Function at 0x44c210
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004d9950
test eax, eax
je 0x44c500
push ebx
push esi
push 0x72fe84
push str.PrintScreenDisabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x91c], 1
call fcn.004d5820
mov esi, dword [0x72fe84]
lea eax, [ebp - 0x91c]
push eax
push str.PrintScreenSetScanCode
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x910], esi
call fcn.004d5820
xor ebx, ebx
cmp dword [ebp - 0x91c], ebx
je 0x44c29f
cmp esi, ebx
je 0x44c2a5
push 1
call fcn.004310b0
add esp, 4
cmp eax, 2
je 0x44c2a5
mov dword [0x72fe84], ebx
mov dword [ebp - 0x910], ebx
mov esi, dword [ebp - 0x910]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x90c], ebx
cmp esi, ebx
je 0x44c2d1
lea ecx, [ebp - 0x90c]
push ecx
push str.SystemCurrentControlSetControlKeyboard_Layout
push reloc.OLEAUT32.dll_SysReAllocString
call edi
jmp 0x44c2ed
lea edx, [ebp - 0x90c]
push edx
push 1
push ebx
push str.SystemCurrentControlSetControlKeyboard_Layout
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
cmp eax, ebx
jne 0x44c4fd
push 0x800
lea eax, [ebp - 0x908]
push ebx
push eax
mov dword [ebp - 0x920], ebx
mov dword [ebp - 0x914], ebx
mov dword [ebp - 0x918], 0x800
call fcn.005dfd60
add esp, 0xc
lea ecx, [ebp - 0x918]
push ecx
mov ecx, dword [ebp - 0x90c]
lea edx, [ebp - 0x908]
push edx
lea eax, [ebp - 0x920]
push eax
push ebx
push str.Scancode_Map
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, eax
mov eax, dword [ebp - 0x918]
cmp esi, ebx
je 0x44c412
cmp eax, ebx
jbe 0x44c3a8
cmp ecx, ebx
jne 0x44c3a8
lea ecx, [ebp - 0x908]
mov esi, 0x686330
cmp eax, 4
jb 0x44c384
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x44c3a8
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x44c370
cmp eax, ebx
je 0x44c3d2
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x44c3a8
cmp eax, 1
jbe 0x44c3d2
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x44c3a8
cmp eax, 2
jbe 0x44c3d2
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x44c3d2
mov ecx, dword [ebp - 0x90c]
push 0x1c
push 0x686330
push 3
push ebx
push str.Scancode_Map
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x44c3d2
mov dword [ebp - 0x914], 1
mov eax, dword [ebp - 0x90c]
cmp eax, ebx
je 0x44c3e9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x90c], ebx
cmp dword [ebp - 0x914], ebx
je 0x44c4fd
cmp dword [ebp - 0x910], ebx
je 0x44c4ce
push str.Reboot_Needed_for_PrintScreen_Block...
lea edx, [ebp - 0x108]
push edx
jmp 0x44c4da
cmp eax, ebx
jbe 0x44c3d2
cmp ecx, ebx
jne 0x44c3d2
lea ecx, [ebp - 0x908]
mov esi, 0x686330
cmp eax, 4
jb 0x44c444
lea ebx, [ebx]
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x44c3d2
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x44c430
cmp eax, ebx
je 0x44c470
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x44c3d2
cmp eax, 1
jbe 0x44c470
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x44c3d2
cmp eax, 2
jbe 0x44c470
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x44c3d2
mov ecx, dword [ebp - 0x90c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
lea edx, [ebp - 0x90c]
push edx
push str.SystemCurrentControlSetControlKeyboard_Layout
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x90c], ebx
call edi
test eax, eax
jne 0x44c3d2
mov eax, dword [ebp - 0x90c]
push str.Scancode_Map
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x44c4c0
mov dword [ebp - 0x914], 1
mov ecx, dword [ebp - 0x90c]
push ecx
call esi
jmp 0x44c3e3
push str.Reboot_Needed_for_PrintScreen_UnBlock...
lea eax, [ebp - 0x108]
push eax
call fcn.005dfb23
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
push str.Message
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret