Function at 0x433f70
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x150
mov eax, dword [0x887490]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
mov ebx, dword [esp + 0x158]
mov dword [esp + 4], 0
test ebx, ebx
je 0x434ac7
cmp dword [ebx], 0x708
jne 0x434ac7
push ebp
push esi
push edi
push 0x704
lea eax, [ebx + 4]
push 0
push eax
call fcn.0050abb0
add esp, 0xc
mov dword [ebx], 0x708
cmp dword [0x8b3ab0], 0
je 0x4343a2
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
push reloc.ace32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4343a2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4343a2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x18], 0x104
push ecx
push 0
push 0
push str.ThemeActive
push eax
call ebp
test eax, eax
je 0x434031
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4343a2
lea eax, [esp + 0x58]
push eax
call fcn.005147ff
add esp, 4
test eax, eax
jne 0x434051
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4343a2
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push str.DllName
push dword [esp + 0x24]
call ebp
test eax, eax
je 0x434085
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4343a2
push 0x103
lea edi, [ebx + 0x10]
push edi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea esi, [esp + 0x58]
mov ecx, edi
sub esi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4340a1
lea eax, [esp + 0x58]
push eax
call fcn.00515801
lea eax, [esp + 0x5c]
push str..msstyles
push eax
call fcn.0050b160
add esp, 0xc
test eax, eax
jne 0x4340ed
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
push 0
push edi
call fcn.0050abb0
add esp, 0xc
jmp 0x4343a2
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea ebp, [ebx + 0x114]
push ebp
push 0
push 0
push str.ColorName
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x10]
test eax, eax
je 0x434124
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x434150
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x434130
lea eax, [esp + 0x58]
push 0x5c
push eax
call fcn.0050b020
add esp, 8
test eax, eax
jne 0x434172
push 0x104
push 0
push edi
call fcn.0050abb0
push 0x104
push 0
push ebp
call fcn.0050abb0
add esp, 0x18
jmp 0x4343a2
lea ecx, [esp + 0x58]
mov byte [eax], 0
dec ecx
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x434180
mov eax, dword [str._shell_]
mov esi, ebp
mov dword [ecx], eax
mov eax, dword [0x73a8e0]
mov dword [ecx + 4], eax
nop dword [eax + eax]
mov al, byte [ebp]
inc ebp
test al, al
jne 0x4341a0
lea edi, [esp + 0x58]
sub ebp, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4341b0
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x58]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4341d0
mov eax, dword [str._shellstyle.dll]
lea esi, [ebx + 0x218]
mov dword [ecx], eax
mov edx, esi
mov eax, dword [0x73a8e8]
mov dword [ecx + 4], eax
mov eax, dword [0x73a8ec]
mov dword [ecx + 8], eax
mov eax, dword [0x73a8f0]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x58]
mov eax, ecx
sub edx, eax
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x434210
cmp dword [esp + 0x168], 0
jne 0x4343a2
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebp, eax
test ebp, ebp
je 0x4343a2
push str.UIFILE
push 1
push ebp
mov dword [ebx + 0xc], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x43439b
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x43439b
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
je 0x434394
test eax, eax
je 0x434394
push esi
push eax
call fcn.00436bc0
mov esi, eax
add esp, 8
test esi, esi
je 0x434394
push ebp
push ebx
push esi
call fcn.00434f00
add esp, 0xc
test eax, eax
jne 0x434500
mov eax, dword [ebx + 0x4e8]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4342d0
