Function at 0x100492f0
Capabilities:
Check for time delay via gettickcount
Inspect section memory permissions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push edi
cmp esi, 0x111
ja 0x10049852
je 0x1004981a
lea eax, [esi - 0x10]
cmp eax, 0xf0
ja case.0x1004987c.276
movzx eax, byte [eax + 0x10049b84]
jmp dword [eax*4 + 0x10049b60]
mov edi, dword [ebp + 0x14]
push str.ImmersiveColorSet
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10049b47
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
call dword [eax]
jmp 0x10049b47
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x10049b47
test byte [edi + 0x18], 2
jne 0x10049b47
lea eax, [esp + 0x18]
push eax
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
sub eax, ecx
mov dword [esp + 0x10], eax
mov dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov eax, ecx
sub eax, edx
mov dword [edi + 8], edx
cmp dword [esp + 0x10], eax
jl 0x100493ba
sub ecx, dword [ebx + 0x34]
sub ecx, edx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x18]
mov dword [edi + 8], eax
jmp 0x10049b47
mov eax, dword [esp + 0x24]
sub eax, dword [ebx + 0x38]
sub eax, dword [esp + 0x1c]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x1c]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x38]
lea ecx, [eax + eax*8]
mov eax, 0x4bda12f7
shl ecx, 2
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x10], eax
jge 0x10049b47
mov ecx, dword [ebx + 0x10]
call fcn.10040270
test eax, eax
jne 0x10049408
mov ecx, 0x40000000
jmp 0x10049424
cmp eax, 2
jne 0x10049414
mov ecx, 0x60000000
jmp 0x10049424
cmp eax, 1
mov ecx, SHChangeNotifyRegister
mov edx, 0x20000000
cmove ecx, edx
xor eax, eax
cmp ecx, 0x80000000
setne al
lea eax, [eax*4 - 2]
add dword [edi + 0xc], eax
jmp 0x10049b47
cmp dword [0x1005e0b4], 1
je case.0x1004987c.276
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0xffffffff
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
push 0
push 0x10
push str.TabletMode
push str.SOFTWAREMicrosoftWindowsCurrentVersionImmersiveShell
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp dword [esp + 0x10], 0
jne case.0x1004987c.276
push 0
push 0
push 0xf2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 4
je case.0x1004987c.276
mov dword [ebx + 0x30], 1
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, ecx
xor edi, edi
test eax, eax
je 0x100495c8
mov edi, dword [ebp + 0x14]
cmp eax, 1
jne 0x10049534
cmp dword [0x1005e0b4], 1
je 0x1004950f
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0xffffffff
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
push 0
push 0x10
push str.TabletMode
push str.SOFTWAREMicrosoftWindowsCurrentVersionImmersiveShell
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp dword [esp + 0x10], 0
je 0x10049534
cmp edi, 0xface
je 0x10049534
push 1
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov ecx, eax
call fcn.10046ec0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x20], 0
mov dword [ebx + 0x5c], 0
jne 0x10049a3b
push 0
push 0
push 0xf2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 4
jne 0x10049a3b
push edi
push dword [ebp + 0x10]
mov dword [ebx + 0x20], 1
push esi
push dword [ebp + 8]
call dword [sym.imp.COMCTL32.dll_DefSubclassProc]
mov ecx, ebx
mov edi, eax
call fcn.1004a280
cmp dword [ebp + 0x10], 1
jne 0x100495e5
cmp dword [0x1005e0b4], 0
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x100495ac
cmp dword [0x1005e0dc], 0
jne 0x100495ac
push 0
push 0
push 0x40d
push dword [0x1005dc0c]
call esi
push 0
push 0x132
push 0x111
push dword [ebx + 0x10]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x5c], edi
je 0x100495e5
push dword [ebp + 0x14]
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.COMCTL32.dll_DefSubclassProc]
mov ecx, ebx
mov edi, eax
call fcn.1004a280
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
push ecx
push esi
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0x401
push dword [ebx + 0x18]
mov dword [ebx + 0x2c], 1
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x1005d070], 0
je 0x10049642
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push 0x7b
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1004973b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, eax
push 0x104
lea eax, [esp + 0x4c]
mov dword [esp + 0x18], edi
push eax
push 0x2d0
push dword [0x1005dc3c]
call esi
test eax, eax
jne 0x10049686
push 0x104
lea eax, [esp + 0x4c]
push eax
push 0x2d0
push dword [0x1005dc10]
call esi
lea eax, [esp + 0x48]
push eax
push 0x7a69
push 0x400
push 0
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x104
lea eax, [esp + 0x4c]
push eax
push 0x2cf
push dword [0x1005dc3c]
call esi
test eax, eax
jne 0x100496d0
push 0x104
lea eax, [esp + 0x4c]
push eax
push 0x2cf
push dword [0x1005dc10]
call esi
lea eax, [esp + 0x48]
push eax
push 4
push 0x400
push 1
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0xffffffffffffffec
push dword [0x1005dc0c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, eax
push ecx
push dword [ebp + 8]
push ecx
call esi
shr eax, 0x10
movsx ecx, ax
