Function at 0x418428
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x41de68
call fcn.00405af4
mov edi, ecx
test dword [0x421b00], 0x200
je 0x418459
push edi
push 0x401910
push dword [0x421b0c]
push dword [0x421b08]
call fcn.0040973a
xor ebx, ebx
mov byte [0x421ba8], 1
cmp dword [edi + 0x5c], ebx
je 0x418471
push 0x1c084d
call fcn.00404f88
cmp byte [edi + 0x13b], bl
je 0x418483
push 0x1c084e
call fcn.00404f88
mov byte [edi + 0x13b], bl
cmp dword [edi + 0x38], ebx
je 0x418498
push 0x1c084f
call fcn.00404f88
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x30
pop esi
push esi
mov dword [edi + 0x38], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0x418ce8
mov dword [ebp - 0x38], 0x4016dc
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test ax, ax
jne 0x4184df
mov ebx, 0x80004005
jmp 0x4189bf
push ebx
mov byte [edi + 0x138], 1
call fcn.0041a496
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call esi
test eax, eax
jne 0x418547
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402850
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418539
mov dword [ebp - 0x14], 0x3a98
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x41854c
mov eax, 0x3a98
mov ecx, 0x2710
mov dword [edi + 0x238], eax
cmp eax, ecx
jae 0x418561
mov dword [edi + 0x238], ecx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call esi
test eax, eax
jne 0x4185b7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402908
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x7530
test eax, eax
je 0x4185a9
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x4185be
mov esi, 0x7530
mov eax, esi
mov dword [edi + 0x234], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418619
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402960
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41860b
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x41861b
mov eax, ebx
mov dword [edi + 0x23c], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x4028a8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418676
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x4029a8
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418668
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x418678
mov eax, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x8000000
mov dword [edi + 0x240], eax
mov eax, 0x4016dc
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x5c], eax
test eax, eax
je 0x4184d5
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x402a28
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4186f7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x4029f0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4186eb
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x402a28
push 0x80000001
mov dword [edi + 0x190], esi
mov dword [edi + 0x194], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41875c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x402a78
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41874e
mov dword [ebp - 0x10], 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x418761
mov eax, 0x1f4
mov dword [edi + 0x188], eax
mov dword [edi + 0x18c], ebx
cmp byte [0x4214d4], bl
je 0x4187dc
push ebx
push dword [edi + 0x5c]
call fcn.004189d7
test al, al
je 0x4184d5
mov eax, dword [edi + 0x190]
cmp dword [edi + 0x194], ebx
ja 0x418875
jb 0x4187a3
cmp eax, 0xffffffff
ja 0x418875
push 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xfff
pop eax
cmp byte [edi + 0x13c], bl
je 0x4187bd
mov eax, 0x105
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0041bcf4
add esp, 0x10
test eax, eax
jne 0x4187dc
push 0x1c0852
call fcn.00404f88
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0xffffffffffffffeb
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x418801
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4184d5
push 7
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 0x2710
pop eax
cmp byte [edi + 0x13c], bl
je 0x41881f
mov eax, 0x107
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.0041bcf4
add esp, 0x10
test eax, eax
jne 0x418845
push 0x1c0853
call fcn.00404f88
mov ecx, edi
call fcn.00419b55
push edi
lea ecx, [ebp - 0x30]
call fcn.0041a378
mov dword [ebp - 4], ebx
cmp dword [edi + 0x60], ebx
je 0x418884
cmp dword [edi + 0x64], ebx
je 0x418884
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00419464
mov eax, dword [ebp - 0x30]
shr eax, 0xb
test al, 1
je 0x41887a
mov eax, dword [edi + 0x60]
jmp 0x41887d
call fcn.0041669a
mov eax, dword [edi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
mov word [edi + 0x139], 0x101
call fcn.0041a3a4
mov esi, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push ebx
call esi
push 1
mov dword [edi + 0x198], eax
call esi
mov dword [edi + 0x19c], eax
cmp dword [edi + 0x198], ebx
je 0x4188be
test eax, eax
jne 0x4188c8
push 0x1c0854
call fcn.00404f88
mov eax, dword [edi + 0x198]
test eax, eax
je 0x418969
cmp dword [edi + 0x19c], ebx
je 0x418967
push 0x10
call fcn.00406e16
test eax, eax
je 0x4188f9
push edi
mov ecx, eax
call fcn.0041a21e
mov esi, eax
jmp 0x4188fb
mov esi, ebx
test esi, esi
jne 0x41892f
push 0x1c0855
call fcn.00404f88
mov eax, dword [edi + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x418920
push 0x1c0856
call fcn.00404f88
test esi, esi
je 0x41898d
lea eax, [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41898d
mov edx, dword [edi + 0x58]
lea eax, [edi + 0x1a0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [edx]
lea ecx, [esi + 8]
push ecx
push 0x2101
push edx
call dword [eax + 0x14]
test eax, eax
js 0x418909
mov eax, dword [edi + 0x1a0]
mov ecx, dword [eax]
push 0xffffffffffffffff
push dword [edi + 0x198]
push eax
call dword [ecx + 0x6c]
jmp 0x418920
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41897a
push eax
call esi
mov dword [edi + 0x198], ebx
mov eax, dword [edi + 0x19c]
test eax, eax
je 0x41898d
push eax
call esi
mov dword [edi + 0x19c], ebx
push dword [0x421ac0]
push ebx
push 0x41a4eb
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x244], eax
test eax, eax
jne 0x4189bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4189bf
push 0x24a759
call fcn.00404f88
cmp byte [edi + 0x13a], 0
jne 0x4189cf
mov ecx, edi
call fcn.004181c4
mov eax, ebx
call fcn.00405bcc
ret