Function at 0x4574a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x118]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0
push str.TurboMode
mov edi, 4
push ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x4574f6
cmp dword [ebp - 0x30], edi
jne 0x4574f6
cmp dword [ebp - 0x2c], edi
jne 0x4574f6
mov eax, dword [ebp - 0x34]
mov ecx, dword [esi + 0x11c]
lea edx, [ebp - 0x30]
push edx
mov dword [esi + 0x118], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push str.PollUnderCursor
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x457539
cmp dword [ebp - 0x2c], edi
jne 0x457539
cmp dword [ebp - 0x30], edi
jne 0x457539
mov eax, dword [ebp - 0x34]
mov edx, dword [esi + 0x120]
mov dword [esi + 0x11c], eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x28], edx
lea edx, [ebp - 0x2c]
push edx
push 0
push str.PollForeground
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x45757c
cmp dword [ebp - 0x2c], edi
jne 0x45757c
cmp dword [ebp - 0x30], edi
jne 0x45757c
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x124]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.PollFullScreen
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x4575bf
cmp dword [ebp - 0x2c], edi
jne 0x4575bf
cmp dword [ebp - 0x30], edi
jne 0x4575bf
mov eax, dword [ebp - 0x34]
mov ecx, dword [esi + 0x128]
lea edx, [ebp - 0x30]
push edx
mov dword [esi + 0x124], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push str.OnlyPollConsole
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x457602
cmp dword [ebp - 0x2c], edi
jne 0x457602
cmp dword [ebp - 0x30], edi
jne 0x457602
mov eax, dword [ebp - 0x34]
mov edx, dword [esi + 0x12c]
mov dword [esi + 0x128], eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x28], edx
lea edx, [ebp - 0x2c]
push edx
push 0
push str.OnlyPollOnEvent
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x457645
cmp dword [ebp - 0x2c], edi
jne 0x457645
cmp dword [ebp - 0x30], edi
jne 0x457645
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x12c], eax
mov eax, dword [esi + 0x130]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.MaxCpu
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x457688
cmp dword [ebp - 0x2c], edi
jne 0x457688
cmp dword [ebp - 0x30], edi
jne 0x457688
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x130], eax
test eax, eax
jne 0x45769c
mov dword [esi + 0x130], 0x64
mov ecx, dword [esi + 0x134]
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push str.EnableDriver
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x4576d9
cmp dword [ebp - 0x2c], edi
jne 0x4576d9
cmp dword [ebp - 0x30], edi
jne 0x4576d9
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x134], eax
test eax, eax
je 0x4576f6
push 0
call fcn.00416ed0
movzx edx, al
add esp, 4
mov dword [esi + 0x134], edx
mov eax, dword [esi + 0x138]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.EnableHook
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x457733
cmp dword [ebp - 0x2c], edi
jne 0x457733
cmp dword [ebp - 0x30], edi
jne 0x457733
mov eax, dword [ebp - 0x34]
mov ecx, dword [esi + 0x13c]
lea edx, [ebp - 0x30]
push edx
mov dword [esi + 0x138], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push str.EnableVirtual
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x457776
cmp dword [ebp - 0x2c], edi
jne 0x457776
cmp dword [ebp - 0x30], edi
jne 0x457776
mov eax, dword [ebp - 0x34]
mov edx, dword [esi + 0x140]
mov dword [esi + 0x13c], eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x28], edx
lea edx, [ebp - 0x2c]
push edx
push 0
push str.SingleWindow
push ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x4577b9
cmp dword [ebp - 0x2c], edi
jne 0x4577b9
cmp dword [ebp - 0x30], edi
jne 0x4577b9
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x140], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push str.SingleWindowName
push ebx
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x457804
cmp dword [ebp - 0x2c], 0x100
jg 0x457804
lea edi, [esi + 0x144]
mov ecx, 8
lea esi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret