Function at 0x4b6c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xf8], ebx
cmp edi, 0x84
ja 0x4b70b2
je 0x4b706d
lea eax, [edi - 1]
cmp eax, 0x81
ja case.0x4b6c4c.3
movzx eax, byte [eax + 0x4b73e8]
jmp dword [eax*4 + 0x4b73d4]
mov eax, dword [esi]
mov dword [eax + 4], ebx
push dword [esi]
push 0x4e7090
push ebx
call dword [sym.imp.USER32.dll_SetPropW]
jmp 0x4b73bc
lea eax, [ebp - 0x158]
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x15c], 0
push eax
push ebx
call dword [sym.imp.gdiplus.dll_GdipCreateFromHWND]
mov esi, dword [ebp - 0x15c]
mov edi, eax
push 0xffffffffffffffff
push esi
mov dword [ebp - 0xec], esi
call dword [sym.imp.gdiplus.dll_GdipGraphicsClear]
test eax, eax
push 2
push esi
cmovne edi, eax
call dword [sym.imp.gdiplus.dll_GdipSetSmoothingMode]
test eax, eax
push 4
push esi
cmovne edi, eax
call dword [sym.imp.gdiplus.dll_GdipSetTextRenderingHint]
test eax, eax
xorps xmm0, xmm0
movlpd qword [ebp - 0xf4], xmm0
cmovne edi, eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
call dword [sym.imp.gdiplus.dll_GdipCreateStringFormat]
push 0
push dword [ebp - 0xf4]
mov dword [ebp - 0xf0], eax
call dword [sym.imp.gdiplus.dll_GdipSetStringFormatAlign]
mov ecx, dword [ebp - 0xf0]
test eax, eax
push 0
push dword [ebp - 0xf4]
cmovne ecx, eax
mov dword [ebp - 0xf0], ecx
call dword [sym.imp.gdiplus.dll_GdipSetStringFormatLineAlign]
mov ecx, dword [ebp - 0xf0]
test eax, eax
mov dword [ebp - 0xe4], 0
cmovne ecx, eax
lea eax, [ebp - 0xe4]
push eax
push 0xff787878
mov dword [ebp - 0xf0], ecx
call dword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
push 0x64
lea eax, [ebp - 0xe0]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
movss xmm2, dword [0x4e7958]
lea ecx, [ebp - 0x118]
sub esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x118], xmm0
push 0
push 0x4e6f20
call fcn.004b5ca0
mov ebx, dword [ebp - 0xe4]
lea eax, [ebp - 0x14]
movaps xmm0, xmmword [0x4e7c20]
push ebx
push dword [ebp - 0xf4]
movups xmmword [ebp - 0x14], xmm0
push eax
push dword [ebp - 0x118]
lea eax, [ebp - 0xe0]
push 0xffffffffffffffff
push eax
push esi
call dword [sym.imp.gdiplus.dll_GdipDrawString]
test eax, eax
cmovne edi, eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0xf8]
mov dword [ebp - 0xe8], edi
call dword [sym.imp.USER32.dll_GetClientRect]
sub dword [ebp - 0x100], 0xf
lea edx, [ebp - 0x108]
push 0xffffffffffffffff
push 0xffc0c0c0
push ecx
mov dword [esp], 0x40000000
lea ecx, [ebp - 0xec]
push 7
push 7
mov dword [ebp - 0x108], 0xf
mov dword [ebp - 0x104], 0xc8
mov dword [ebp - 0xfc], 0x190
call fcn.004b4920
push 0xffffffffffffffff
push ebx
call dword [sym.imp.gdiplus.dll_GdipSetSolidFillColor]
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
add ecx, 0xffffffe7
mov esi, dword [ebp - 0xec]
add eax, 0xf
push 0x1e
push 0x2a
push ecx
push eax
push ebx
mov ebx, dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
push esi
call ebx
mov edi, dword [ebp - 0xe8]
test eax, eax
push 0xff000000
push dword [ebp - 0xe4]
cmovne edi, eax
call dword [sym.imp.gdiplus.dll_GdipSetSolidFillColor]
push 1
push dword [ebp - 0xf4]
call dword [sym.imp.gdiplus.dll_GdipSetStringFormatLineAlign]
mov ecx, dword [ebp - 0xf0]
test eax, eax
movss xmm2, dword [0x4e7948]
xorps xmm0, xmm0
cmovne ecx, eax
movlpd qword [ebp - 0x110], xmm0
sub esp, 8
mov dword [ebp - 0xf0], ecx
lea ecx, [ebp - 0x110]
push 0
push 0x4e6f20
call fcn.004b5ca0
mov eax, dword [ebp - 0x108]
push dword [ebp - 0xe4]
add eax, 0xe
mov dword [ebp - 0xc], 0x43fa0000
push dword [ebp - 0xf4]
mov dword [ebp - 8], 0x42480000
movd xmm0, eax
mov eax, dword [ebp - 0x104]
cvtdq2ps xmm0, xmm0
add eax, 0xffffffe7
movss dword [ebp - 0x14], xmm0
movd xmm0, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x110]
cvtdq2ps xmm0, xmm0
push 0xffffffffffffffff
push 0x4e7160
push esi
movss dword [ebp - 0x10], xmm0
call dword [sym.imp.gdiplus.dll_GdipDrawString]
test eax, eax
mov dword [ebp - 0x104], 0x1d6
cmovne edi, eax
mov dword [ebp - 0xe8], edi
push 0xffffffffffffffff
push 0xffc0c0c0
push ecx
mov dword [esp], 0x40000000
lea edx, [ebp - 0x108]
push 7
push 7
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xfc], 0x2d5
call fcn.004b4920
mov edi, dword [ebp - 0xe4]
mov esi, dword [sym.imp.gdiplus.dll_GdipSetSolidFillColor]
push 0xffffffffffffffff
push edi
call esi
mov eax, dword [ebp - 0x104]
push 0x1e
push 0x2a
add eax, 0xffffffe7
push eax
mov eax, dword [ebp - 0x108]
add eax, 0xf
push eax
push edi
mov edi, dword [ebp - 0xec]
push edi
call ebx
mov ebx, dword [ebp - 0xe4]
