Function at 0x10021900
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e1068
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1025e344]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [0x1025e0c4]
lea ecx, [ebp - 0x18]
call fcn.10003660
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push dword [0x1025e0c0]
call fcn.10003660
mov byte [ebp - 4], 1
lea ebx, [esi + 4]
push ebx
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.100be760
add esp, 0x10
cmp eax, 1
sete byte [ebp - 0xd]
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002198f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100219b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
jne 0x100233ab
push dword [0x1025e0c4]
lea ecx, [ebp - 0x20]
call fcn.10003660
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c]
push dword [0x1025e0c0]
call fcn.10003660
mov byte [ebp - 4], 5
lea eax, [ebp - 0x20]
push ebx
push 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100beb80
add esp, 0x10
mov byte [ebp - 4], 4
mov eax, edi
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10021a12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10021a31
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 8
mov ecx, edi
push str.REG_SZ
call fcn.10004060
test al, al
jne 0x10021a7a
push 6
push str.REG_SZ
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 9
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0xa
mov ecx, edi
push str.WaitToKillAppTimeout
call fcn.10004060
test al, al
jne 0x10021ac5
push 0x14
push str.WaitToKillAppTimeout
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0xb
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0xc
mov ecx, edi
push str.HKEY_CURRENT_USERControl_PanelDesktop
call fcn.10004060
test al, al
jne 0x10021b0d
push 0x27
push str.HKEY_CURRENT_USERControl_PanelDesktop
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0xd
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0xe
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x10021b68
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0xf
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x10
mov ecx, edi
push str.Win32PrioritySeparation
call fcn.10004060
test al, al
jne 0x10021bb3
push 0x17
push str.Win32PrioritySeparation
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x11
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x12
mov ecx, edi
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPriorityControl
call fcn.10004060
test al, al
jne 0x10021bfb
push 0x43
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPriorityControl
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x13
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100233f9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x14
mov ecx, edi
push str.REG_SZ
call fcn.10004060
test al, al
jne 0x10021c56
push 6
push str.REG_SZ
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x15
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023403
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x16
mov ecx, edi
push str.HungAppTimeout
call fcn.10004060
test al, al
jne 0x10021ca1
push 0xe
push str.HungAppTimeout
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x17
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002340d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x18
mov ecx, edi
push str.HKEY_CURRENT_USERControl_PanelDesktop
call fcn.10004060
test al, al
jne 0x10021ce9
push 0x27
push str.HKEY_CURRENT_USERControl_PanelDesktop
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x19
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023417
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x1a
mov ecx, edi
push str.REG_SZ
call fcn.10004060
test al, al
jne 0x10021d44
push 6
push str.REG_SZ
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x1b
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023421
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x1c
mov ecx, edi
push str.AutoEndTasks
call fcn.10004060
test al, al
jne 0x10021d8f
push 0xc
push str.AutoEndTasks
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x1d
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002342b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x1e
mov ecx, edi
push str.HKEY_CURRENT_USERControl_PanelDesktop
call fcn.10004060
test al, al
jne 0x10021dd7
push 0x27
push str.HKEY_CURRENT_USERControl_PanelDesktop
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x1f
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023435
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x20
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x10021e32
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x21
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002343f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x22
mov ecx, edi
push str.IoPageLockLimit
call fcn.10004060
test al, al
jne 0x10021e7d
push 0xf
push str.IoPageLockLimit
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x23
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023449
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x24
mov ecx, edi
push str.HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Session_Manager_Memory_Management
call fcn.10004060
test al, al
jne 0x10021ec5
push 0x55
push str.HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Session_Manager_Memory_Management
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x25
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023453
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x26
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x10021f20
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x27
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002345d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x28
mov ecx, edi
push str.DisablePagingExecutive
call fcn.10004060
test al, al
jne 0x10021f6b
push 0x16
push str.DisablePagingExecutive
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x29
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023467
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x2a
mov ecx, edi
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_Management
call fcn.10004060
test al, al
jne 0x10021fb3
push 0x55
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_Management
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x2b
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023471
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x2c
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x1002200e
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x2d
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002347b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x2e
mov ecx, edi
push str.LargeSystemCache
call fcn.10004060
test al, al
jne 0x10022059
push 0x10
push str.LargeSystemCache
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x2f
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023485
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x30
mov ecx, edi
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_Management
call fcn.10004060
test al, al
jne 0x100220a1
push 0x55
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_Management
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x31
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002348f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x32
mov ecx, edi
push str.REG_SZ
