Function at 0x10007270
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe8
mov dword [ebp - 0xfe8], ecx
mov eax, dword [ebp - 0xfe8]
mov byte [eax], 0
mov ecx, dword [ebp - 0xfe8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0xfe8]
mov byte [edx + 8], 0
mov eax, dword [ebp - 0xfe8]
mov byte [eax + 9], 0
mov ecx, dword [ebp - 0xfe8]
mov byte [ecx + 0xa], 0
mov edx, dword [ebp - 0xfe8]
mov byte [edx + 0xb], 0
mov eax, dword [ebp - 0xfe8]
add eax, 0x20
mov dword [ebp - 0x648], eax
mov ecx, dword [ebp - 0x648]
mov dword [ecx + 0x100], 0x80000002
xor edx, edx
je 0x100072ef
push 0
mov eax, dword [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xfe8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x124], edx
mov eax, dword [ebp - 0xfe8]
mov dword [eax + 0x42c], 0
mov ecx, dword [ebp - 0xfe8]
mov byte [ecx + 0x430], 0
mov edx, dword [ebp - 0xfe8]
mov dword [edx + 0x434], 0
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x438
call fcn.1000e8c0
mov ecx, dword [ebp - 0xfe8]
add ecx, 0xb1c
call fcn.1000e8c0
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x1200
call fcn.1000e8c0
mov eax, dword [ebp - 0xfe8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x18e4], ecx
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x58c], str.Forth
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x1ec], 0
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
push 0x1001a078
lea ecx, [ebp - 0x588]
call fcn.10001980
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0
je 0x1000741d
mov eax, dword [ebp - 0x684]
push eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001a2dc
lea ecx, [ebp - 0x588]
call fcn.10001980
mov dword [ebp - 0x6ac], eax
mov edx, dword [ebp - 0xfe8]
add edx, 0x438
mov dword [ebp - 0x6a8], edx
mov eax, dword [ebp - 0x6ac]
push eax
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ecx + 0x1e4]
imul edx, edx, 0xff
mov eax, dword [ebp - 0x6a8]
lea ecx, [eax + edx + 0x1e8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x6a8]
mov eax, dword [edx + 0x1e4]
add eax, 1
mov ecx, dword [ebp - 0x6a8]
mov dword [ecx + 0x1e4], eax
push 0x1001a304
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x128
call fcn.10001980
mov dword [ebp - 0x6d4], eax
mov edx, dword [ebp - 0xfe8]
add edx, 0x438
mov dword [ebp - 0x6d0], edx
mov eax, dword [ebp - 0x6d4]
push eax
mov ecx, dword [ebp - 0x6d0]
mov edx, dword [ecx + 0x1e4]
imul edx, edx, 0xff
mov eax, dword [ebp - 0x6d0]
lea ecx, [eax + edx + 0x1e8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x6d0]
mov eax, dword [edx + 0x1e4]
add eax, 1
mov ecx, dword [ebp - 0x6d0]
mov dword [ecx + 0x1e4], eax
push 0x10
mov edx, dword [ebp - 0xfe8]
add edx, 0xc
push edx
call fcn.1000f930
add esp, 8
mov ecx, dword [ebp - 0xfe8]
call fcn.1000cdd0
lea eax, [ebp - 0x1e8]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp - 0x284], ecx
mov edx, dword [ebp - 0xfe8]
mov byte [edx + 0x1c], 0
mov eax, dword [ebp - 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0xfc]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0xfc], edx
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x20
call fcn.1000e870
movzx eax, al
test eax, eax
jne 0x100075b7
mov ecx, dword [ebp - 0xfe8]
mov byte [ecx + 0x1c], 1
mov edx, dword [ebp - 0x58c]
movsx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x284]
push ecx
lea edx, [ebp - 0x59c]
push edx
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [ebp - 0xfe8]
mov dword [eax + 0x120], 0x80000001
lea ecx, [ebp - 0x1e0]
push ecx
lea edx, [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0xfc]
push eax
push 0x100172a0
lea ecx, [ebp - 0x1e0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
sbb edx, edx
neg edx
mov eax, dword [ebp - 0xfe8]
mov byte [eax + 8], dl
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx ecx, ax
mov dword [ebp - 0x284], ecx
mov edx, 0x3d
sub edx, dword [ebp - 0x1e8]
imul edx, dword [ebp - 0x284]
mov dword [ebp - 0x284], edx
mov eax, dword [ebp - 0xfe8]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x10007718
mov edx, dword [ebp - 0x58c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0xfc]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0xfc], edx
push 0x9c
lea eax, [ebp - 0x640]
push eax
call fcn.1000f930
add esp, 8
lea ecx, [ebp - 0x59c]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x59c]
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x640], 0x9c
