Function at 0x41e880
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x324
mov eax, dword [0x47e378]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
mov ebx, dword [esp + 0x32c]
push ebp
push esi
push edi
xor ebp, ebp
push 0xff
lea eax, [esp + 0x134]
mov edi, ecx
push ebp
push eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], 0x104
mov dword [esp + 0x28], ebp
call fcn.004541e0
mov eax, dword [ebx + 0x7f6c]
add esp, 0xc
xor esi, esi
test eax, 0xf000
je 0x41e8fc
xor eax, 0xf000
mov esi, 1
mov dword [ebx + 0x7f6c], eax
cmp dword [ebx + 0x7f6c], 2
jne 0x41ea7c
cmp dword [ebx + 0xac14], ebp
jne 0x41ea7c
cmp dword [0x4805c8], 1
jne 0x41ea7c
push str.HkWndName
push str.HkClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, eax
mov eax, dword [ebx + 0x7f68]
cmp eax, dword [edi + 0x7f70]
mov dword [esp + 0x24], ecx
jne 0x41e94b
cmp esi, 1
jne 0x41e964
cmp eax, ebp
push ebp
push ebp
je 0x41e958
push 0x40e
jmp 0x41e95d
push 0x40f
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, 0x47c378
lea esi, [ebx + 0x8078]
nop
cmp dword [esi - 0x108], 1
jne 0x41ea61
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.Softwareinteldisplayigfxcuihkcmd_resources
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0xff
lea eax, [esp + 0x134]
push ebp
push eax
call fcn.004541e0
mov edx, dword [edi]
push 0xa
lea ecx, [esp + 0x140]
push ecx
push edx
call fcn.00455d05
add esp, 0x18
lea ecx, [esi - 0x104]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41e9f0
test dl, dl
je 0x41e9ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41e9f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x41e9d0
xor eax, eax
jmp 0x41e9f5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x41ea0e
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x130]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x41ea36
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41ea13
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
push esi
push 1
push ebp
lea edx, [esp + 0x140]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x41ea4c
push ebp
push ebp
push 0x40c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esi - 0x108], ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
add edi, 8
add esi, 0x214
cmp edi, 0x47c3e8
jl 0x41e970
mov dword [ebx + 0x7f6c], ebp
cmp dword [ebx + 0x7f6c], 1
jne 0x41ecd0
mov edi, 0x47c378
lea esi, [ebx + 0x817c]
mov eax, dword [edi]
cmp eax, ebp
jne 0x41eacd
cmp dword [edi + 4], ebp
jne 0x41eacd
push 0x104
lea edx, [esi - 0x104]
push ebp
push edx
call fcn.004541e0
push 0x104
lea eax, [esi - 0x208]
push ebp
push eax
call fcn.004541e0
add esp, 0x18
mov dword [esi], ebp
mov dword [esi + 4], ebp
jmp 0x41eaf4
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [0x48bc18]
mov ecx, dword [edi]
push edx
push 0x104
lea eax, [esi - 0x208]
push eax
push ecx
push ebp
call sub.hccutils.DLL_LoadSTRING
add esp, 0x14
add edi, 8
add esi, 0x214
cmp edi, 0x47c3e8
jl 0x41ea94
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebp
push str.Softwareinteldisplayigfxcuihkcmd_resources
push SysReAllocString
call esi
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebp
push str.Softwareinteldisplayigfxcuihkcmd_resources
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp edi, ebp
mov esi, eax
je 0x41eb6c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.Softwareinteldisplayigfxcuihkcmd_resources
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x41eca6
cmp esi, ebp
jne 0x41eca6
push 0xff
lea eax, [esp + 0x234]
push ebp
push eax
call fcn.004541e0
lea esi, [ebx + 0x7f74]
mov ebx, 0x104
lea ecx, [esp + 0x3c]
add esp, 0xc
mov ebp, 0x47c378
sub ebx, ecx
push 0xff
lea edx, [esp + 0x34]
push 0
push edx
call fcn.004541e0
mov ecx, dword [ebp]
push 0xa
lea eax, [esp + 0x240]
push eax
push ecx
call fcn.00455d05
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x18
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
push 0
lea edx, [esp + 0x240]
push edx
push eax
call edi
test eax, eax
jne 0x41ec06
lea eax, [esp + 0x30]
lea edx, [ebx + esi]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x41ebf8
jmp 0x41ec6c
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x240]
push ecx
push edx
call edi
test eax, eax
jne 0x41ec3f
lea eax, [esp + 0x30]
lea edx, [ebx + esi]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x41ec31
jmp 0x41ec6c
push 0x104
lea edi, [esi + 0x104]
push 0
push edi
call fcn.004541e0
mov edx, edi
add esp, 0xc
mov eax, esi
sub edx, esi
jmp 0x41ec60
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x41ec60
push 0xff
lea eax, [esp + 0x234]
push 0
push eax
call fcn.004541e0
add ebp, 8
add esp, 0xc
add esi, 0x214
cmp ebp, 0x47c3e8
mov dword [esp + 0x18], 0x104
jl 0x41eba0
mov ebx, dword [esp + 0x28]
xor ebp, ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [ebx + 0x7f68]
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 0x7f70], eax
mov dword [ebx + 0x7f6c], ebp
mov ecx, dword [esp + 0x330]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454162
add esp, 0x324
ret 4