push eax
call edi
mov eax, dword [ebx + 0x530]
test eax, eax
je 0x4342dd
push eax
call edi
mov eax, dword [ebx + 0x534]
test eax, eax
je 0x4342ea
push eax
call edi
mov eax, dword [ebx + 0x538]
test eax, eax
je 0x4342f7
push eax
call edi
mov eax, dword [ebx + 0x53c]
test eax, eax
je 0x434304
push eax
call edi
mov eax, dword [ebx + 0x540]
test eax, eax
je 0x434311
push eax
call edi
mov eax, dword [ebx + 0x544]
test eax, eax
je 0x43431e
push eax
call edi
mov eax, dword [ebx + 0x67c]
test eax, eax
je 0x43432b
push eax
call edi
mov eax, dword [ebx + 0x6c4]
test eax, eax
je 0x434338
push eax
call edi
mov eax, dword [ebx + 0x6c8]
test eax, eax
je 0x434345
push eax
call edi
mov eax, dword [ebx + 0x6cc]
test eax, eax
je 0x434352
push eax
call edi
mov eax, dword [ebx + 0x6d0]
test eax, eax
je 0x43435f
push eax
call edi
mov eax, dword [ebx + 0x6d4]
test eax, eax
je 0x43436c
push eax
call edi
mov eax, dword [ebx + 0x6d8]
test eax, eax
je 0x434380
push eax
call edi
nop dword [eax]
push esi
mov esi, dword [esi + 4]
call fcn.005142ca
add esp, 4
test esi, esi
jne 0x434380
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 5
mov dword [ebx + 4], 1
call esi
push 5
mov dword [ebx + 0x33c], eax
call esi
push 0x12
mov dword [ebx + 0x340], eax
mov dword [ebx + 0x344], 0
mov dword [ebx + 0x354], 0xc
mov dword [ebx + 0x350], 0xc
mov dword [ebx + 0x34c], 0xc
mov dword [ebx + 0x348], 0xc
mov dword [ebx + 0x36c], 6
mov dword [ebx + 0x370], 0
mov dword [ebx + 0x374], 4
mov dword [ebx + 0x378], 0
mov dword [ebx + 0x37c], 0
mov dword [ebx + 0x380], 4
mov dword [ebx + 0x384], 0
mov dword [ebx + 0x388], 0
mov dword [ebx + 0x38c], 0
mov dword [ebx + 0x390], 4
mov dword [ebx + 0x394], 0
mov dword [ebx + 0x398], 0
call esi
push 0x1a
mov dword [ebx + 0x39c], eax
call esi
mov ebp, dword [sym.imp.GDI32.dll_GetStockObject]
lea edi, [ebx + 0x3dc]
mov dword [ebx + 0x3a0], eax
lea eax, [esp + 0x1c]
movups xmm0, xmmword [ebx + 0x36c]
push eax
push 0x11
movups xmmword [ebx + 0x3a4], xmm0
movups xmm0, xmmword [ebx + 0x37c]
movups xmmword [ebx + 0x3b4], xmm0
movups xmm0, xmmword [ebx + 0x38c]
movups xmmword [ebx + 0x3c4], xmm0
movq xmm0, qword [ebx + 0x39c]
movq qword [ebx + 0x3d4], xmm0
call ebp
push eax
call fcn.00434af0
test eax, eax
je 0x43453e
lea ecx, [esp + 0x38]
mov eax, ecx
sub edi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x4344e2
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x4e0], eax
jmp 0x434559
push esi
mov esi, dword [esi + 4]
call fcn.005142ca
add esp, 4
test esi, esi
jne 0x434500
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.005091ef
add esp, 0x150
ret 8
mov eax, dword [str.Arial]
mov dword [edi], eax
mov ax, word [0x73a874]
mov word [edi + 4], ax
mov dword [ebx + 0x4e0], 0xfffffff3
push 0x12
mov dword [ebx + 0x4e4], 0xf
call esi
push 0x12
mov dword [ebx + 0x4f4], eax
call esi
push 0xf
mov dword [ebx + 0x4f8], eax
mov dword [ebx + 0x4fc], 0x21
mov dword [ebx + 0x500], 0x2bc
mov dword [ebx + 0x504], 0xa
mov dword [ebx + 0x508], 0
mov dword [ebx + 0x50c], 1
mov dword [ebx + 0x510], 0
mov dword [ebx + 0x514], 2
mov dword [ebx + 0x518], 2
mov dword [ebx + 0x51c], 2
mov dword [ebx + 0x520], 0
call esi
mov dword [ebx + 0x524], eax
lea eax, [ebx + 0x52c]
push eax
lea eax, [ebx + 0x528]
mov dword [ebx + 0x4ec], 0xba
push eax
push 0xff
push 0x12
mov dword [ebx + 0x4f0], 0x15
call esi
push eax
push 0xf0e0d
push 0x6b
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x530], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x6c
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x534], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x6d
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x538], eax
push 0
push 0
push 0xff
push 0x12
call esi
push eax
push 0xf0e0d
push 0x6e
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x53c], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x6f
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x540], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x70
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x544], eax
push 5
call esi
push 0xf
mov dword [ebx + 0x548], eax
call esi
mov dword [ebx + 0x55c], eax
lea edi, [ebx + 0x570]
lea eax, [esp + 0x1c]
mov dword [ebx + 0x54c], 1
push eax
push 0x11
mov dword [ebx + 0x554], 1
mov dword [ebx + 0x550], 0
mov dword [ebx + 0x558], 1
mov dword [ebx + 0x568], 0xc
mov dword [ebx + 0x560], 0xc
mov dword [ebx + 0x56c], 0xa
mov dword [ebx + 0x564], 0xa
call ebp
push eax
call fcn.00434af0
test eax, eax
je 0x434799
lea ecx, [esp + 0x38]
mov eax, ecx
sub edi, eax
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x434780
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x674], eax
jmp 0x4347b4
mov eax, dword [str.Arial]
mov dword [edi], eax
mov ax, word [0x73a874]
mov word [edi + 4], ax
mov dword [ebx + 0x674], 0xfffffff3
push 0xe
mov dword [ebx + 0x678], 0xf
call esi
push 0xe
mov dword [ebx + 0x688], eax
call esi
push 0xd
mov dword [ebx + 0x68c], eax
mov dword [ebx + 0x690], 0x21
mov dword [ebx + 0x694], 0x2bc
mov dword [ebx + 0x698], 0xa
mov dword [ebx + 0x69c], 0
mov dword [ebx + 0x6a0], 1
mov dword [ebx + 0x6a4], 0
mov dword [ebx + 0x6a8], 2
mov dword [ebx + 0x6ac], 2
mov dword [ebx + 0x6b0], 2
mov dword [ebx + 0x6b4], 0
call esi
mov dword [ebx + 0x6b8], eax
lea eax, [ebx + 0x6c0]
push eax
lea eax, [ebx + 0x6bc]
mov dword [ebx + 0x680], 0xba
push eax
push 0xff
push 0xe
mov dword [ebx + 0x684], 0x15
call esi
push eax
push 0xf0e0d
push 0x6b
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x6c4], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6c
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x6c8], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6d
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x6cc], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6e
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x6d0], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6f
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x6d4], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x70
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x6d8], eax
push 5
call esi
push 0xd
mov dword [ebx + 0x6dc], eax
call esi
mov dword [ebx + 0x6f4], eax
lea eax, [ebx + 0x320]
push eax
lea eax, [ebx + 0x31c]
mov dword [ebx + 0x6e0], 0x44
push eax
push 0xff
push 0x12
mov dword [ebx + 0x6e4], 1
mov dword [ebx + 0x6ec], 1
mov dword [ebx + 0x6e8], 0
mov dword [ebx + 0x6f0], 1
mov dword [ebx + 0x700], 0xc
mov dword [ebx + 0x6f8], 0xc
mov dword [ebx + 0x704], 0xa
mov dword [ebx + 0x6fc], 0xa
call esi
push eax
push 0xf0e0d
push 0x74
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x324], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x75
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x328], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x76
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x32c], eax
push 0
push 0
push 0xff
push 0x12
call esi
push eax
push 0xf0e0d
push 0x71
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x330], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x72
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x334], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x73
push dword [0x8b3ab4]
call fcn.004368f0
add esp, 0x1c
mov dword [ebx + 0x338], eax
jmp 0x43451e
mov ecx, dword [esp + 0x150]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.005091ef
add esp, 0x150
ret 8