Function at 0x48815c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x4a4ff0
call fcn.0043fcf6
mov edi, ecx
test dword [0x4f2e00], 0x200
je 0x48818d
push edi
push 0x42fc58
push dword [0x4f2e0c]
push dword [0x4f2e08]
call fcn.0047cafd
xor ebx, ebx
mov byte [0x4f2ea8], 1
cmp dword [edi + 0x5c], ebx
je 0x4881a5
push 0x1c084d
call fcn.00456bc8
cmp byte [edi + 0x13b], bl
je 0x4881b7
push 0x1c084e
call fcn.00456bc8
mov byte [edi + 0x13b], bl
cmp dword [edi + 0x38], ebx
je 0x4881cc
push 0x1c084f
call fcn.00456bc8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x30
pop esi
push esi
mov dword [edi + 0x38], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0x488a1c
mov dword [ebp - 0x38], 0x42fa20
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test ax, ax
jne 0x488213
mov ebx, 0x80004005
jmp 0x4886f3
push ebx
mov byte [edi + 0x138], 1
call fcn.0048a1a7
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x430b50
push 0x80000001
call esi
test eax, eax
jne 0x48827b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x430af8
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x48826d
mov dword [ebp - 0x14], 0x3a98
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x488280
mov eax, 0x3a98
mov ecx, 0x2710
mov dword [edi + 0x238], eax
cmp eax, ecx
jae 0x488295
mov dword [edi + 0x238], ecx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x430b50
push 0x80000001
call esi
test eax, eax
jne 0x4882eb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x430bb0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x7530
test eax, eax
je 0x4882dd
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x4882f2
mov esi, 0x7530
mov eax, esi
mov dword [edi + 0x234], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x430b50
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48834d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x430c08
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x48833f
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x48834f
mov eax, ebx
mov dword [edi + 0x23c], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x430b50
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4883aa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x430c50
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x48839c
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x4883ac
mov eax, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x8000000
mov dword [edi + 0x240], eax
mov eax, 0x42fa20
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x5c], eax
test eax, eax
je 0x488209
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x430cd0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48842b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x430c98
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x48841f
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x430cd0
push 0x80000001
mov dword [edi + 0x190], esi
mov dword [edi + 0x194], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x488490
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x430d20
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x488482
mov dword [ebp - 0x10], 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x488495
mov eax, 0x1f4
mov dword [edi + 0x188], eax
mov dword [edi + 0x18c], ebx
cmp byte [0x4e58dc], bl
je 0x488510
push ebx
push dword [edi + 0x5c]
call fcn.0048870b
test al, al
je 0x488209
mov eax, dword [edi + 0x190]
cmp dword [edi + 0x194], ebx
ja 0x4885a9
jb 0x4884d7
cmp eax, 0xffffffff
ja 0x4885a9
push 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xfff
pop eax
cmp byte [edi + 0x13c], bl
je 0x4884f1
mov eax, 0x105
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0049f081
add esp, 0x10
test eax, eax
jne 0x488510
push 0x1c0852
call fcn.00456bc8
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0xffffffffffffffeb
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x488535
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x488209
push 7
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 0x2710
pop eax
cmp byte [edi + 0x13c], bl
je 0x488553
mov eax, 0x107
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0049f081
add esp, 0x10
test eax, eax
jne 0x488579
push 0x1c0853
call fcn.00456bc8
mov ecx, edi
call fcn.00489889
push edi
lea ecx, [ebp - 0x30]
call fcn.0048a089
mov dword [ebp - 4], ebx
cmp dword [edi + 0x60], ebx
je 0x4885b8
cmp dword [edi + 0x64], ebx
je 0x4885b8
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00489198
mov eax, dword [ebp - 0x30]
shr eax, 0xb
test al, 1
je 0x4885ae
mov eax, dword [edi + 0x60]
jmp 0x4885b1
call fcn.004863d9
mov eax, dword [edi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
mov word [edi + 0x139], 0x101
call fcn.0048a0b5
mov esi, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push ebx
call esi
push 1
mov dword [edi + 0x198], eax
call esi
mov dword [edi + 0x19c], eax
cmp dword [edi + 0x198], ebx
je 0x4885f2
test eax, eax
jne 0x4885fc
push 0x1c0854
call fcn.00456bc8
mov eax, dword [edi + 0x198]
test eax, eax
je 0x48869d
cmp dword [edi + 0x19c], ebx
je 0x48869b
push 0x10
call fcn.00476d4a
test eax, eax
je 0x48862d
push edi
mov ecx, eax
call fcn.00489f2f
mov esi, eax
jmp 0x48862f
mov esi, ebx
test esi, esi
jne 0x488663
push 0x1c0855
call fcn.00456bc8
mov eax, dword [edi + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x488654
push 0x1c0856
call fcn.00456bc8
test esi, esi
je 0x4886c1
lea eax, [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4886c1
mov edx, dword [edi + 0x58]
lea eax, [edi + 0x1a0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [edx]
lea ecx, [esi + 8]
push ecx
push 0x2101
push edx
call dword [eax + 0x14]
test eax, eax
js 0x48863d
mov eax, dword [edi + 0x1a0]
mov ecx, dword [eax]
push 0xffffffffffffffff
push dword [edi + 0x198]
push eax
call dword [ecx + 0x6c]
jmp 0x488654
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4886ae
push eax
call esi
mov dword [edi + 0x198], ebx
mov eax, dword [edi + 0x19c]
test eax, eax
je 0x4886c1
push eax
call esi
mov dword [edi + 0x19c], ebx
push dword [0x4f2dd8]
push ebx
push 0x48a1fc
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x244], eax
test eax, eax
jne 0x4886f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4886f3
push 0x24a759
call fcn.00456bc8
cmp byte [edi + 0x13a], 0
jne 0x488703
mov ecx, edi
call fcn.00487ef8
mov eax, ebx
call fcn.0043fdce
ret