Function at 0x1000bf70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov al, byte [0x1005dbdc]
sub esp, 0x17c
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
test al, al
jne 0x1000bfc4
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000bfb3
mov ecx, eax
call fcn.10032660
mov esi, eax
mov al, 1
mov dword [0x1005e0e4], esi
mov byte [0x1005dbdc], al
jmp 0x1000bfca
xor esi, esi
mov al, 1
mov dword [0x1005e0e4], esi
mov byte [0x1005dbdc], al
jmp 0x1000bfca
mov esi, dword [0x1005e0e4]
mov dword [esi + 0x244], 0
test al, al
jne 0x1000c000
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000bff1
mov ecx, eax
call fcn.10032660
mov esi, eax
jmp 0x1000bff3
xor esi, esi
mov al, 1
mov dword [0x1005e0e4], esi
mov byte [0x1005dbdc], al
cmp dword [esi + 0x214], 0
jne 0x1000c04f
test al, al
jne 0x1000c035
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c026
mov ecx, eax
call fcn.10032660
mov esi, eax
jmp 0x1000c028
xor esi, esi
mov dword [0x1005e0e4], esi
mov byte [0x1005dbdc], 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
or eax, 0xff000000
mov dword [esi + 0x244], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
jne 0x1000c07b
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c06c
mov ecx, eax
call fcn.10032660
mov esi, eax
jmp 0x1000c06e
xor esi, esi
mov al, 1
mov dword [0x1005e0e4], esi
mov byte [0x1005dbdc], al
cmp byte [esi + 3], 0
je 0x1000c0a0
movaps xmm0, xmmword [0x100592f0]
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
jne 0x1000c0cc
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c0bd
mov ecx, eax
call fcn.10032660
mov esi, eax
jmp 0x1000c0bf
xor esi, esi
mov dword [0x1005e0e4], esi
mov byte [0x1005dbdc], 1
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x89c
push 0
push 0
push dword [esi + 0x214]
call dword [sym.imp.UxTheme.dll_GetThemeBool]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
sub esp, 8
push 0xe
call fcn.10033b30
lea eax, [ebp - 0x60]
mov ecx, esi
push eax
sub esp, 8
push 0x12
call fcn.10033b30
cmp dword [ebp - 4], 0
je 0x1000c528
cmp dword [ebp - 0x24], 0
je 0x1000c528
cmp dword [ebp - 0x54], 0
je 0x1000c528
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x18], 4
call dword [0x1005dc40]
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push 0x10
push str.EnableShadow
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x10
push str.EnableShadow
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
push pe_nt_image_headers32
lea eax, [ebp - 0x174]
mov dword [ebp - 0x178], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x16c], 0x42a7
mov dword [ebp - 4], 4
sbb eax, eax
add eax, 2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10
push str.StartMenuBlur
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10
push str.StartMenuBlur
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0xffffffff
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 4
push eax
push 0
push 0x10
push str.StartMenuColor
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
push str.StartMenuColor
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xffffffff
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push 0
push 0x10
push str.StartMenuAlpha
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
push str.StartMenuAlpha
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
jne 0x1000c350
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x3c], 4
push eax
push 0
push 0x10
push str.EnableTransparency
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push SHChangeNotifyRegister
call esi
cmp dword [ebp - 4], 0
je 0x1000c348
push pe_nt_image_headers32
lea eax, [ebp - 0x174]
mov dword [ebp - 0x178], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x16c], 0x42a7
sbb eax, eax
and eax, 9
add eax, 0xc4
jmp 0x1000c34d
mov eax, 0xff
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, 0xffffffff
jne 0x1000c38d
cmp dword [0x1005dc18], 0
push 0x28
push ecx
je 0x1000c370
call fcn.1004c820
mov ecx, 0xb0b0b0b0
jmp 0x1000c378
call fcn.1004c820
or ecx, 0xffffffff
add esp, 4
mov edx, eax
call fcn.1001ca90
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, eax
and ecx, 0xffffff
shl edx, 0x18
mov esi, 2
or edx, ecx
cmp eax, 0xff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], edx
je 0x1000c3be
test eax, eax
je 0x1000c3be
mov ecx, 1
cmp ecx, eax
sbb esi, esi
neg esi
add esi, 3
mov dl, byte [0x1005dbdc]
test dl, dl
jne 0x1000c3f6
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c3e1
mov ecx, eax
call fcn.10032660
mov ecx, eax
jmp 0x1000c3e3
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov dl, 1
mov dword [0x1005e0e4], ecx
mov byte [0x1005dbdc], dl
jmp 0x1000c3fc
mov ecx, dword [0x1005e0e4]
cmp eax, 3
sete al
mov byte [ecx + 1], al
mov byte [ecx], al
test dl, dl
jne 0x1000c434
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c424
mov ecx, eax
call fcn.10032660
mov ecx, eax
jmp 0x1000c426
xor ecx, ecx
mov dl, 1
mov dword [0x1005e0e4], ecx
mov byte [0x1005dbdc], dl
mov eax, dword [ebp - 0x40]
mov dword [ecx + 0x244], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x13
test dl, dl
jne 0x1000c473
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c464
mov ecx, eax
call fcn.10032660
mov ecx, eax
jmp 0x1000c466
xor ecx, ecx
mov dword [0x1005e0e4], ecx
mov byte [0x1005dbdc], 1
cmp byte [ecx], 0
mov eax, dword [ecx + 0x244]
je 0x1000c483
and eax, 0xffffff
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x20], 0x13
mov dword [ebp - 0x18], 0x10
call dword [0x1005dc40]
cmp byte [0x1005dbdc], 0
jne 0x1000c4ea
push 0x29c
call edi
add esp, 4
test eax, eax
je 0x1000c4da
mov ecx, eax
call fcn.10032660
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], 1
jmp 0x1000c4ef
xor eax, eax
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], eax
jmp 0x1000c4ef
mov eax, dword [0x1005e0e4]
cmp byte [eax + 1], 0
je 0x1000c507
push 0x81
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp - 0x14], 0
je 0x1000c55d
cmp dword [ebp - 0x10], 0
je 0x1000c55d
mov ecx, dword [ebx + 4]
call fcn.100430b0
mov dword [ebx + 0xb0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 1
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.dwmapi.dll_DwmEnableBlurBehindWindow]
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret