Function at 0x1001a760
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009c1ce
mov eax, dword fs:[0]
push eax
sub esp, 0x730
mov eax, dword [0x100c82c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x6a0], eax
call fcn.1001b6a0
test eax, eax
je 0x1001a7a9
mov ecx, 4
jmp 0x1001ad4b
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov esi, eax
call ebx
push 0
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0
lea ebx, [esi - 1]
mov dword [ebp - 0x69c], eax
push ebx
call dword [sym.imp.USER32.dll_WindowFromPoint]
lea esi, [edi - 1]
mov dword [ebp - 0x690], eax
mov edi, dword [sym.imp.USER32.dll_WindowFromPoint]
push esi
push 0
call edi
push esi
push ebx
mov dword [ebp - 0x694], eax
call edi
mov ecx, dword [ebp - 0x690]
mov edx, eax
mov edi, dword [ebp - 0x69c]
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp edi, ecx
jne 0x1001a861
mov eax, dword [ebp - 0x694]
cmp ecx, eax
jne 0x1001a861
cmp eax, edx
jne 0x1001a861
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x698]
movlpd qword [ebp - 0x698], xmm0
push eax
push edi
call ebx
lea eax, [ebp - 0x694]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x698]
xor ecx, ecx
cmp eax, dword [ebp - 0x694]
setne cl
test ecx, ecx
je 0x1001a861
mov ecx, 0x10
jmp 0x1001ad4b
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
jle 0x1001a878
mov ecx, 0x40
jmp 0x1001ad4b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1001aa44
push 0x200
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.10056110
add esp, 0xc
lea eax, [ebp - 0x254]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x694]
mov dword [ebp - 0x694], 0
push eax
lea eax, [ebp - 0x254]
push str.PP_dFrameClass
push eax
call fcn.1001cda0
add esp, 0xc
cmp eax, 1
je 0x1001aa2f
xor esi, esi
mov eax, dword [esi + 0x100c709c]
lea ecx, [ebp - 0x254]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1001a916
test dx, dx
je 0x1001a912
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1001a916
add ecx, 4
add eax, 4
test dx, dx
jne 0x1001a8f0
xor eax, eax
jmp 0x1001a91b
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001aa2f
add esi, 4
cmp esi, 0xc
jb 0x1001a8e1
push 0x200
lea eax, [ebp - 0x65c]
push 0
push eax
call fcn.10056110
add esp, 0xc
lea eax, [ebp - 0x65c]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x65c]
push str.Microsoft_PowerPoint
push eax
call fcn.10054e95
add esp, 8
test eax, eax
jne 0x1001aa2f
mov dword [ebp - 0x690], eax
lea eax, [ebp - 0x690]
push eax
push edi
call ebx
push 0x208
lea eax, [ebp - 0x45c]
push 0
push eax
call fcn.10056110
push 0x104
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x690]
call fcn.1000b780
add esp, 0x18
mov dword [ebp - 0x664], 0
xor eax, eax
mov dword [ebp - 0x660], 7
lea ecx, [ebp - 0x45c]
mov word [ebp - 0x674], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001a9d3
sub ecx, edx
lea eax, [ebp - 0x45c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x674]
call fcn.1000eae0
cmp dword [ebp - 0x664], 0
jbe 0x1001aa39
cmp dword [ebp - 0x660], 8
lea eax, [ebp - 0x674]
push str.wpp.exe
cmovae eax, dword [ebp - 0x674]
push eax
call fcn.100593f7
add esp, 8
test eax, eax
jne 0x1001aa39
lea ecx, [ebp - 0x674]
call fcn.10009e10
mov ecx, 0x80
jmp 0x1001ad4b
lea ecx, [ebp - 0x674]
call fcn.10009e10
call fcn.1002aca0
test al, al
je 0x1001aa57
mov ecx, 0x100
jmp 0x1001ad4b
mov ecx, 0x100cadf0
mov dword [ebp - 0x690], 0
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x69c], 4
mov dword [ebp - 0x694], 4
mov edx, 0x16
mov dword [ebp - 0x3c], 0x4f0053
sub esi, ecx
mov dword [ebp - 0x38], 0x540046
mov dword [ebp - 0x34], 0x410057
mov dword [ebp - 0x30], 0x450052
mov dword [ebp - 0x2c], 0x33005c
mov dword [ebp - 0x28], 0x300036
mov dword [ebp - 0x24], 0x610053
mov dword [ebp - 0x20], 0x650066
mov dword [ebp - 0x1c], 0x73005c
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x74
lea eax, [edx + 0x7fffffe8]
test eax, eax
je 0x1001aaef
movzx eax, word [ecx + esi]
test ax, ax
je 0x1001aaef
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001aad1
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x69c]
push eax
push str.advtool_PopWndTracker
push 0x100cadf0
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001ab3b
cmp dword [ebp - 0x690], 1
jne 0x1001ab3b
lea ecx, [eax + 1]
jmp 0x1001ad4b
mov ebx, dword [ebp - 0x6a0]
mov ecx, ebx
call fcn.1001ba80
test eax, eax
je 0x1001ab56
mov ecx, 2
jmp 0x1001ad4b
call fcn.1001b4e0
mov ecx, eax
call fcn.10018f40
test eax, eax
je 0x1001ab70
mov ecx, 0x200
jmp 0x1001ad4b
call fcn.1001b4e0
mov ecx, eax
call fcn.10018f10
test eax, eax
je 0x1001ab8a
mov ecx, 0x400
jmp 0x1001ad4b
movaps xmm0, xmmword [str.Start_to_Init_36us____360Util_paus____start_checus____Get_360_ce360_not_installeloadlibrary_fail360Util.dll_missk_360_pop_status___Get360PopStatM]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x69745530
mov word [ebp - 0x40], 0x6c
call fcn.10038ba0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1001ac71
push 0x62
push str.d:jenkins.jenkinsworkspacegamemodegamemodeldsmodeidentifyldsmodeidentifymodeidentifyex.cpp
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.1000e9f0
push 3
push 0x100a3b84
lea ecx, [ebp - 0x68c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0xf
mov byte [ebp - 0x68c], 0
call fcn.1000e9f0
mov byte [ebp - 4], 1
call fcn.10038ba0
mov edi, eax
lea ecx, [ebp - 0x73c]
push 0x46
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x68c]
push eax
call fcn.10009360
mov esi, eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
push esi
call fcn.1000a4c0
mov eax, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x73c]
call fcn.1000a5f0
lea ecx, [ebp - 0x68c]
call fcn.10009dc0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10009dc0
mov ecx, ebx
call fcn.1001a190
mov esi, eax
xor ecx, ecx
and eax, 1
or eax, ecx
je 0x1001ac88
mov ecx, 0x800
mov eax, esi
and eax, 4
or eax, 0
je 0x1001ac98
or ecx, 0x1000
mov eax, esi
and eax, 0x80
or eax, 0
je 0x1001acaa
or ecx, 0x2000
mov eax, esi
and eax, 0x100
or eax, 0
je 0x1001acbc
or ecx, 0x4000
mov eax, esi
and eax, 0x200
or eax, 0
je 0x1001acce
or ecx, 0x8000
mov eax, esi
and eax, 0x400
or eax, 0
je 0x1001ace0
or ecx, 0x10000
mov eax, esi
and eax, 0x800
or eax, 0
je 0x1001acf2
or ecx, 0x20000
mov eax, esi
and eax, 0x2000
or eax, 0
je 0x1001ad04
or ecx, 0x40000
mov eax, esi
and eax, 0x4000
or eax, 0
je 0x1001ad16
or ecx, 0x80000
mov eax, esi
and eax, 0x10000
or eax, 0
je 0x1001ad28
or ecx, 0x100000
mov eax, esi
and eax, 0x8000
or eax, 0
je 0x1001ad3a
or ecx, 0x200000
and esi, 0x1000
or esi, 0
je 0x1001ad4b
or ecx, 0x400000
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045897
mov esp, ebp
pop ebp
ret