Function at 0x407ea7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x289c
call fcn.0041d440
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x2818], 0
and dword [ebp - 0x2820], 0
push ebx
mov eax, dword [eax]
mov ebx, 0x200
push esi
mov esi, dword [ebp + 8]
push edi
push 0x14
mov edi, ecx
mov dword [ebp - 0x2814], eax
call fcn.0040e770
mov dword [edi + 0x74], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x1b
call fcn.0040e770
mov dword [edi + 0x6c], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x16
call fcn.0040e770
mov dword [edi + 0x70], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x19
call fcn.0040e770
mov dword [edi + 0x1c], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x1a
call fcn.0040e770
mov dword [edi + 0x20], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x15
call fcn.0040e770
mov dword [edi + 0x24], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x17
call fcn.0040e770
mov dword [edi + 0x28], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x18
call fcn.0040e770
mov dword [edi + 0x2c], eax
pop ecx
test eax, eax
je 0x4084b4
push 0x137
call fcn.0040e770
mov dword [edi + 0x30], eax
pop ecx
test eax, eax
je 0x4084b4
push esi
call dword [sym.imp.USER32.dll_GetDpiForWindow]
mov word [edi + 0x10dc], ax
lea eax, [ebp - 0x2820]
push eax
call dword [sym.imp.USER32.dll_GetProcessDefaultLayout]
test eax, eax
je 0x407fc1
test byte [ebp - 0x2820], 1
je 0x407fc1
mov ebx, 0x2200
xor eax, eax
push eax
push dword [0x41edf4]
push 1
push esi
push eax
push eax
push eax
push eax
push 0x5001003f
push eax
push 0x401bd4
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x60], eax
test eax, eax
je 0x4084b4
push 0
push 0x401bf0
push eax
call dword [sym.imp.UxTheme.dll_SetWindowTheme]
push 4
push 4
push 0x112c
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push eax
push dword [0x41edf4]
push 2
push esi
push eax
push eax
push eax
push eax
push 0x52018a41
push eax
push 0x401c04
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi], eax
test eax, eax
je 0x4084b4
mov ecx, 0x4000
push ecx
push ecx
push 0x1036
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push eax
push dword [0x41edf4]
push eax
push esi
push eax
push eax
push eax
push eax
push 0x50010080
push eax
push 0x401c20
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
xor ebx, ebx
mov dword [edi + 4], eax
push ebx
push ebx
push 0x4076f0
push eax
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
push 1
push dword [edi + 4]
call dword [sym.imp.COMCTL32.dll_Ordinal_384]
push esi
mov ecx, edi
call fcn.0040757d
cmp dword [edi + 4], ebx
je 0x4084b4
mov eax, dword [ebp - 0x2814]
mov eax, dword [eax + 0x3c]
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [edi + 4]
mov dword [edi + 0x18], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov ecx, edi
call fcn.0040a0f1
test eax, eax
je 0x4084b4
mov ecx, edi
call fcn.0040a20f
push 0x44
lea eax, [ebp - 0x2898]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x2898], 0xffff0000
mov dword [ebp - 0x2894], 0xffff0002
mov dword [ebp - 0x2890], 0x67
mov dword [ebp - 0x2878], ebx
push 0x13
mov dword [ebp - 0x2874], ebx
mov dword [ebp - 0x2870], 1
mov dword [ebp - 0x286c], ebx
call fcn.0040e770
pop ecx
mov dword [ebp - 0x2880], eax
lea eax, [ebp - 0x2898]
push eax
push ebx
push 0x1132
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2880]
mov dword [ebp - 0x2898], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2878], 2
mov eax, ebx
mov dword [ebp - 0x2874], 3
mov dword [ebp - 0x2824], ebx
cmp eax, 5
je 0x4081ce
mov eax, dword [ebx + 0x401250]
lea ecx, [ebp - 0x808]
push 0x400
push ecx
mov dword [ebp - 0x2880], eax
mov eax, dword [ebx + 0x401254]
push 0
push eax
mov dword [ebp - 0x286c], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2870], eax
lea eax, [ebp - 0x2898]
push eax
push 0
push 0x1132
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x2824]
inc eax
add ebx, 0xc
mov dword [ebp - 0x2824], eax
cmp ebx, 0x3c
jb 0x408174
push dword [ebp - 0x2898]
push 2
push 0x1102
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2898]
push 9
push 0x110b
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp - 0x2814]
mov eax, dword [edi + 0x60]
and dword [edi + 0x14], 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0xc], eax
movzx eax, word [edi + 0x10dc]
push 0x60
push eax
mov dword [ebp - 0x2850], 6
push dword [ebx + 0x30]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x11
mov dword [ebp - 0x2848], eax
call fcn.0040e770
pop ecx
mov dword [ebp - 0x2844], eax
lea eax, [ebp - 0x2850]
push eax
push 0
push 0x1061
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2844]
call dword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, word [edi + 0x10dc]
push 0x60
push eax
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x1f
mov dword [ebp - 0x2848], eax
call fcn.0040e770
pop ecx
mov dword [ebp - 0x2844], eax
lea eax, [ebp - 0x2850]
push eax
push 1
push 0x1061
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2844]
call dword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, word [edi + 0x10dc]
push 0x60
push eax
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x12
mov dword [ebp - 0x2848], eax
call fcn.0040e770
pop ecx
mov dword [ebp - 0x2844], eax
lea eax, [ebp - 0x2850]
push eax
push 2
push 0x1061
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2844]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.USER32.dll_GetMenu]
mov ebx, dword [edi + 0x38]
mov dword [ebp - 0x2814], eax
test ebx, ebx
je 0x408334
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x2814]
push 0x3f
mov dword [edi + 0x38], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
and al, 1
mov byte [edi + 0x3d], al
jne 0x40837d
xor ebx, ebx
push ebx
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_GetSubMenu]
push ebx
mov esi, eax
push 0x291
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
push 0x300
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
push 0x2a1
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x40837f
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x40], eax
lea eax, [ebp - 0x281c]
push eax
push 0x401920
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4084a4
lea eax, [ebp - 0x280c]
mov dword [ebp - 0x280c], 0x2000
push eax
lea eax, [ebp - 0x2808]
push eax
lea eax, [ebp - 0x2810]
push eax
push ebx
push 0x401a40
push dword [ebp - 0x281c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408425
lea eax, [ebp - 0x280c]
push eax
lea eax, [ebp - 0x2808]
push eax
lea ecx, [ebp - 0x2810]
call fcn.0040ed4f
test eax, eax
jne 0x408425
cmp dword [ebp - 0x2810], 1
jne 0x408425
cmp dword [ebp - 0x280c], eax
jbe 0x408425
push 1
lea eax, [ebp - 0x2808]
mov ecx, edi
push eax
call fcn.00406ebb
push 4
pop esi
lea eax, [ebp - 0x280c]
mov dword [ebp - 0x280c], esi
push eax
lea eax, [ebp - 0x2818]
push eax
lea eax, [ebp - 0x2810]
push eax
push ebx
push 0x401a50
push dword [ebp - 0x281c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408498
lea eax, [ebp - 0x280c]
push eax
lea eax, [ebp - 0x2818]
push eax
lea ecx, [ebp - 0x2810]
call fcn.0040ed4f
test eax, eax
jne 0x408498
cmp dword [ebp - 0x2810], esi
jne 0x408498
cmp dword [ebp - 0x280c], eax
jbe 0x408498
cmp dword [ebp - 0x2818], eax
je 0x408498
mov dword [0x45fa0c], 1
push dword [ebp - 0x281c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.00407d1f
test eax, eax
js 0x4084b4
xor eax, eax
inc eax
jmp 0x4084b6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cc10
leave
ret 8