Function at 0x409168
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.004090a1
mov esi, eax
lea eax, [ebx + 0x184]
mov dword [esp + 0x14], esi
cmp esi, dword [eax]
je 0x409884
and dword [esp + 0x10], 0
and dword [esp + 0x2c], 0
mov dword [eax], esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], 0xc
call fcn.00407e9f
mov ebp, dword [0x4645c0]
cmp esi, 1
pop ecx
jne 0x409360
push 0x471898
push dword [ebx + 0x88]
call dword [0x464570]
push 0x44f
mov dword [esp + 0x34], 0x8000
push dword [ebx + 4]
call ebp
sub esp, 0x10
lea esi, [esp + 0x38]
mov edi, esp
lea ecx, [ebx + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
push 0x44f
push dword [ebx + 4]
call ebp
push 0x471b00
push eax
call dword [0x464570]
push 0x44e
mov dword [esp + 0x30], 1
push dword [ebx + 4]
mov dword [esp + 0x30], 0xe
mov dword [esp + 0x38], 0x8000
call ebp
sub esp, 0x10
lea esi, [esp + 0x38]
mov edi, esp
lea ecx, [ebx + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
push 0x44e
push dword [ebx + 4]
call ebp
mov esi, 0x471848
push esi
push eax
call dword [0x464570]
lea eax, [esp + 0x10]
mov edi, 0x29cd
push eax
push edi
push 0x44d
push dword [ebx + 4]
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x409293
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push esi
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push edi
push 0x451
push dword [ebx + 4]
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x4092cb
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push esi
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push edi
push 0x454
push dword [ebx + 4]
call fcn.0042e6c8
xor edi, edi
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x409304
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push esi
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x409338
push 0x44b
push dword [ebx + 4]
call ebp
mov esi, dword [0x464580]
push edi
mov edi, 0xf1
push 1
push edi
push eax
call esi
push 0x456
push dword [ebx + 4]
call ebp
push 0
push 1
push edi
push eax
call esi
push 0x424
push dword [ebx + 4]
call ebp
mov esi, dword [0x464588]
push 5
push eax
call esi
push 0x425
push dword [ebx + 4]
call ebp
push 0
push eax
call esi
mov esi, dword [esp + 0x14]
cmp esi, 3
jne 0x409511
push 0x47183c
push dword [ebx + 0x88]
call dword [0x464570]
push 0x44f
mov dword [esp + 0x34], 0x35da
push dword [ebx + 4]
call ebp
sub esp, 0x10
lea esi, [esp + 0x38]
mov edi, esp
lea ecx, [ebx + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
push 0x44f
push dword [ebx + 4]
call ebp
push 0x471ac4
push eax
call dword [0x464570]
push 0x44e
mov dword [esp + 0x30], 1
push dword [ebx + 4]
mov dword [esp + 0x30], 0xe
mov dword [esp + 0x38], 0x35da
call ebp
sub esp, 0x10
lea esi, [esp + 0x38]
mov edi, esp
lea ecx, [ebx + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
push 0x44e
push dword [ebx + 4]
call ebp
mov esi, 0x4717f8
push esi
push eax
call dword [0x464570]
lea eax, [esp + 0x10]
mov edi, 0x29cd
push eax
push edi
push 0x44d
push dword [ebx + 4]
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x409444
push str.false
push str.rgb_237_28_36
push dword [esp + 0x28]
push esi
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push edi
push 0x451
push dword [ebx + 4]
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x40947c
push str.false
push str.rgb_237_28_36
push dword [esp + 0x28]
push esi
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push edi
push 0x454
push dword [ebx + 4]
call fcn.0042e6c8
xor edi, edi
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x4094b5
push str.false
push str.rgb_237_28_36
push dword [esp + 0x28]
push esi
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x4094ea
push 0x44b
push dword [ebx + 4]
call ebp
mov esi, dword [0x464580]
push edi
push edi
mov edi, 0xf1
push edi
push eax
call esi
push 0x456
push dword [ebx + 4]
call ebp
push 0
push 0
push edi
push eax
call esi
xor edi, edi
