Function at 0x41844a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x41de5b
call fcn.00405af4
mov edi, ecx
test dword [0x421b00], 0x200
je 0x41847b
push edi
push 0x401910
push dword [0x421b0c]
push dword [0x421b08]
call fcn.0040975d
xor ebx, ebx
mov byte [0x421ba8], 1
cmp dword [edi + 0x5c], ebx
je 0x418493
push 0x1c084d
call fcn.00404f88
cmp byte [edi + 0x13b], bl
je 0x4184a5
push 0x1c084e
call fcn.00404f88
mov byte [edi + 0x13b], bl
cmp dword [edi + 0x38], ebx
je 0x4184ba
push 0x1c084f
call fcn.00404f88
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x30
pop esi
push esi
mov dword [edi + 0x38], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0x418d0a
mov dword [ebp - 0x38], 0x4016dc
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test ax, ax
jne 0x418501
mov ebx, 0x80004005
jmp 0x4189e1
push ebx
mov byte [edi + 0x138], 1
call fcn.0041a495
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call esi
test eax, eax
jne 0x418569
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402850
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41855b
mov dword [ebp - 0x14], 0x3a98
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x41856e
mov eax, 0x3a98
mov ecx, 0x2710
mov dword [edi + 0x238], eax
cmp eax, ecx
jae 0x418583
mov dword [edi + 0x238], ecx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call esi
test eax, eax
jne 0x4185d9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402908
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x7530
test eax, eax
je 0x4185cb
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x4185e0
mov esi, 0x7530
mov eax, esi
mov dword [edi + 0x234], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41863b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402960
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41862d
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x41863d
mov eax, ebx
mov dword [edi + 0x23c], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418698
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x4029a8
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41868a
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x41869a
mov eax, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x8000000
mov dword [edi + 0x240], eax
mov eax, 0x4016dc
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x5c], eax
test eax, eax
je 0x4184f7
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x402a28
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418719
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x4029f0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41870d
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x402a28
push 0x80000001
mov dword [edi + 0x190], esi
mov dword [edi + 0x194], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41877e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402a78
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418770
mov dword [ebp - 0x10], 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x418783
mov eax, 0x1f4
mov dword [edi + 0x188], eax
mov dword [edi + 0x18c], ebx
cmp byte [0x4214d4], bl
je 0x4187fe
push ebx
push dword [edi + 0x5c]
call fcn.004189f9
test al, al
je 0x4184f7
mov eax, dword [edi + 0x190]
cmp dword [edi + 0x194], ebx
ja 0x418897
jb 0x4187c5
cmp eax, 0xffffffff
ja 0x418897
push 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xfff
pop eax
cmp byte [edi + 0x13c], bl
je 0x4187df
mov eax, 0x105
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0041bcf4
add esp, 0x10
test eax, eax
jne 0x4187fe
push 0x1c0852
call fcn.00404f88
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0xffffffffffffffeb
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x418823
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4184f7
push 7
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 0x2710
pop eax
cmp byte [edi + 0x13c], bl
je 0x418841
mov eax, 0x107
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0041bcf4
add esp, 0x10
test eax, eax
jne 0x418867
push 0x1c0853
call fcn.00404f88
mov ecx, edi
call fcn.00419b77
push edi
lea ecx, [ebp - 0x30]
call fcn.0041a377
mov dword [ebp - 4], ebx
cmp dword [edi + 0x60], ebx
je 0x4188a6
cmp dword [edi + 0x64], ebx
je 0x4188a6
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00419486
mov eax, dword [ebp - 0x30]
shr eax, 0xb
test al, 1
je 0x41889c
mov eax, dword [edi + 0x60]
jmp 0x41889f
call fcn.0041671b
mov eax, dword [edi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
mov word [edi + 0x139], 0x101
call fcn.0041a3a3
mov esi, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push ebx
call esi
push 1
mov dword [edi + 0x198], eax
call esi
mov dword [edi + 0x19c], eax
cmp dword [edi + 0x198], ebx
je 0x4188e0
test eax, eax
jne 0x4188ea
push 0x1c0854
call fcn.00404f88
mov eax, dword [edi + 0x198]
test eax, eax
je 0x41898b
cmp dword [edi + 0x19c], ebx
je 0x418989
push 0x10
call fcn.00406e16
test eax, eax
je 0x41891b
push edi
mov ecx, eax
call fcn.0041a21d
mov esi, eax
jmp 0x41891d
mov esi, ebx
test esi, esi
jne 0x418951
push 0x1c0855
call fcn.00404f88
mov eax, dword [edi + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x418942
push 0x1c0856
call fcn.00404f88
test esi, esi
je 0x4189af
lea eax, [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4189af
mov edx, dword [edi + 0x58]
lea eax, [edi + 0x1a0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [edx]
lea ecx, [esi + 8]
push ecx
push 0x2101
push edx
call dword [eax + 0x14]
test eax, eax
js 0x41892b
mov eax, dword [edi + 0x1a0]
mov ecx, dword [eax]
push 0xffffffffffffffff
push dword [edi + 0x198]
push eax
call dword [ecx + 0x6c]
jmp 0x418942
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41899c
push eax
call esi
mov dword [edi + 0x198], ebx
mov eax, dword [edi + 0x19c]
test eax, eax
je 0x4189af
push eax
call esi
mov dword [edi + 0x19c], ebx
push dword [0x421ac0]
push ebx
push 0x41a4ea
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x244], eax
test eax, eax
jne 0x4189e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4189e1
push 0x24a759
call fcn.00404f88
cmp byte [edi + 0x13a], 0
jne 0x4189f1
mov ecx, edi
call fcn.004181e6
mov eax, ebx
call fcn.00405bcc
ret