Function at 0x100615a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x288
push ebx
mov ebx, ecx
xor eax, eax
lea ecx, [ebx + 0x1600]
inc eax
cmp dword [ecx], 0
jne 0x1006575
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov esi, 0x100
push esi
push ebx
mov dword [ecx], eax
push 0x5aa
push dword [0x100db44]
mov dword [0x1015078], eax
call edi
push esi
lea eax, [ebx + 0x200]
push eax
push 0x5ab
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0x400]
push eax
push 0x5ac
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0x600]
push eax
push 0x5ad
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0x800]
push eax
push 0x5ae
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0xa00]
push eax
push 0x5af
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0xc00]
push eax
push 0x5b0
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0xe00]
push eax
push 0x5b1
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0x1000]
push eax
push 0x5b2
push dword [0x100db44]
call edi
push esi
lea eax, [ebx + 0x1200]
push eax
push 0x5b4
push dword [0x100db44]
call edi
push esi
add ebx, 0x1400
push ebx
push 0x5b5
push dword [0x100db44]
call edi
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp + 0x48]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], 0x100603e
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x54], edi
mov eax, dword [0x100db44]
push 0x7f00
push edi
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x5c], edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp + 0x60], eax
lea eax, [ebp + 0x48]
push eax
mov dword [ebp + 0x64], 0x10
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x6c], 0x1002030
call dword [sym.imp.USER32.dll_RegisterClassW]
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
mov dword [0x1015074], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
xor eax, eax
inc eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
cmp eax, edi
mov dword [ebp + 0x74], eax
jne 0x10062f9
xor eax, eax
jmp 0x1006573
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [0x1015074]
call ebx
push eax
push dword [0x1015074]
call ebx
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push eax
mov dword [ebp + 0x74], eax
call ebx
push 0x26
push dword [ebp + 0x74]
mov dword [0x100d73c], eax
call ebx
push dword [ebp + 0x74]
and eax, esi
push edi
mov dword [0x1015054], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xf
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [sym.imp.GDI32.dll_GetPaletteEntries]
lea ecx, [ebp + 0x38]
push ecx
push 1
push 0xb
push eax
mov dword [ebp + 0x74], eax
mov dword [ebp - 8], 0xffffff
mov dword [ebp - 4], edi
mov dword [ebp], 0xc0c0c0
mov dword [ebp + 4], 0x808080
mov dword [ebp + 8], 0xff
mov dword [ebp + 0xc], 0x80
mov dword [ebp + 0x10], 0xffff
mov dword [ebp + 0x14], 0x8080
mov dword [ebp + 0x18], 0xff00
mov dword [ebp + 0x1c], 0x8000
mov dword [ebp + 0x20], 0xffff00
mov dword [ebp + 0x24], 0x808000
mov dword [ebp + 0x28], 0xff0000
mov dword [ebp + 0x2c], 0x800000
mov dword [ebp + 0x30], 0xff00ff
mov dword [ebp + 0x34], 0x800080
call esi
mov ebx, dword [sym.imp.GDI32.dll_CreatePalette]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x110300
call ebx
mov dword [0x1015050], eax
lea eax, [ebp + 0x38]
push eax
push 4
push 8
push dword [ebp + 0x74]
call esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x140300
call ebx
mov dword [0x101504c], eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi*4 + 0x100db6c], eax
mov dword [esi*4 + 0x1014d78], edi
inc esi
cmp esi, 0x1f
jl 0x100640d
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push edi
lea ecx, [ebp - 0x210]
mov eax, 0x1f4
push ecx
push eax
push 0x29
mov dword [ebp - 0x210], eax
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.010053d4
push edi
push 0x1014f1c
push 0x5c
push 0x1f
call esi
push edi
push 1
push edi
push 0x1009
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call esi
mov dword [0x100d104], eax
cdq
sub eax, edx
sar eax, 1
mov dword [0x100d110], eax
lea eax, [ebp + 0x70]
push eax
push 0x1001c80
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1006503
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push 0x1001cc8
push dword [ebp + 0x70]
mov dword [ebp + 0x74], 0x10
call ebx
test eax, eax
jne 0x10064cd
lea eax, [ebp - 0x1c]
push eax
call fcn.01005457
mov dword [0x100d104], eax
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push 0x1001ce8
push dword [ebp + 0x70]
mov dword [ebp + 0x74], 0x10
call ebx
test eax, eax
jne 0x10064fa
lea eax, [ebp - 0x1c]
push eax
call fcn.01005457
mov dword [0x100d110], eax
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x26
call esi
sub eax, dword [0x100d104]
push 0x2b
mov dword [0x100d0ec], eax
pop ebx
jns 0x100651d
mov dword [0x100d0ec], ebx
push 0x27
call esi
sub eax, dword [0x100d104]
mov dword [0x100d0f8], eax
jns 0x1006534
mov dword [0x100d0f8], ebx
mov eax, 0x1014df8
mov dword [eax], edi
add eax, 0x60
cmp eax, 0x1015038
jl 0x1006539
push 1
call fcn.010052dc
push 6
call esi
push 5
mov dword [0x1015048], eax
call esi
push 0x2d
mov dword [0x1015044], eax
call esi
push 0x2e
mov dword [0x1015040], eax
call esi
mov dword [0x101503c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret