Function at 0x401000
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x688
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], 0x73
mov dword [ebp - 0x24], 0x25000a
mov dword [ebp - 0x28], 0x730025
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
lea ebx, [ebp - 0x694]
push 0x200
push 0
push ebx
call sym._memset
add esp, 0xc
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x494]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x100
mov edi, dword [0x40d144]
lea eax, [ebp - 0x50]
push eax
push 0
push 0x113e
push dword [edi + 0x10]
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40109b
add ecx, 0x202
lea edx, [ebp - 0x28]
push ecx
push eax
push edx
push ebx
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0x10
jmp 0x4010b4
xor ecx, ecx
nop dword [eax]
movzx edx, word [eax + ecx]
mov word [ebp + ecx - 0x694], dx
add ecx, 2
test dx, dx
jne 0x4010a0
push ebx
push dword [0x419038]
call dword [sym.imp.user32.dll_SetWindowTextW]
push 0
push 0
push 0x130c
push dword [0x41903c]
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4010e6
test byte [eax], 4
jne 0x401356
mov edi, dword [sym.imp.user32.dll_SendMessageW]
push 0
push 2
push 0x1308
push dword [0x41903c]
call edi
push 0
push 1
push 0x1308
push dword [0x41903c]
call edi
lea ebx, [ebp - 0x494]
push 0x100
push ebx
push esi
call dbg.CreateRegPath
add esp, 0xc
mov esi, eax
xor eax, eax
test esi, esi
setne al
lea eax, [eax + eax*4]
push eax
push dword [0x41903c]
call dword [sym.imp.user32.dll_ShowWindow]
mov edi, dword [0x419040]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
push 0xffff0000
push 4
push 0x110a
push edi
call ebx
push eax
push 0
push 0x1114
push edi
call ebx
push 0xffff0000
push 0
push 0x1101
push dword [0x419040]
call ebx
test esi, esi
je 0x40134b
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x78], 0x100
lea esi, [ebp - 0x294]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x90], 0xffff0002
mov dword [ebp - 0x94], 0xffff0000
mov dword [ebp - 0x10], 0xffff0000
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x14]
mov edx, dword [sym.imp.advapi32.dll_RegOpenKeyW]
lea ebx, [ebp - 0x494]
mov edi, ebx
nop dword [eax + eax]
add edi, 2
movzx eax, word [edi - 2]
test eax, eax
je 0x4012e6
cmp eax, 0x5c
jne 0x4011d0
mov word [edi - 2], 0
push ecx
push ebx
push 0x80000000
call edx
test eax, eax
jne 0x40134b
mov ebx, 0xfffffffe
cmp word [ebp + ebx - 0x492], 0
lea ebx, [ebx + 2]
jne 0x401200
sar ebx, 1
mov word [edi - 2], 0x5c
mov dword [ebp - 0x1c], 0x200
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegQueryValueW]
test eax, eax
jne 0x4012bd
mov eax, dword [ebp - 0x18]
inc eax
mov ecx, esi
mov esi, ebx
sub esi, eax
lea eax, [esi*2 - 0x28e]
add eax, ebp
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
push edx
push ecx
push eax
call sym._memmove
add esp, 0xc
mov eax, dword [ebp - 0x18]
lea eax, [eax*2 - 0x492]
add eax, ebp
lea ecx, [esi + esi]
push ecx
push eax
lea eax, [ebp - 0x294]
push eax
call sym._memcpy
add esp, 0xc
cmp dword [ebp - 0x10], 1
jne 0x401283
xor eax, eax
jmp 0x401292
mov dword [ebp + esi*2 - 0x292], 0x20003d
mov ax, 0x20
mov word [ebp + esi*2 - 0x294], ax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x1132
push dword [0x419040]
call dword [sym.imp.user32.dll_SendMessageW]
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x294]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x94], eax
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x18], ebx
lea ebx, [ebp - 0x494]
lea ecx, [ebp - 0x14]
mov edx, dword [sym.imp.advapi32.dll_RegOpenKeyW]
jmp 0x4011d0
lea eax, [ebp - 0x494]
push ecx
push eax
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x40134b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
lea eax, [eax*2 - 0x492]
add eax, ebp
mov edi, dword [ebp - 0x10]
mov edx, edi
push 1
push eax
call dbg.CreateRegRec
add esp, 8
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push edi
push 2
push 0x1102
push dword [0x419040]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
call esi
push edi
push 0
push 0x1114
push dword [0x419040]
call esi
add esp, 0x688
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
push 0
push 0x1304
push dword [0x41903c]
call dword [sym.imp.user32.dll_SendMessageW]
cmp eax, 1
lea ebx, [ebp - 0x494]
jne 0x401114
xorps xmm0, xmm0
movups xmmword [ebp - 0x290], xmm0
xorps xmm0, xmm0
movsd qword [ebp - 0x280], xmm0
mov dword [ebp - 0x294], 1
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], 0x100
push 0x100
push ebx
push 0xfb
push dword [edi + 0x1c]
call dword [sym.imp.user32.dll_LoadStringW]
lea eax, [ebp - 0x294]
push eax
mov ebx, eax
push 1
push 0x133e
push dword [0x41903c]
call dword [sym.imp.user32.dll_SendMessageW]
push 0x100
lea eax, [ebp - 0x494]
push eax
push 0xfc
push dword [edi + 0x1c]
call dword [sym.imp.user32.dll_LoadStringW]
push ebx
lea ebx, [ebp - 0x494]
push 2
push 0x133e
push dword [0x41903c]
call dword [sym.imp.user32.dll_SendMessageW]
jmp 0x401114