Function at 0x4061f0
Capabilities:
Capture webcam image
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x418ec0]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
xor ebp, ebp
push edi
push ebp
push ebp
push pe_nt_image_headers32
push 0x410
push eax
xor ebx, ebx
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
test eax, eax
je 0x40623a
fld qword [0x4132b0]
fld qword [0x413378]
call fcn.0040a2c0
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x411
push ecx
call esi
push eax
call edi
test eax, eax
je 0x40627c
fld qword [0x4132b0]
fld qword [0x413370]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x412
push edx
call esi
push eax
call edi
test eax, eax
je 0x4062be
fld qword [0x4132b0]
fld qword [0x4132b0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x413
push eax
call esi
push eax
call edi
test eax, eax
je 0x4062ff
fld qword [0x4132b0]
fld qword [0x413368]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x414
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406341
fld qword [0x4132b0]
fld qword [0x413360]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x415
push edx
call esi
push eax
call edi
test eax, eax
je 0x406383
fld qword [0x4132b0]
fld qword [0x413358]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x416
push eax
call esi
push eax
call edi
test eax, eax
je 0x4063c4
fld qword [0x4132b0]
fld qword [0x413350]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x419
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406406
fld qword [0x4132b0]
fld qword [0x413348]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x41a
push edx
call esi
push eax
call edi
test eax, eax
je 0x406448
fld qword [0x4132b0]
fld qword [0x413340]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x41b
push eax
call esi
push eax
call edi
test eax, eax
je 0x406489
fld qword [0x4132b0]
fld qword [0x413338]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x41e
push ecx
call esi
push eax
call edi
test eax, eax
je 0x4064cb
fld qword [0x4132b0]
fld qword [0x413330]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x41f
push edx
call esi
push eax
call edi
test eax, eax
je 0x40650d
fld qword [0x4132b0]
fld qword [0x413328]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x420
push eax
call esi
push eax
call edi
test eax, eax
je 0x40654e
fld qword [0x4132b0]
fld qword [0x413320]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x421
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406590
fld qword [0x4132b0]
fld qword [0x413318]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x422
push edx
call esi
push eax
call edi
test eax, eax
je 0x4065d2
fld qword [0x4132b0]
fld qword [0x413310]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x423
push eax
call esi
push eax
call edi
test eax, eax
je 0x406613
fld qword [0x4132b0]
fld qword [0x413308]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x424
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406655
fld qword [0x4132b0]
fld qword [0x413300]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x425
push edx
call esi
push eax
call edi
test eax, eax
je 0x406697
fld qword [0x4132b0]
fld qword [0x4132f8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x426
push eax
call esi
push eax
call edi
test eax, eax
je 0x4066d8
fld qword [0x4132b0]
fld qword [0x4132f0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x427
push ecx
call esi
push eax
call edi
test eax, eax
je 0x40671a
fld qword [0x4132b0]
fld qword [0x4132e8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x428
push edx
call esi
push eax
call edi
test eax, eax
je 0x40675c
fld qword [0x4132b0]
fld qword [0x4132e0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x429
push eax
call esi
push eax
call edi
test eax, eax
je 0x40679d
fld qword [0x4132b0]
fld qword [0x4132d8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x42a
push ecx
call esi
push eax
call edi
test eax, eax
je 0x4067df
fld qword [0x4132b0]
fld qword [0x4132d0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x42b
push edx
call esi
push eax
call edi
test eax, eax
je 0x406821
fld qword [0x4132b0]
fld qword [0x4132c8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x42c
push eax
call esi
push eax
call edi
test eax, eax
je 0x406862
fld qword [0x4132b0]
fld qword [0x4132c0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x42d
push ecx
call esi
push eax
call edi
test eax, eax
je 0x4068a4
fld qword [0x4132b0]
fld qword [0x4132b8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
push 4
call fcn.0040a1df
mov esi, eax
add esp, 4
mov byte [esi], bl
shr ebx, 8
mov eax, ebx
mov byte [esi + 1], al
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [esi + 2], al
cdq
and edx, 0xff
add eax, edx
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
sar eax, 8
push Ordinal_2
mov byte [esi + 3], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
push 4
push esi
push 3
push ebp
push str.Nodrives
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret