Function at 0x1006a3b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100b33c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0xc6
mov word [ebp - 0xcc], ax
xor esi, esi
lea eax, [ebp - 0xca]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 0xd8], 0x320
mov dword [ebp - 0xdc], 0x258
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd0], esi
call fcn.01008c21
push esi
lea eax, [ebp - 0x100]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1006adf
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0xd8]
jle 0x1006ad5
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xdc]
jg 0x1006adf
mov dword [ebp - 0xd4], 0x1000000
call fcn.0100691d
mov dword [0x100b364], eax
cmp eax, esi
jne 0x1006af7
mov eax, 0x8007000e
jmp 0x1006d5f
push ebx
push edi
push 0x64
lea eax, [ebp - 0xcc]
push eax
xor ebx, ebx
inc ebx
push ebx
push dword [0x100b360]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0xcc]
push eax
mov edi, 0x10014d8
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xe8], eax
cmp eax, esi
je 0x1006b84
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x2c
pop edi
push edi
lea eax, [ebp - 0x12c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0xe8]
mov dword [ebp - 0x12c], edi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x1006bef
cmp dword [ebp - 0x124], 2
jne 0x1006bef
push 9
push dword [ebp - 0xe8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1006bef
mov eax, dword [ebp - 0xd4]
push esi
push esi
or eax, 0xcf0000
push eax
push esi
push dword [ebp - 0xdc]
mov eax, 0x80000000
push dword [ebp - 0xd8]
push eax
push eax
push ebx
push dword [0x100b360]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [0x100b364]
push eax
push esi
lea eax, [ebp - 0xcc]
push eax
push edi
call dword [sym.imp.DUI70.dll_public:_long_int___thiscall_DirectUI::NativeHWNDHost::Initialize_unsigned_short_int_const___unsigned_short_int_const___struct_HWND_____struct_HICON_____int__int__int__int__int__int__struct_HINSTANCE_____unsigned_int_]
mov ecx, dword [0x100b364]
mov edi, eax
cmp edi, esi
jge 0x1006be0
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::NativeHWNDHost::Destroy_void_]
jmp 0x1006d5b
call dword [sym.imp.DUI70.dll_public:_struct_HWND______thiscall_DirectUI::NativeHWNDHost::GetHWND_void_]
mov dword [0x100b368], eax
cmp eax, esi
jne 0x1006bf9
mov eax, 0x80004005
jmp 0x1006d5d
push 0x10066b5
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 3
push 3
push dword [0x100b368]
mov dword [0x100b670], eax
call fcn.010068b0
lea eax, [ebp - 0xe0]
push eax
push 0x20019
push esi
push 0x1001458
push 0x80000002
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xec], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006c7f
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xe4]
push eax
push esi
push esi
push 0x1001444
push dword [ebp - 0xe0]
mov dword [ebp - 0xf0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xec]
push eax
call fcn.0100911e
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xe4]
jne 0x1006cd9
mov dword [0x100b63c], ebx
mov dword [ebp - 0xd0], ebx
mov dword [0x100b640], 0xac
mov dword [0x100b644], 0xad
mov dword [0x100b664], 0x10013f8
mov dword [0x100b668], 0xb8
mov dword [0x100b66c], 0x100b1d8
jmp 0x1006ce4
call fcn.010090cd
push esi
call fcn.01008fa6
call fcn.01008f09
test eax, eax
jge 0x1006d1b
push 0x1001388
push 2
mov dword [ebp - 0xd0], ebx
mov dword [0x100b63c], ebx
mov dword [0x100b640], 0xb6
mov dword [0x100b644], 0x9e
call fcn.01008cef
pop ecx
pop ecx
cmp dword [ebp - 0xd0], esi
je 0x1006d31
push 0x40a
call fcn.010066f9
mov edi, eax
jmp 0x1006d5b
push 0x40b
call fcn.010066f9
mov edi, eax
cmp edi, esi
jl 0x1006d5b
test dword [ebp - 0xd4], 0x1000000
je 0x1006d5b
push 3
push dword [0x100b368]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010086b7
leave
ret