Function at 0x1019b4a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ecx
mov esi, dword [ebx + 0x74]
mov ebx, ecx
push edi
lea ecx, [ebp - 0x150]
push ecx
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
xor ecx, ecx
lea edi, [ebx + 0xc4]
cmp esi, 2
mov dword [ebp - 0x160], edi
mov esi, dword [ebp - 0x164]
sete cl
push ecx
push dword [eax]
push dword [esi + 0x40]
call fcn.100286f0
mov ecx, eax
call fcn.1002cbc0
mov edx, dword [ebp - 0x150]
mov dword [edi], eax
add edx, 0xfffffff0
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1019b526
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebx + 0x10c], 8
lea eax, [ebx + 0xc4]
mov dword [ebp - 0x1a4], eax
lea eax, [ebx + 0xf8]
mov dword [ebx + 0xf0], 0
mov dword [eax + 0x10], 0
jb 0x1019b554
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebx + 0x110]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ecx
jb 0x1019b56a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebx + 0x128]
cmp dword [eax + 0x14], 8
mov dword [ebx + 0xf4], ecx
mov dword [eax + 0x10], ecx
jb 0x1019b586
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x10]
push esi
push ecx
lea ecx, [ebx + 0xd8]
call fcn.10020ef0
mov ebx, dword [ebp - 8]
cmp byte [ebx + 0xd], 0
jne 0x1019b5b9
mov eax, dword [esi]
cmp eax, dword [ebx + 0x10]
jb 0x1019b5b9
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ecx + 0xd8]
jmp 0x1019b5c7
mov ecx, dword [ebp - 0x15c]
mov ebx, dword [ecx + 0xd8]
mov eax, ebx
cmp ebx, eax
jne 0x1019b5d2
xor esi, esi
jmp 0x1019c94d
mov eax, dword [esi]
mov dword [ecx + 0xec], eax
xor eax, eax
mov edx, dword [esi + 0x74]
cmp edx, 2
mov dword [ebp - 0x158], edx
sete al
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ecx + 0x218]
test eax, eax
je 0x1019b7ae
cmp eax, dword [esi]
jne 0x1019b7ae
cmp edx, 2
je 0x1019b6d3
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x1019b61f
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x1019b624
mov eax, 0x10219d7c
push eax
lea ecx, [ebp - 0x10c]
call fcn.10132670
mov ecx, dword [ebp - 0x15c]
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x10c]
push dword [eax]
push dword [esi + 0x44]
push dword [esi + 0x40]
push dword [esi]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.10137700
mov edx, dword [ebp - 0x150]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1019b67a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.1000ad40
test eax, eax
je 0x1019b68c
mov esi, 0xf013f
mov eax, esi
jmp 0x1019b696
mov esi, 0xf003f
mov eax, 0x200
push 0
push 0x10229d04
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10c]
call fcn.10136720
push esi
push 0x10229d04
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003390
lea ecx, [ebp - 0x10c]
call fcn.10132d00
push str.HKLM_
lea ecx, [ebp - 0x158]
call fcn.10004700
mov esi, eax
mov ecx, dword [esi]
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x1019b6f9
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x1019b70f
call fcn.10003980
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x1019c96d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x150], eax
mov eax, dword [esi]
push 0x3e
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.100258c0
mov eax, dword [ebp - 0x160]
add esp, 0x14
mov esi, dword [ebp - 0x150]
push 0x1021b9bc
push 0
push 0x10229d04
push esi
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1019b777
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x158]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1019b792
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x164]
cmp dword [ebx + 0x74], 2
jne 0x1019c943
mov dword [ebx + 0x74], 3
jmp 0x1019c943
mov eax, dword [0x1025a378]
cmp eax, 0xffffffff
je 0x1019b80b
cmp dword [0x1025a37c], 0xffffffff
je 0x1019b80b
push eax
mov dword [ebp - 0x150], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1019b80b
mov eax, dword [0x1025a380]
test eax, eax
je 0x1019b80b
lea ecx, [ebp - 0x150]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push dword [0x1025a378]
call esi
push dword [ebp - 0x150]
push dword [0x1025a37c]
call esi
mov esi, dword [ebp - 0x164]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
sub eax, ecx
mov dword [ebp - 0x150], ecx
and eax, 0xfffffffc
cmp eax, 4
jne 0x1019ba49
push ecx
lea eax, [ebp - 0x10]
mov ecx, 0x10259c60
push eax
call fcn.10020fd0
mov eax, dword [ebp - 8]
cmp byte [eax + 0xd], 0
jne 0x1019ba49
add eax, 0x10
mov ecx, 0x10259c60
push eax
push dword [ebp - 0x150]
call fcn.10023540
test al, al
jne 0x1019ba49
mov eax, dword [ebp - 8]
cmp eax, dword [0x10259c60]
je 0x1019ba49
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1019b880
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x1019b885
mov eax, 0x10219d7c
push eax
lea ecx, [ebp - 0x14c]
call fcn.10195b20