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
lea ecx, [ebp - 0x640]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10007718
xor edx, edx
cmp dword [ebp - 0x63c], 6
sete dl
mov eax, dword [ebp - 0xfe8]
mov byte [eax + 9], dl
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
mov edx, dword [ebp - 0xfe8]
movzx eax, byte [edx + 9]
test eax, eax
je 0x10007718
mov ecx, dword [ebp - 0x58c]
push ecx
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x58c]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0xfe8]
mov dword [edx + 0x428], eax
push 0x1001a2cc
lea ecx, [ebp - 0x588]
call fcn.10001980
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0xfe8]
add eax, 0x20
mov dword [ebp - 0x708], eax
mov dword [ebp - 0x700], 4
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x704], 4
lea ecx, [ebp - 0x704]
push ecx
mov edx, dword [ebp - 0xfe8]
add edx, 0x42c
push edx
lea eax, [ebp - 0x700]
push eax
mov ecx, dword [ebp - 0x70c]
push ecx
mov edx, dword [ebp - 0x708]
push edx
mov eax, dword [ebp - 0x708]
mov ecx, dword [eax + 0x100]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x6fc], eax
xor edx, edx
cmp dword [ebp - 0x6fc], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x10007987
mov ecx, dword [ebp - 0xfe8]
call fcn.1000c470
mov ecx, dword [ebp - 0xfe8]
mov dword [ecx + 0x42c], eax
mov edx, dword [ebp - 0xfe8]
mov byte [edx + 0x430], 1
mov eax, dword [ebp - 0xfe8]
mov ecx, dword [eax + 0x42c]
mov dword [ebp - 0x740], ecx
push 0x1001a2cc
lea ecx, [ebp - 0x588]
call fcn.10001980
mov dword [ebp - 0x73c], eax
mov edx, dword [ebp - 0xfe8]
add edx, 0x20
mov dword [ebp - 0x738], edx
mov dword [ebp - 0x730], 0
mov dword [ebp - 0x734], 4
mov eax, dword [ebp - 0x734]
push eax
lea ecx, [ebp - 0x740]
push ecx
push 4
mov edx, dword [ebp - 0x73c]
push edx
mov eax, dword [ebp - 0x738]
push eax
mov ecx, dword [ebp - 0x738]
mov edx, dword [ecx + 0x100]
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
je 0x10007886
mov byte [ebp - 0x741], 0
jmp 0x1000788d
mov byte [ebp - 0x741], 1
push 0x1001a2cc
lea ecx, [ebp - 0x588]
call fcn.10001980
mov dword [ebp - 0x778], eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x20
mov dword [ebp - 0x774], ecx
mov dword [ebp - 0x76c], 4
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x770], 4
lea edx, [ebp - 0x770]
push edx
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x76c]
push ecx
mov edx, dword [ebp - 0x778]
push edx
mov eax, dword [ebp - 0x774]
push eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x100]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x768], eax
xor eax, eax
cmp dword [ebp - 0x768], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x10007933
mov edx, dword [ebp - 0x58c]
push edx
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001a37c
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x128
call fcn.10001980
push eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0xfe8]
call fcn.1000d5b0
mov edx, dword [ebp - 0x58c]
push edx
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x58c]
push ecx
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001a328
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x128
call fcn.10001980
push eax
mov eax, dword [ebp - 0xfe8]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x438
call fcn.1000e940
mov ecx, dword [ebp - 0x58c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0xfc]
lea eax, [edx + eax + 1]
mov dword [ebp - 0xfc], eax
push 0x1001a330
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x128
call fcn.10001980
push eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0xfe8]
add ecx, 0xb1c
call fcn.1000e940
lea edx, [ebp - 0x59c]
push edx
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x1e8], eax
push 0x1001a338
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x128
call fcn.10001980
push eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x1200
call fcn.1000e940
mov edx, dword [ebp - 0x1ec]
push edx
call dword [sym.imp.GDI32.dll_GetBkColor]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xfe8]
add ecx, 0x18e8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0xfe8]
mov dword [edx + 0x19ec], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x1e8], eax
lea ecx, [ebp - 0x1e8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x1e0], al
mov eax, dword [ebp - 0xfe8]
mov esp, ebp
pop ebp
ret 8