push 0xff000000
push ebx
call esi
push 1
push dword [ebp - 0xf4]
call dword [sym.imp.gdiplus.dll_GdipSetStringFormatLineAlign]
mov ecx, dword [ebp - 0xf0]
test eax, eax
push ebx
push dword [ebp - 0xf4]
cmovne ecx, eax
mov dword [ebp - 0xc], 0x43fa0000
mov eax, dword [ebp - 0x108]
add eax, 0xf
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 8], 0x42480000
movd xmm0, eax
mov eax, dword [ebp - 0x104]
cvtdq2ps xmm0, xmm0
add eax, 0xffffffe7
movss dword [ebp - 0x14], xmm0
movd xmm0, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x110]
cvtdq2ps xmm0, xmm0
push 0xffffffffffffffff
push 0x4e7168
push edi
movss dword [ebp - 0x10], xmm0
call dword [sym.imp.gdiplus.dll_GdipDrawString]
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_EndPaint]
push dword [ebp - 0x110]
mov esi, dword [sym.imp.gdiplus.dll_GdipDeleteFont]
call esi
push dword [ebp - 0x118]
call esi
push ebx
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
push dword [ebp - 0xf4]
call dword [sym.imp.gdiplus.dll_GdipDeleteStringFormat]
push edi
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x4b73bc
push 0x4e7090
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
mov ecx, eax
call fcn.004b7470
jmp 0x4b73bc
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4b73bc
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
add eax, 0x23
movsx ecx, si
mov dword [ebp - 8], eax
mov eax, esi
shr eax, 0x10
cwde
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je case.0x4b6c4c.3
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret 0x10
cmp edi, 0x111
je 0x4b73a5
cmp edi, 0x219
je 0x4b71ff
cmp edi, 0x8000
je 0x4b70f1
push esi
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x4b7137
sub eax, 1
jne 0x4b73bc
push eax
push 4
push 0x4e70a4
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxExW]
cmp eax, 6
jne 0x4b73bc
push 0x1d
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x1d
push 0x111
push ebx
call fcn.004b6c00
jmp 0x4b73bc
push 0
push 3
push str.eg5u
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxExW]
sub eax, 6
je 0x4b71dc
sub eax, 1
jne 0x4b71f3
mov cl, 1
mov dword [ebp - 0xec], 0x2001b68
mov al, 3
mov word [ebp - 0xe8], 0x301
add al, cl
mov dl, 2
add al, dl
xor ah, ah
add al, ah
mov byte [ebp - 0xe6], ah
mov ch, 0x1b
mov dh, 0x68
add al, ch
lea ecx, [ebp - 0xec]
add al, dh
mov edx, 7
push 0
mov byte [ebp - 0xe6], al
call fcn.004b4ba0
push 0x4e7090
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 0x4e6efc
push 0xc8
mov ecx, dword [esi + 0x40]
add ecx, 8
push ecx
call fcn.004b5c10
mov ecx, dword [esi + 0x40]
add esp, 0xc
call fcn.004be760
mov byte [0x4ede54], 0
jmp 0x4b73bc
push 0x10
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x10
push 0x111
push ebx
call fcn.004b6c00
mov byte [0x4ede54], 0
jmp 0x4b73bc
cmp dword [ebp + 0x10], 0x8000
jne 0x4b738d
cmp dword [esi + 4], 3
jne 0x4b738d
lea eax, [ebp - 0x15c]
push eax
push 1
push 0
push str.HARDWAREDEVICEMAPSERIALCOMM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b738d
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xf8], 0x64
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xe4], 0x14
push eax
xor edi, edi
lea eax, [ebp - 0xf8]
push edi
push edi
push eax
lea eax, [ebp - 0xe0]
push eax
push edi
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x4b7381
lea eax, [ebp - 0xe0]
push str.DeviceProlificSerial
push eax
call fcn.004c0757
add esp, 8
test eax, eax
jne 0x4b72ca
lea eax, [ebp - 0xe0]
push str.DeviceSilabser
push eax
call fcn.004c0757
add esp, 8
test eax, eax
jne 0x4b72ca
lea eax, [ebp - 0xe0]
push str.DeviceSerial
push eax
call fcn.004c0757
add esp, 8
test eax, eax
je 0x4b72e2
lea ecx, [ebp - 0x18]
lea eax, [esi + 0xc]
push ecx
push eax
mov dword [ebp - 0xe8], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4b7350
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xf8], 0x64
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xe4], 0x14
push eax
push 0
push 0
lea eax, [ebp - 0xf8]
inc edi
push eax
lea eax, [ebp - 0xe0]
push eax
push edi
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4b7282
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret 0x10
push 0x4e7090
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4b7381
push dword [ebp - 0xe8]
push 0xffffffffffffffff
push 0x14d
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret 0x10
push 0x4e7090
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
mov edx, dword [ebp + 0x10]
mov ecx, eax
push esi
call fcn.004b7960
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret 0x10