Function at 0x429740
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x442be8
push 0x41ca70
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x445030]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
push ecx
mov eax, esp
mov dword [eax], 0
mov esi, dword [ebp + 8]
add esi, 0x38
call fcn.00412700
xor ecx, ecx
cmp eax, ecx
jne 0x4297c8
mov ecx, dword [0x4495ac]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, ecx
je 0x4297ed
push ebx
push 1
push edi
mov eax, dword [ebp + 8]
add eax, 0x38
call fcn.0042deb0
mov edx, dword [0x4495ac]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4299bc
mov eax, dword [ebp + 0x10]
cmp eax, ecx
je 0x429813
push eax
push edi
mov eax, dword [ebp + 8]
add eax, 0x38
push eax
call fcn.0042e220
mov eax, dword [0x4495ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4299bc
cmp edi, ecx
je 0x429867
movzx eax, word [edi]
cmp ax, cx
je 0x429867
mov esi, edi
mov dword [ebp - 0x20], esi
cmp ax, 0x22
jne 0x42984f
lea esi, [edi + 2]
mov dword [ebp - 0x20], esi
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x24], edi
push esi
call ebx
cmp edi, eax
jge 0x42984f
cmp word [esi + edi*2], 0x22
jne 0x429864
xor ecx, ecx
mov word [esi + edi*2], cx
push 0
push 1
push esi
mov eax, dword [ebp + 8]
add eax, 0x38
call fcn.0042deb0
jmp 0x4299bc
inc edi
jmp 0x429838
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
push SysReAllocStringLen
mov ecx, 0x2001f
mov edx, 0x43bb84
lea esi, [ebp - 0x30]
call fcn.00401f40
test eax, eax
je 0x4298a3
push SysReAllocStringLen
mov edx, 0x43bba8
call fcn.0040d960
mov dword [ebp + 0xc], 3
jmp 0x429999
mov ebx, 4
mov dword [ebp + 0x10], ebx
lea edx, [ebp + 0x10]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0x43bbcc
mov esi, dword [ebp - 0x30]
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x4298d3
cmp dword [ebp - 0x28], ebx
je 0x4298df
mov dword [ebp + 0xc], 3
jmp 0x429999
mov ebx, 3
cmp dword [ebp + 0xc], ebx
je 0x429999
mov dword [ebp - 0x28], 0x10
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x10]
push ecx
push 0
push 0x43bbe0
push esi
call edi
mov eax, dword [ebp - 0x34]
mov edx, eax
mov esi, dword [ebp - 0x3c]
sub edx, esi
cmp edx, 0x1f4
jg 0x429922
lea eax, [esi + 0x1f4]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
mov edi, ecx
mov edx, dword [ebp - 0x40]
sub edi, edx
cmp edi, 0x1f4
jg 0x42993d
lea ecx, [edx + 0x1f4]
mov dword [ebp - 0x38], ecx
test eax, eax
jl 0x429948
test esi, esi
jge 0x429957
mov dword [ebp - 0x3c], 0x64
mov eax, 0x2bc
mov dword [ebp - 0x34], eax
test edx, edx
jl 0x42995f
test ecx, ecx
jge 0x42996f
mov dword [ebp - 0x40], 0x64
mov dword [ebp - 0x38], 0x320
jmp 0x429977
cmp ecx, 0x1f4
jl 0x429996
cmp eax, 0x1f4
jle 0x429996
mov eax, dword [ebp + 8]
add eax, 0x3c
push eax
lea eax, [ebp - 0x40]
call fcn.0040d9f0
mov dword [ebp + 0xc], 1
jmp 0x429999
mov dword [ebp + 0xc], ebx
lea esi, [ebp - 0x30]
call fcn.00401f90
push 0
push 1
mov ecx, dword [0x44961c]
push ecx
mov eax, dword [ebp + 8]
add eax, 0x38
call fcn.0042deb0
call fcn.00401fc0
push 3
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x3c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x407
mov eax, dword [ebx + 0x298]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4297ab
push str.SHAutoComplete
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429a0d
push 6
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call fcn.00418640
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc