Function at 0x10023460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0b30
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x100c50e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0
push eax
push 1
push 0
push str.Control_PanelCursors
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1002354c
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x98], 0
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa0], 4
push eax
push 0
push str.CursorBaseSize
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10023544
cmp dword [ebp - 0x98], 4
jne 0x10023544
mov esi, dword [ebp - 0x9c]
mov eax, 0x100
push dword [ebp - 0x94]
and esi, 0xfffffff0
cmp esi, eax
cmova esi, eax
call ebx
cmp esi, 0x20
jbe 0x1002354c
push 0x60
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x100235b7
push dword [ebp - 0x94]
call ebx
mov dword [ebp - 4], 0
mov eax, dword [0x100c8c1c]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10023569
push edi
push 0xd
call eax
jmp 0x10023581
push 0xd
call ebx
mov esi, eax
mov eax, dword [0x100c5b5c]
cmp edi, eax
je 0x10023583
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
mov dword [ebp - 4], 1
mov eax, dword [0x100c8c1c]
test eax, eax
je 0x1002359a
push edi
push 0xe
call eax
jmp 0x100235b1
push 0xe
call ebx
mov ecx, dword [0x100c5b5c]
cmp edi, ecx
je 0x100235b1
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
mov dword [ebp - 0xa8], esi
push 0
movups xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0xa4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
mov dword [ebp - 0xb8], esi
test esi, esi
je 0x10023685
push 0x7c
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.10085460
mov eax, dword [ebp - 0xa8]
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0xac]
push 0
push 0
push eax
push 0
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0x7c
push eax
push esi
mov dword [ebp - 0x84], 0x200001
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x68], 0xff0000
mov dword [ebp - 0x64], 0xff00
mov dword [ebp - 0x60], 0xff
mov dword [ebp - 0x5c], 0xff000000
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0xb4], eax
test eax, eax
je 0x100236b7
push eax
push dword [ebp - 0xb8]
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp - 0xb8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb0], 0
jne 0x100236bf
test eax, eax
je 0x100236a5
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebp - 0xb8]
test esi, esi
je 0x100236b0
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
jmp 0x1002386c
mov esi, dword [ebp - 0xb8]
jmp 0x1002368b
lea eax, [ebp - 0x94]
mov esi, 0xfeffff
push eax
push 1
push 0
push str.SoftwareMicrosoftAccessibility
push SysReAllocStringLen
mov edi, 0x10000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100237ae
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa0], 4
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push str.CursorType
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100237a6
cmp dword [ebp - 0x9c], 4
jne 0x100237a6
mov eax, dword [ebp - 0x98]
sub eax, 1
je 0x1002379f
sub eax, 3
je 0x1002379f
sub eax, 2
jne 0x100237a6
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa0], 4
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push str.CursorColor
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100237a6
cmp dword [ebp - 0x9c], 4
jne 0x100237a6
mov esi, dword [ebp - 0x98]
jmp 0x100237a6
mov esi, edi
mov edi, 0xfeffff
push dword [ebp - 0x94]
call ebx
push edi
push esi
lea ecx, [ebp - 0xb8]
call fcn.100232d0
xor edi, edi
push edi
push 1
push 1
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, eax
test esi, esi
je 0x10023835
push dword [ebp - 0xb0]
push dword [ebp - 0xb8]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], esi
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push esi
mov edi, eax
call ebx
mov ecx, dword [ebp - 0xb0]
test ecx, ecx
je 0x1002384c
push ecx
push dword [ebp - 0xb8]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x10023859
push eax
call ebx
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x1002386a
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10083210
mov esp, ebp
pop ebp
ret