mov ecx, dword [ebp - 0x15c]
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x134]
push dword [eax]
push dword [esi + 0x44]
push dword [esi + 0x40]
push dword [esi]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.10137700
mov edx, dword [ebp - 0x150]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1019b8db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi + 0x28]
lea ecx, [ebp - 0x138]
call fcn.10004870
call fcn.10003980
test eax, eax
je 0x1019c96d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov esi, eax
call fcn.10003980
test eax, eax
je 0x1019c96d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edi, eax
call fcn.10003980
test eax, eax
je 0x1019c96d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x15c]
add eax, 0x10
push 0
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x5c]
mov ebx, dword [ebp - 0x164]
lea eax, [ebp - 0x14c]
push dword [ebp - 0x154]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push dword [eax]
call dword [edx + 0x68]
cmp dword [ebp - 0x158], 2
je 0x1019b989
mov ecx, dword [ebp - 0x15c]
call fcn.101a9500
push 0
mov ecx, 0x1025a378
call fcn.10009a80
cmp dword [ebx + 0x74], 2
jne 0x1019b9a2
mov dword [ebx + 0x74], 3
call fcn.1019b2b0
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1019b9f3
mov ecx, dword [ebp - 8]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1019b9d4
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1019c977
push ecx
push edx
call fcn.102134ff
add esp, 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x150]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1019ba13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1019ba27
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1019ba39
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x14c]
call fcn.10196000
jmp 0x1019c948
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1019ba5d
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x1019ba62
mov eax, 0x10219d7c
push eax
lea ecx, [ebp - 0x14c]
call fcn.10195b20
mov ecx, dword [ebp - 0x15c]
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x134]
push dword [eax]
push dword [esi + 0x44]
push dword [esi + 0x40]
push dword [esi]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.10137700
mov edx, dword [ebp - 0x150]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1019bab6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x40]
mov eax, dword [ebp - 0x160]
mov edi, dword [ebp - 0x154]
push dword [eax]
push edi
push 0x200
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID_
push SysReAllocString
call fcn.10187b80
push dword [ebp - 0x40]
mov eax, dword [ebp - 0x160]
push dword [eax]
push edi
push 0x100
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID_
push SysReAllocString
call fcn.10187b80
mov ecx, dword [ebp - 0x15c]
add esp, 0x38
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1c], eax
cmp ebx, dword [ecx + 0xd8]
je 0x1019bb1f
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14c]
push eax
push esi
call fcn.101a54b0
mov eax, dword [ebp - 0x15c]
cmp ebx, dword [eax + 0xd8]
je 0x1019c90b
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x18]
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x1019c90b
push dword [ebx + 0x18]
mov ecx, 0x10259b48
push str.CLSID
call fcn.10060d00
test eax, eax
jne 0x1019c90b
push dword [ebp - 0x40]
mov esi, dword [ebp - 0x160]
push dword [esi]
push edi
push 0x200
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace_
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10187b80
push dword [ebp - 0x40]
push dword [esi]
push edi
push 0x100
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace_
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10187b80
push dword [ebp - 0x40]
push dword [esi]
push edi
push 0x200
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace_
push SysReAllocString
call fcn.10187b80
add esp, 0x54
push dword [ebp - 0x40]
push dword [esi]
push edi
push 0x100
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace_
push SysReAllocString
call fcn.10187b80
push dword [ebp - 0x40]
push dword [esi]
push edi
push 0x200
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace_
push SysReAllocString
call fcn.10187b80
push dword [ebp - 0x40]
push dword [esi]
push edi
push 0x100
push dword [ebx + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace_
push SysReAllocString
call fcn.10187b80
add esp, 0x54
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x10], 0
call fcn.1001e380
push 0x52
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel_
lea ecx, [ebp - 0x154]
call fcn.10004050
mov esi, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1019bc91
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bc8e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bc83