push 0x424
push dword [ebx + 4]
call ebp
mov esi, dword [0x464588]
push edi
push eax
call esi
push 0x425
push dword [ebx + 4]
call ebp
push 5
push eax
call esi
mov esi, dword [esp + 0x14]
cmp esi, 2
jne 0x40986a
push 0x47183c
push dword [ebx + 0x88]
call dword [0x464570]
push 0x44f
mov dword [esp + 0x34], 0x3294f6
push dword [ebx + 4]
call ebp
sub esp, 0x10
lea esi, [esp + 0x38]
mov edi, esp
lea ecx, [ebx + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
push 0x44f
push dword [ebx + 4]
call ebp
push 0x471a88
push eax
call dword [0x464570]
push 0x44e
mov dword [esp + 0x30], 1
push dword [ebx + 4]
mov dword [esp + 0x30], 0xe
mov dword [esp + 0x38], 0x3294f6
call ebp
sub esp, 0x10
lea esi, [esp + 0x38]
mov edi, esp
lea ecx, [ebx + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
push 0x44e
push dword [ebx + 4]
call ebp
push 0x4717b0
push eax
call dword [0x464570]
push 4
lea eax, [esp + 0x1c]
pop esi
mov dword [esp + 0x14], 1
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push str.IMEPRO
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call dword [0x464438]
lea eax, [esp + 0x10]
xor edi, edi
cmp dword [esp + 0x14], edi
push eax
push 0x29cd
push 0x44d
push dword [ebx + 4]
je 0x40964a
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x409635
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push 0x471848
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x409695
push 0x44b
push dword [ebx + 4]
call ebp
push edi
push 1
jmp 0x409689
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x409677
push str.false
push str.rgb_237_28_36
push dword [esp + 0x28]
push 0x4717f8
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x409695
push 0x44b
push dword [ebx + 4]
call ebp
push edi
push edi
push 0xf1
push eax
call dword [0x464580]
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 1
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push str.IMEAD
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
call dword [0x464438]
cmp dword [esp + 0x14], edi
lea eax, [esp + 0x10]
push eax
push 0x29cd
push 0x451
push dword [ebx + 4]
je 0x409723
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x40970e
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push 0x471848
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x40976e
push 0x453
push dword [ebx + 4]
call ebp
push edi
push 1
jmp 0x409762
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x409750
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push 0x471848
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x40976e
push 0x453
push dword [ebx + 4]
call ebp
push edi
push edi
push 0xf1
push eax
call dword [0x464580]
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 1
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push 0x471a58
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
call dword [0x464438]
cmp dword [esp + 0x14], edi
lea eax, [esp + 0x10]
push eax
push 0x29cd
push 0x454
push dword [ebx + 4]
je 0x4097fc
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x4097e7
push str.false
push str.rgb_23_121_53_
push dword [esp + 0x28]
push 0x471848
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x409847
push 0x456
push dword [ebx + 4]
call ebp
push edi
push 1
jmp 0x40983b
call fcn.0042e6c8
add esp, 0x10
cmp dword [esp + 0x10], edi
je 0x409829
push str.false
push str.rgb_237_28_36
push dword [esp + 0x28]
push 0x4717f8
push dword [esp + 0x20]
call fcn.00406a81
add esp, 0x14
cmp dword [esp + 0x3c], edi
je 0x409847
push 0x456
push dword [ebx + 4]
call ebp
push edi
push edi
push 0xf1
push eax
call dword [0x464580]
push 0x424
push dword [ebx + 4]
call ebp
mov esi, dword [0x464588]
push edi
push eax
call esi
push 0x425
push dword [ebx + 4]
call ebp
push 5
push eax
call esi
push 0x41a
push dword [ebx + 4]
call ebp
push 0x105
push 0
push 0
push eax
call dword [0x464504]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4