2a4], 0xee87b631
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x234], ecx
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x2a4], edx
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
movaps xmm1, xmmword [ebp - 0x2a0]
pxor xmm1, xmmword [ebp - 0x260]
movaps xmmword [ebp - 0x2a0], xmm1
movaps xmm1, xmmword [ebp - 0x290]
pxor xmm1, xmmword [ebp - 0x250]
movaps xmmword [ebp - 0x290], xmm1
movaps xmm1, xmmword [ebp - 0x280]
pxor xmm1, xmmword [ebp - 0x240]
movaps xmmword [ebp - 0x280], xmm1
movaps xmm1, xmmword [ebp - 0x270]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 0x2b0]
pxor xmm1, xmmword [ebp - 0x230]
push eax
movaps xmmword [ebp - 0x270], xmm1
call fcn.0040d6dc
push ecx
push 1
push dword [eax]
push ecx
lea ecx, [ebp - 0x2b8]
call fcn.00433e4c
mov ecx, dword [ebp - 0x2b0]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0040bb70
test esi, esi
je 0x461a75
mov esi, str.ScrCap_IsShowFloatWinTip
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2ac]
call fcn.0040df19
mov dword [ebp - 0x2b0], edi
cmp dword [ebp - 0x2b4], edi
je 0x461a75
mov esi, dword [ebp - 0x2ac]
test esi, esi
je 0x461a7f
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 0x200
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2bc]
push eax
push edi
push esi
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x2bc], 1
jne 0x461a7f
test eax, eax
jne 0x4619c8
mov word [ebp - 0x1a], ax
jmp 0x461a4f
mov eax, dword [ebp - 0x2a4]
add eax, 2
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x461a7d
lea eax, [ebp - 0x2a4]
push eax
push edi
lea eax, [ebp - 0x2bc]
push eax
push 0
push esi
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x461a3e
mov eax, dword [ebp - 0x2a4]
xor ecx, ecx
shr eax, 1
push 0xff
push edi
push 0x100
mov word [edi + eax*2], cx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov dword [ebp - 0x2b0], 1
xor eax, eax
mov word [ebp - 0x1a], ax
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [ebp - 0x2b0], 0
pop ecx
je 0x461a7d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040d7bf
xor edi, edi
inc edi
jmp 0x461a7f
mov esi, dword [ebp - 0x2ac]
jmp 0x461a7f
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.0040bb70
cmp dword [ebp - 0x2b4], 0
mov dword [ebp - method.CKANRegisterKey.virtual_0], vtable.CKANRegisterKey.0
je 0x461aa6
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.004a774e
ret