mov eax, dword [eax + 0x11c]
jmp 0x1019bc85
xor eax, eax
test eax, eax
je 0x1019bc8e
push esi
call eax
jmp 0x1019bc91
push esi
call edi
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019bcca
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bcc7
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bcbc
mov eax, dword [eax + 0x11c]
jmp 0x1019bcbe
xor eax, eax
test eax, eax
je 0x1019bcc7
push esi
call eax
jmp 0x1019bcca
push esi
call edi
push 0x2021f
push dword [ebp - 0x154]
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ecx, eax
call fcn.10004230
test eax, eax
jne 0x1019bebe
mov esi, dword [ebp - 0x10]
mov edi, dword [ebx + 0x18]
mov dword [ebp - 0x150], eax
or eax, 0xffffffff
test esi, esi
je 0x1019bd5d
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bd44
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bd2b
mov eax, dword [eax + 0x110]
jmp 0x1019bd2d
xor eax, eax
test eax, eax
je 0x1019bd44
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1019bd59
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1019bdba
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1019bdb6
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bda1
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bd88
mov eax, dword [eax + 0x110]
jmp 0x1019bd8a
xor eax, eax
test eax, eax
je 0x1019bda1
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1019bdb6
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1019be18
mov esi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKLM_
lea ecx, [ebp - 0x17c]
call fcn.10004700
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push esi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x178]
call int.10008f10
lea ecx, [ebp - 0x17c]
call int.10008f10
cmp dword [ebp - 0x158], 2
je 0x1019beb8
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebx + 0x18]
test esi, esi
je 0x1019be79
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019be71
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019be65
mov eax, dword [eax + 0xf0]
jmp 0x1019be67
xor eax, eax
test eax, eax
je 0x1019be71
push edi
push esi
call eax
jmp 0x1019be79
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019beb8
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019beb0
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bea4
mov eax, dword [eax + 0xf0]
jmp 0x1019bea6
xor eax, eax
test eax, eax
je 0x1019beb0
push edi
push esi
call eax
jmp 0x1019beb8
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1019befe
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bef4
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bee9
mov eax, dword [eax + 0x11c]
jmp 0x1019beeb
xor eax, eax
test eax, eax
je 0x1019bef4
push esi
call eax
jmp 0x1019bef7
push esi
call edi
mov dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019bf3e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bf34
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bf29
mov eax, dword [eax + 0x11c]
jmp 0x1019bf2b
xor eax, eax
test eax, eax
je 0x1019bf34
push esi
call eax
jmp 0x1019bf37
push esi
call edi
mov dword [ebp - 0x10], 0
push 0x2011f
push dword [ebp - 0x154]
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ecx, eax
call fcn.10004230
test eax, eax
jne 0x1019c12c
mov esi, dword [ebp - 0x10]
mov edi, dword [ebx + 0x18]
mov dword [ebp - 0x150], eax
or eax, 0xffffffff
test esi, esi
je 0x1019bfd1
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bfb8
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bf9f
mov eax, dword [eax + 0x110]
jmp 0x1019bfa1
xor eax, eax
test eax, eax
je 0x1019bfb8
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1019bfcd
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1019c02e
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1019c02a
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c015
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019bffc
mov eax, dword [eax + 0x110]
jmp 0x1019bffe
xor eax, eax
test eax, eax
je 0x1019c015
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1019c02a
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1019c08c
mov esi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKLM_
lea ecx, [ebp - 0x184]
call fcn.10004700
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push esi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x180]
call int.10008f10
lea ecx, [ebp - 0x184]
call int.10008f10
cmp dword [ebp - 0x158], 2
je 0x1019c12c
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebx + 0x18]
test esi, esi
je 0x1019c0ed
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c0e5
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c0d9
mov eax, dword [eax + 0xf0]
jmp 0x1019c0db
xor eax, eax
test eax, eax
je 0x1019c0e5
push edi
push esi
call eax
jmp 0x1019c0ed
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019c12c
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c124
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c118
mov eax, dword [eax + 0xf0]
jmp 0x1019c11a
xor eax, eax
test eax, eax
je 0x1019c124
push edi
push esi
call eax
jmp 0x1019c12c
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1019c181
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c16f
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c157
mov eax, dword [eax + 0x11c]
jmp 0x1019c159
xor eax, eax
test eax, eax
je 0x1019c16f
push esi
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
jmp 0x1019c187
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call edi
mov dword [ebp - 0x14], 0
jmp 0x1019c187
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019c1c7
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c1bd
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c1b2
mov eax, dword [eax + 0x11c]
jmp 0x1019c1b4
xor eax, eax
test eax, eax
je 0x1019c1bd
push esi
call eax
jmp 0x1019c1c0
push esi
call edi
mov dword [ebp - 0x10], 0
push 0x2021f
push dword [ebp - 0x154]
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0xffffffff
push SysReAllocString
push eax
mov ecx, eax
call fcn.10004230
test eax, eax
jne 0x1019c3b7
mov esi, dword [ebp - 0x10]
mov edi, dword [ebx + 0x18]
mov dword [ebp - 0x150], eax
or eax, 0xffffffff
test esi, esi
je 0x1019c25a
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c241
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c228
mov eax, dword [eax + 0x110]
jmp 0x1019c22a
xor eax, eax
test eax, eax
je 0x1019c241
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1019c256
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1019c2b7
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1019c2b3
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c29e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c285
mov eax, dword [eax + 0x110]
jmp 0x1019c287
xor eax, eax
test eax, eax
je 0x1019c29e
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1019c2b3
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1019c315
mov esi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKCU_
lea ecx, [ebp - 0x18c]
call fcn.10004700
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push esi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x188]
call int.10008f10
lea ecx, [ebp - 0x18c]
call int.10008f10
mov edi, dword [ebp - 0x158]
cmp edi, 2
je 0x1019c3bd
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebx + 0x18]
test esi, esi
je 0x1019c378
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c370
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c364
mov eax, dword [eax + 0xf0]
jmp 0x1019c366
xor eax, eax
test eax, eax
je 0x1019c370
push edi
push esi
call eax
jmp 0x1019c378
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019c3b7
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c3af
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c3a3
mov eax, dword [eax + 0xf0]
jmp 0x1019c3a5
xor eax, eax
test eax, eax
je 0x1019c3af
push edi
push esi
call eax
jmp 0x1019c3b7
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [ebp - 0x158]
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1019c401
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c3f3
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c3e8
mov eax, dword [eax + 0x11c]
jmp 0x1019c3ea
xor eax, eax
test eax, eax
je 0x1019c3f3
push esi
call eax
jmp 0x1019c3fa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1019c445
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c437
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c42c
mov eax, dword [eax + 0x11c]
jmp 0x1019c42e
xor eax, eax
test eax, eax
je 0x1019c437
push esi
call eax
jmp 0x1019c43e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
push 0x2011f
push dword [ebp - 0x154]
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0xffffffff
push SysReAllocString
push eax
mov ecx, eax
call fcn.10004230
test eax, eax
jne 0x1019c5bb
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx + 0x18]
mov dword [ebp - 0x150], eax
or eax, 0xffffffff
test edi, edi
je 0x1019c4d8
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c4bf
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c4a6
mov eax, dword [eax + 0x110]
jmp 0x1019c4a8
xor eax, eax
test eax, eax
je 0x1019c4bf
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push esi
push edi
call eax
jmp 0x1019c4d4
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1019c535
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x1019c531
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c51c
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1019c503
mov eax, dword [eax + 0x110]
jmp 0x1019c505
xor eax, eax
test eax, eax
je 0x1019c51c
push 0
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0
push esi
push edi
call eax
jmp 0x1019c531
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1019c593
mov esi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKCU_
lea ecx, [ebp - 0x168]
call fcn.10004700
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push esi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x190]
call int.10008f10
lea ecx, [ebp - 0x168]
call int.10008f10
mov edi, dword [ebp - 0x158]
cmp edi, 2
je 0x1019c5bb
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
push dword [ebx + 0x18]
lea ecx, [ebp - 0x14]
call fcn.1005fb70
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsClassicStartMenu_
lea ecx, [ebp - 0x154]
call fcn.1006cbc0
mov esi, dword [ebp - 0x154]
lea ecx, [ebp - 0x14]
push 0x2021f
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003db0
test eax, eax
jne 0x1019c690
push eax
push eax
mov dword [ebp - 0x168], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x168]
push eax
push dword [ebx + 0x18]
call fcn.10198300
test eax, eax
jne 0x1019c66e
mov edi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKLM_
lea ecx, [ebp - 0x16c]
call fcn.10004700
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push edi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x194]
call int.10008f10
lea ecx, [ebp - 0x16c]
call int.10008f10
mov edi, dword [ebp - 0x158]
cmp edi, 2
je 0x1019c690
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
push dword [ebx + 0x18]
lea ecx, [ebp - 0x14]
call fcn.1005fb70
push 0x2011f
push esi
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.10003db0
test eax, eax
jne 0x1019c74f
push eax
push eax
mov dword [ebp - 0x16c], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x16c]
push eax
push dword [ebx + 0x18]
call fcn.10198300
test eax, eax
jne 0x1019c72d
mov edi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKLM_
lea ecx, [ebp - 0x170]
call fcn.10004700
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push edi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x198]
call int.10008f10
lea ecx, [ebp - 0x170]
call int.10008f10
mov edi, dword [ebp - 0x158]
cmp edi, 2
je 0x1019c74f
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
push dword [ebx + 0x18]
lea ecx, [ebp - 0x14]
call fcn.1005fb70
push 0x2021f
push esi
push SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.10003db0
test eax, eax
jne 0x1019c80e
push eax
push eax
mov dword [ebp - 0x170], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x170]
push eax
push dword [ebx + 0x18]
call fcn.10198300
test eax, eax
jne 0x1019c7ec
mov edi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKCU_
lea ecx, [ebp - 0x174]
call fcn.10004700
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push edi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x19c]
call int.10008f10
lea ecx, [ebp - 0x174]
call int.10008f10
mov edi, dword [ebp - 0x158]
cmp edi, 2
je 0x1019c80e
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
push dword [ebx + 0x18]
lea ecx, [ebp - 0x14]
call fcn.1005fb70
push 0x2011f
push esi
push SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.10003db0
test eax, eax
jne 0x1019c8c9
push eax
push eax
mov dword [ebp - 0x174], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x174]
push eax
push dword [ebx + 0x18]
call fcn.10198300
test eax, eax
jne 0x1019c8a5
mov esi, dword [ebx + 0x18]
lea eax, [ebp - 0x154]
push eax
push str.HKCU_
lea ecx, [ebp - 0x1a0]
call fcn.10004700
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.10023360
add esp, 0xc
push 0x1021b9bc
push 0
push esi
push dword [eax]
mov eax, dword [ebp - 0x160]
push dword [eax]
call fcn.100286f0
mov ecx, eax
call fcn.100dd2f0
lea ecx, [ebp - 0x158]
call int.10008f10
lea ecx, [ebp - 0x1a0]
call int.10008f10
cmp edi, 2
je 0x1019c8d9
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x14]
push 0
push dword [ebx + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
push dword [ebx + 0x18]
lea ecx, [ebp - 0x14]
call fcn.1005fb70
jmp 0x1019c8ce
cmp edi, 2
je 0x1019c8d9
mov ecx, dword [ebp - 0x15c]
call fcn.101a9500
lea ecx, [ebp - 0x154]
call int.10008f10
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1019c8f8
push eax
call fcn.10034a70
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1019c905
push eax
call fcn.10034a70
mov esi, dword [ebp - 0x164]
lea ecx, [ebp - 0x14c]
call fcn.10196000
push 0
mov ecx, 0x1025a378
call fcn.10009a80
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp dword [esi + 0x74], 2
jne 0x1019c943
mov dword [esi + 0x74], 3
call fcn.1019b2b0
mov esi, 1
lea ecx, [ebp - 0x1a4]
call fcn.10195ea0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100030c0
call fcn.10200ab0
int3