Function at 0x10020fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x50], 0
push 0x7f00
push 0
movlpd qword [ebp - 0x48], xmm0
mov dword [edi + 0x2c], 1
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 4], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 4
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x34], eax
mov eax, dword [0x1005dc3c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x2c], str.MoreProgramsPane
mov dword [ebp - 0x4c], 0x100206f0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0x20
push 0xc8
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetRect]
cmp byte [0x1005dbdc], 0
mov ebx, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
jne 0x1002106e
push 0x29c
call ebx
add esp, 4
test eax, eax
je 0x1002105e
mov ecx, eax
call fcn.10032660
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], 1
jmp 0x10021073
xor eax, eax
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], eax
jmp 0x10021073
mov eax, dword [0x1005e0e4]
lea ecx, [ebp - 0x18]
push ecx
push 2
mov ecx, eax
call fcn.10033ed0
cmp byte [0x1005dbdc], 0
jne 0x100210c0
push 0x29c
call ebx
add esp, 4
test eax, eax
je 0x100210af
mov ecx, eax
call fcn.10032660
mov esi, eax
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], esi
jmp 0x100210c6
xor esi, esi
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], esi
jmp 0x100210c6
mov esi, dword [0x1005e0e4]
lea ebx, [edi + 0x10]
push ebx
lea eax, [ebp - 0x18]
push eax
push 0xe12
push 0
push 2
push 0
push dword [esi + 0x214]
call dword [sym.imp.UxTheme.dll_GetThemeMargins]
test eax, eax
jne 0x100210f1
cmp dword [esi + 0x214], eax
jne 0x1002110c
mov dword [ebx], 4
mov dword [ebx + 4], 4
mov dword [ebx + 8], 4
mov dword [ebx + 0xc], 4
mov ecx, dword [ebp + 8]
push 0
push dword [0x1005dc3c]
mov eax, dword [ecx]
push 4
call dword [eax]
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push 0
push 0x56000000
push 0
push str.MoreProgramsPane
push 0
call esi
push edi
push 0xffffffffffffffeb
push eax
mov dword [edi + 8], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [0x1005dc3c]
push 0
push dword [edi + 8]
push 0
push 0
push 0
push 0
push 0x56000000
push 0
push str.Button
push 0
call esi
push 0x40000068
mov dword [edi + 0xc], eax
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x1002118d
push 0
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x1004fd84
push 0x1004fd84
push dword [edi + 0xc]
call dword [sym.imp.UxTheme.dll_SetWindowTheme]
mov eax, dword [ebp - 0xc]
sub eax, dword [edi + 0x1c]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [edi + 0x14]
push eax
push dword [edi + 0x18]
lea eax, [ebp - 0x28]
push dword [ebx]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub eax, edx
mov ecx, dword [ebp - 0x28]
push 0x14
push eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0
push 0x10
push str.Start_LargeMFUIcons
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov dword [ebp + 8], 4
call esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
push str.Start_LargeMFUIcons
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov eax, dword [ebp - 8]
cmp eax, 1
jbe 0x1002124d
mov ecx, dword [edi + 4]
push 0x60
mov eax, dword [ecx]
call dword [eax + 8]
push eax
push 0x18
jmp 0x10021365
test eax, eax
je 0x100212dc
cmp byte [0x1005dbdc], 0
jne 0x1002129a
mov eax, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
push 0x29c
call eax
add esp, 4
test eax, eax
je 0x10021289
mov ecx, eax
call fcn.10032660
mov ebx, eax
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], ebx
jmp 0x100212a0
xor ebx, ebx
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], ebx
jmp 0x100212a0
mov ebx, dword [0x1005e0e4]
mov eax, dword [0x1005e1fc]
test eax, eax
jne 0x100212ce
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x1005e1fc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x1005e1fc]
push eax
push dword [ebx + 0x23c]
push 0xb
jmp 0x1002135e
cmp byte [0x1005dbdc], 0
jne 0x10021321
mov eax, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
push 0x29c
call eax
add esp, 4
test eax, eax
je 0x10021310
mov ecx, eax
call fcn.10032660
mov ebx, eax
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], ebx
jmp 0x10021327
xor ebx, ebx
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], ebx
jmp 0x10021327
mov ebx, dword [0x1005e0e4]
mov eax, dword [0x1005e1fc]
test eax, eax
jne 0x10021355
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x1005e1fc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x1005e1fc]
push eax
push dword [ebx + 0x23c]
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
add eax, 8
mov ecx, edi
push 0
mov dword [edi + 0x20], eax
call fcn.10021390
push edi
push dword [edi + 8]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4