Function at 0x7cf5f326
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
test byte [esi + 0xa4], 0x20
je 0x7cf5f504
call fcn.7cf66498
test byte [esi + 0x14a], 0x20
je 0x7cf5f369
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.7cf664d4
test eax, eax
je 0x7cf5f369
push dword [ebp - 0x18]
jmp 0x7cf5f379
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp + 8], eax
push 0xff000000
push ebx
push 0x1050
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 8]
mov word [ebp - 0x118], bx
movzx ecx, byte [ebp + 8]
shr eax, 0x10
movzx eax, al
mov word [ebp - 0x218], bx
mov dword [ebp - 0xc], ebx
lea ecx, [eax + ecx*2]
xor eax, eax
mov al, byte [ebp + 9]
movzx eax, al
lea eax, [eax + eax*4]
add ecx, eax
xor eax, eax
cmp ecx, 0x400
setle al
dec eax
or dword [ebp - 8], 0xffffffff
and eax, 0xff000001
add eax, 0xffffff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push 0x7cf3d3a4
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cf5f4a4
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push 0x7cf3d390
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x100
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x7cf3d380
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x7cf3d358
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x7cf5f4a4
push 7
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x7cf5f4a4
mov eax, 0x7ffe02c8
cmp dword [eax], ebx
jne 0x7cf5f49d
cmp dword [eax + 4], ebx
jne 0x7cf5f49d
mov edi, reloc.SHLWAPI.dll_ParseURLW
push 0x7cf3d294
push edi
call fcn.7cfb4538
test eax, eax
jne 0x7cf5f49d
push 0x7cf3d1c0
push edi
call fcn.7cfb4538
test eax, eax
mov dword [ebp - 0xc], ebx
je 0x7cf5f4a4
mov dword [ebp - 0xc], 1
test byte [esi + 0x14a], 0x20
jne 0x7cf5f4f7
push 0x43
call fcn.7cf5b11e
test eax, eax
jne 0x7cf5f535
push 0x16
call fcn.7cf5b11e
test eax, eax
jne 0x7cf5f535
cmp dword [ebp - 0xc], ebx
jne 0x7cf5f535
test byte [esi + 0x149], 0x80
jne 0x7cf5f535
cmp word [ebp - 0x118], bx
je 0x7cf5f4e4
cmp word [ebp - 0x118], 0x28
jne 0x7cf5f535
cmp word [ebp - 0x218], bx
je 0x7cf5f4f7
cmp word [ebp - 0x218], 0x28
jne 0x7cf5f535
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 8], eax
jmp 0x7cf5f535
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 5
call edi
push 8
mov dword [ebp - 8], eax
mov dword [ebp + 8], eax
call edi
test byte [esi + 0xa5], 1
mov dword [ebp - 0x14], eax
je 0x7cf5f535
test byte [esi + 0x14a], 0x20
jne 0x7cf5f535
or dword [ebp - 8], 0xffffffff
or dword [ebp + 8], 0xffffffff
mov edx, dword [esi + 0x148]
mov eax, 0x8fffffff
and edx, 0x100000
jne 0x7cf5f555
mov ecx, dword [esi + 0x150]
cmp ecx, eax
je 0x7cf5f555
mov dword [ebp + 8], ecx
cmp edx, ebx
jne 0x7cf5f566
mov ecx, dword [esi + 0x154]
cmp ecx, eax
je 0x7cf5f566
mov dword [ebp - 0x14], ecx
cmp dword [esi + 0x41c], ebx
je 0x7cf5f5a9
mov eax, dword [esi + 0x420]
cmp eax, ebx
je 0x7cf5f5a9
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x7cf39380
push eax
mov dword [ebp - 4], ebx
call dword [ecx]
cmp eax, ebx
jl 0x7cf5f5a9
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push dword [ebp - 0x14]
push eax
call dword [ecx + 0x18]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_IUnknown_AtomicRelease]
push dword [ebp - 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x1001
push dword [esi + 0xd4]
call edi
push dword [ebp + 8]
push ebx
push 0x1026
push dword [esi + 0xd4]
call edi
push dword [ebp - 0x14]
push ebx
push 0x1024
push dword [esi + 0xd4]
call edi
pop edi
pop esi
pop ebx
leave
ret 4