push ecx
call esi
mov esi, dword [esp + 0x24]
and edi, 0x400000
cwde
mov edx, 0x8002
push eax
mov eax, 2
mov ecx, esi
cmove edx, eax
call fcn.10018dd0
add esp, 0x14
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
push 0
push 0x2000
lea eax, [esp + 0x30]
mov dword [ebx + 0x2c], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
mov eax, dword [esp + 0x28]
shl eax, 0x14
push 0
sar eax, 0x1f
push eax
push 0x401
push dword [ebx + 0x18]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
call ebx
push 0
push 0
push 0x470
push dword [ebp + 8]
call ebx
jmp 0x10049b47
mov edi, dword [ebp + 0x14]
cmp dword [edi + 8], 0xfffffdf7
jne 0x10049b47
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x28]
push eax
push dword [ebp + 8]
call esi
lea eax, [esp + 0x18]
push eax
push dword [edi]
call esi
mov ecx, dword [ebx + 0x10]
call fcn.10040270
test eax, eax
je 0x100497e9
cmp eax, 2
je 0x100497db
cmp eax, 1
jne 0x100497cd
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
jmp 0x100497f1
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
add dword [esp + 0x1c], eax
jmp 0x100497f1
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
add dword [esp + 0x18], eax
jmp 0x100497f1
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], eax
push 0x211
push 0
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 0x7a69
jne 0x10049833
xor edx, edx
mov ecx, str.StartIsBackCfg.exe
call fcn.100191c0
jmp case.0x1004987c.276
cmp ecx, 4
jne case.0x1004987c.276
push 0
mov edx, str.explorer.exe
xor ecx, ecx
call fcn.10019010
add esp, 4
jmp case.0x1004987c.276
cmp esi, 0x207
ja 0x10049a99
je 0x10049a82
lea eax, [esi - 0x113]
cmp eax, 0xf0
ja case.0x1004987c.276
movzx eax, byte [eax + 0x10049c8c]
jmp dword [eax*4 + 0x10049c78]
cmp ecx, 0x28
jne 0x10049903
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [ebx + 0x48]
mov edx, 0x11
cmp eax, 0x1e
mov ecx, 0x22
cmovle ecx, edx
cmp eax, 0x32
mov eax, dword [ebx + 0x44]
mov edx, 0x33
cmovg ecx, edx
cmp dword [ebx + 0x40], 0
jle 0x100498cc
add eax, ecx
mov dword [ebx + 0x44], eax
cmp eax, 0xff
jle 0x100498de
mov dword [ebx + 0x44], 0xff
jmp 0x100498e0
sub eax, ecx
mov dword [ebx + 0x44], eax
jns 0x100498dc
mov dword [ebx + 0x44], 0
jmp 0x100498e0
test eax, eax
jne 0x100498f2
push 0x28
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebx + 0x40], 0
mov ecx, ebx
call fcn.1004a280
call edi
mov dword [ebx + 0x48], eax
jmp case.0x1004987c.276
cmp ecx, 0x1e
jne case.0x1004987c.276
mov edi, dword [ebp + 8]
push ecx
push edi
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 1
push 0xf3
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x1004987c.276
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x14]
test ecx, ecx
js case.0x1004987c.276
mov eax, dword [esp + 0x10]
test eax, eax
js case.0x1004987c.276
cmp ecx, dword [esp + 0x20]
jg case.0x1004987c.276
cmp eax, dword [esp + 0x24]
jg case.0x1004987c.276
cmp dword [ebx + 0x24], 0
jne 0x100499e4
cmp dword [ebx + 0x28], 0
jne 0x100499e4
push 0
push 0
push 0xf2
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 4
jne 0x100499e4
cmp dword [0x1005d044], 0
jne 0x100499b8
push 0
push 0
push 0x470
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100499e4
cmp dword [ebx + 0x40], 0
jne 0x100499c5
mov dword [ebx + 0x44], 0
push 0
push 0xf
push 0x28
push dword [ebx + 0x14]
mov dword [ebx + 0x40], 1
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x48], eax
lea eax, [esp + 0x28]
mov dword [ebx + 0x24], 1
push eax
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0xa
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp case.0x1004987c.276
mov esi, 0x201
cmp dword [ebx + 0x30], 0
je 0x10049a46
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff00
cmp eax, 0xff515700
jne 0x10049a46
mov dword [ebx + 0x30], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp ebx, 0xd
jne 0x10049a61
push 0
push 1
push 0xf3
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x14]
push ebx
push esi
push edi
call dword [sym.imp.COMCTL32.dll_DefSubclassProc]
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov ecx, eax
call fcn.10046ec0
jmp case.0x1004987c.276
mov eax, esi
sub eax, 0x2a3
je 0x10049ad2
sub eax, 0x7b
je 0x10049abe
sub eax, 0x152
jne case.0x1004987c.276
mov ecx, ebx
call fcn.1004a280
jmp case.0x1004987c.276
push 0
push 0
push 0x470
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x1004987c.276
cmp dword [ebx + 0x24], 0
je 0x10049b3d
cmp dword [ebx + 0x28], 0
jne 0x10049b3d
push 0
push 0
push 0xf2
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 4
jne 0x10049b3d
cmp dword [0x1005d044], 0
jne 0x10049b11
push 0
push 0
push 0x470
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10049b3d
cmp dword [ebx + 0x40], 0
jne 0x10049b1e
mov dword [ebx + 0x44], 0xff
push 0
push 0xf
push 0x28
push dword [ebx + 0x14]
mov dword [ebx + 0x40], 0xffffffff
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x24], 0
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.COMCTL32.dll_DefSubclassProc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10