Function at 0x435270
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0x42
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x14], 0x49
mov dword [ebp - 0x38], 0x48
mov dword [ebp - 0x60], 0x21
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x4c], 0x55
mov dword [ebp - 8], 0x19
mov dword [ebp - 4], 0x5c
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x24], 0xe
mov dword [ebp - 0x18], 0x5e
mov dword [ebp - 0x50], 0x5c
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x28], 0x33
mov dword [ebp - 0x64], 0x5e
mov dword [ebp - 0x68], 0x1e
mov dword [ebp - 0x58], 0x42
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x54], 0x41
mov dword [ebp - 0x20], 0x25
mov dword [ebp - 0x5c], 0x12
mov dword [ebp - 0x6c], 0x13
mov dword [ebp - 0x2c], 0x4f
mov dword [ebp - 0x70], 0x3c
mov eax, dword [ebp - 0x10]
add eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x38]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x60]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x34]
xor edx, dword [ebp - 0x10]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
or ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x50]
or edx, dword [ebp - 4]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x48]
and eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x64]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x68]
xor eax, dword [ebp - 0x48]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x58]
and ecx, dword [ebp - 0xc]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x3c]
or edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 8]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x6c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x70]
and eax, dword [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x50
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x67
push edx
call fcn.0040b7d0
add esp, 8
cmp dword [ebp - 0x14], 0x29
jge 0x435484
cmp dword [ebp + 0x1c], 0x10
je 0x435484
cmp dword [ebp - 0x40], 0x54
jle 0x435484
push 0x127fb
push 0xf017
push 0x13558
push 0xd7dc
call dword [sym.imp.GDI32.dll_DeleteObject]
add esp, 0x10
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
and edx, 0x53
mov dword [ebp + 0x18], edx
cmp dword [ebp - 4], 0xc
jl 0x43544c
mov eax, dword [ebp - 0x38]
sub eax, 0x13
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x32
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0xe
push edx
mov eax, dword [ebp - 0x18]
sub eax, 0x24
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x45
push ecx
mov edx, dword [ebp + 0x24]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x34]
sub eax, 0x1f
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x3f
push ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x16
push edx
mov eax, dword [ebp - 0x54]
sub eax, 0x1b
push eax
call fcn.00419cd0
add esp, 0x28
cmp dword [ebp + 0x10], 0x29
jge 0x4355ea
mov ecx, dword [ebp - 0x18]
xor ecx, 0x62
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x14], 0x40
jne 0x4355e5
cmp dword [ebp - 0x24], 7
jle 0x4355e5
cmp dword [ebp - 0x30], 0xb
je 0x4355e5
push 0x1717d
push 0xb094
push 0x2567
push 0x17017
push 0x2a34
push 0x7401
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
add esp, 0x18
cmp dword [ebp - 8], 9
jge 0x4355c8
cmp dword [ebp - 0x58], 0x1a
jge 0x4355c8
cmp dword [ebp + 0x18], 0x4d
jne 0x4355c8
push 0x7fee
push 0x12ffa
push 0x165d8
push 0x6987
call dword [sym.imp.USER32.dll_FrameRect]
add esp, 0x10
cmp dword [ebp - 0x40], 0x3c
jle 0x435597
push 0x15fe6
call dword [sym.imp.KERNEL32.dll_VirtualFree]
add esp, 4
mov eax, dword [ebp + 0x20]
add eax, 0x2f
mov dword [ebp + 0x20], eax
push 0x539b
push 0x12447
push 0x12ecf
push 0x6a71
push 0x37be
push 0xd762
push 0xf106
push 0xc097
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x20
push 0x15bc9
push 0x5020
push 0x1188a
push 0x13a59
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x10
jmp 0x4354ea
mov ecx, dword [ebp + 0x28]
add ecx, 0x2c
push ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x28
push edx
mov eax, dword [ebp - 0x20]
sub eax, 0x3e
push eax
mov ecx, dword [ebp + 8]
sub ecx, 0xe
push ecx
mov edx, dword [ebp - 0x44]
add edx, 0xe
push edx
mov eax, dword [ebp + 8]
add eax, 0xe
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x14
push ecx
call fcn.00423eb0
add esp, 0x1c
cmp dword [ebp - 0x20], 0x4b
jle 0x43565c
cmp dword [ebp - 0x24], 0x5c
jge 0x435644
cmp dword [ebp - 0x28], 0x55
jge 0x435644
cmp dword [ebp - 0x5c], 0x4e
jge 0x435644
mov edx, dword [ebp + 0x20]
xor edx, 0xb
mov dword [ebp + 0x20], edx
push 0x8cdc
push 0x58a
push 0x2227
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
add esp, 0xc
mov eax, dword [ebp - 0x44]
sub eax, 0x53
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 4
push ecx
call fcn.0040b7d0
add esp, 8
cmp dword [ebp - 0xc], 0x42
jge 0x4356dd
cmp dword [ebp - 0x1c], 0x22
jne 0x4356c3
push 0x71b8
push 0xa421
push 0x8c3b
push 0x1125f
push 0xf764
push 0x7232
push 0xd647
push 0xc534
push 0xd049
call dword [sym.imp.USER32.dll_EndPaint]
add esp, 0x24
cmp dword [ebp - 0x30], 0x20
jle 0x4356c3
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x18], 0x38
je 0x4356db
mov ecx, dword [ebp - 0x34]
sub ecx, 0x64
mov dword [ebp - 0x34], ecx
jmp 0x435672
mov esp, ebp
pop ebp
ret