Function at 0x41683c
Capabilities:
Hide graphical window
Inspect load icon resource
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xffffff38
mov ebx, 0x41899c
lea esi, [esp + 0xc]
call fcn.004027b0
test eax, eax
jle 0x4168ab
mov edx, 0x4197a4
mov eax, 1
call fcn.00402810
mov edx, dword [0x4197a4]
mov eax, 0x4195b0
call fcn.00402bfc
mov eax, 0x4195b0
call fcn.0040298c
call fcn.00402664
test eax, eax
jle 0x41689c
mov eax, 0x4195b0
call fcn.00402998
mov eax, 0x4195b0
call fcn.00402cb8
mov eax, 0x4195b0
call fcn.00402cc4
call fcn.00402634
push 0
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebx], eax
lea eax, [esp + 0x6c]
xor ecx, ecx
mov edx, 0x30
call fcn.00402d8c
mov dword [esp + 0x6c], 0x30
mov dword [esp + 0x74], 0x414c14
mov eax, dword [ebx]
mov dword [esp + 0x80], eax
mov dword [esp + 0x90], 1
mov eax, dword [0x4172a0]
mov dword [esp + 0x94], eax
push 1
mov eax, dword [ebx]
push eax
call sub.user32.dll_LoadIconA
mov dword [esp + 0x84], eax
push 0
push 0x10
push 0x10
push 1
push 3
mov eax, dword [ebx]
push eax
call sub.user32.dll_LoadImageA
mov dword [0x41895c], eax
push 0
push 0x10
push 0x10
push 1
push 2
mov eax, dword [ebx]
push eax
call sub.user32.dll_LoadImageA
mov dword [0x418958], eax
mov eax, dword [0x418958]
mov dword [esp + 0x98], eax
lea eax, [esp + 0x6c]
push eax
call sub.user32.dll_RegisterClassExA
test ax, ax
jne 0x416967
lea eax, [esp + 0x70]
push eax
call sub.user32.dll_RegisterClassA
test ax, ax
jne 0x416967
mov eax, 0xff
call fcn.00404048
mov byte [0x418af4], 0x5b
mov eax, dword [0x4172a4]
push eax
push 0x418af4
call sub.kernel32.dll_lstrcatA
push 0x416b74
push 0x418af4
call sub.kernel32.dll_lstrcatA
push 0xcf0000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0
push 0
mov eax, dword [ebx]
push eax
push 0
mov ecx, 0x418af4
mov edx, dword [0x4172a0]
xor eax, eax
call fcn.004057cc
mov dword [0x4188d4], eax
call fcn.00416148
call fcn.004163b0
mov eax, 0x416b88
mov edx, 1
call fcn.0040dbc8
test eax, eax
setne byte [0x4189e6]
mov dword [esp + 0x28], 0x44
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
test byte [esp + 0x54], 1
jne 0x416a08
mov word [esp + 0x58], 0xa
cmp byte [0x4189e6], 0
je 0x416a22
mov ax, word [esp + 0x58]
cmp ax, 0xa
je 0x416a26
cmp ax, 1
je 0x416a26
xor eax, eax
jmp 0x416a28
mov al, 1
mov byte [0x4189e7], al
cmp byte [0x4189e7], 0
je 0x416aa6
mov dword [esp], 0x2c
mov dword [esp + 4], 3
lea eax, [esp + 8]
push eax
push 0x416b8c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
push esp
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x416ba4
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x416a9c
mov ax, word [esp + 0xa4]
mov word [esp + 0x58], ax
lea eax, [esp + 0x9c]
push eax
mov eax, dword [0x4188d4]
push eax
call sub.user32.dll_SetWindowPlacement
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov dword [0x418bfc], 0x154
push 0
push 0x418bfc
push 0
push 0x29
call sub.user32.dll_SystemParametersInfoA
push 0x418c9c
call sub.gdi32.dll_CreateFontIndirectA
mov dword [0x4188d0], eax
movzx eax, word [esp + 0x58]
push eax
mov eax, dword [0x4188d4]
push eax
call sub.user32.dll_ShowWindow
push 1
mov eax, dword [ebx]
push eax
call sub.user32.dll_LoadAcceleratorsA
mov dword [0x418988], eax
call fcn.0040be68
push 0
push 0
push 0
push esi
call sub.user32.dll_GetMessageA
test eax, eax
je 0x416b32
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
cmp dword [0x4177b4], 0
je 0x416af4
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x416af4
call fcn.00410d20
jmp 0x416af4
mov eax, dword [0x418948]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x41894c]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x418950]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x4188d0]
push eax
call sub.gdi32.dll_DeleteObject
call fcn.0040c050
mov eax, dword [esi + 8]
call fcn.00404048
add esp, 0xc8
pop esi
pop ebx
ret