call fcn.10004060
test al, al
jne 0x100220fc
push 6
push str.REG_SZ
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x33
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023499
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x34
mov ecx, edi
push str.MinAnimate
call fcn.10004060
test al, al
jne 0x10022147
push 0xa
push str.MinAnimate
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x35
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234a3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x36
mov ecx, edi
push str.HKEY_CURRENT_USERControl_PanelDesktopWindowMetrics
call fcn.10004060
test al, al
jne 0x1002218f
push 0x35
push str.HKEY_CURRENT_USERControl_PanelDesktopWindowMetrics
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x37
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234ad
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x38
mov ecx, edi
push str.REG_SZ
call fcn.10004060
test al, al
jne 0x100221ea
push 6
push str.REG_SZ
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x39
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234b7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x3a
mov ecx, edi
push str.MenuShowDelay
call fcn.10004060
test al, al
jne 0x10022235
push 0xd
push str.MenuShowDelay
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x3b
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234c1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x3c
mov ecx, edi
push str.HKEY_CURRENT_USERControl_PanelDesktop
call fcn.10004060
test al, al
jne 0x1002227d
push 0x27
push str.HKEY_CURRENT_USERControl_PanelDesktop
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x3d
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234cb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x3e
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x100222d8
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x3f
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234d5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x40
mov ecx, edi
push str.AutoRestartShell
call fcn.10004060
test al, al
jne 0x10022323
push 0x10
push str.AutoRestartShell
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x41
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234df
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x42
mov ecx, edi
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.10004060
test al, al
jne 0x1002236b
push 0x48
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x43
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234e9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x44
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x100223c6
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x45
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234f3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x46
mov ecx, edi
push str.DesktopProcess
call fcn.10004060
test al, al
jne 0x10022411
push 0xe
push str.DesktopProcess
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x47
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100234fd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x48
mov ecx, edi
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.10004060
test al, al
jne 0x10022459
push 0x44
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x49
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023507
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x4a
mov ecx, edi
push str.REG_SZ
call fcn.10004060
test al, al
jne 0x100224b4
push 6
push str.REG_SZ
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x4b
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023511
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x4c
mov ecx, edi
push str.MenuShowDelay
call fcn.10004060
test al, al
jne 0x100224ff
push 0xd
push str.MenuShowDelay
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x4d
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002351b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x4e
mov ecx, edi
push str.HKEY_CLASSES_ROOTCLSID00021400_0000_0000_C000_000000000046
call fcn.10004060
test al, al
jne 0x10022547
push 0x3e
push str.HKEY_CLASSES_ROOTCLSID00021400_0000_0000_C000_000000000046
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x4f
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023525
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x50
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x100225a2
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x51
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002352f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x52
mov ecx, edi
push str.ForegroundLockTimeout
call fcn.10004060
test al, al
jne 0x100225ed
push 0x15
push str.ForegroundLockTimeout
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x53
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023539
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x54
mov ecx, edi
push str.HKEY_CURRENT_USERControl_PanelDesktop
call fcn.10004060
test al, al
jne 0x10022635
push 0x27
push str.HKEY_CURRENT_USERControl_PanelDesktop
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x55
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023543
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x56
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x10022690
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x57
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002354d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x58
mov ecx, edi
push str.ListviewAlphaSelect
call fcn.10004060
test al, al
jne 0x100226db
push 0x13
push str.ListviewAlphaSelect
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x59
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023557
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x5a
mov ecx, edi
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.10004060
test al, al
jne 0x10022723
push 0x4d
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x5b
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023561
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x5c
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x1002277e
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x5d
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002356b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x5e
mov ecx, edi
push str.TaskbarAnimations
call fcn.10004060
test al, al
jne 0x100227c9
push 0x11
push str.TaskbarAnimations
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x5f
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023575
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x60
mov ecx, edi
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.10004060
test al, al
jne 0x10022811
push 0x4d
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x61
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002357f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x62
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x1002286c
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x63
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x18], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023589
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x64
mov ecx, edi
push str.VisualFXSetting
call fcn.10004060
test al, al
jne 0x100228b7
push 0xf
push str.VisualFXSetting
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x65
push ecx
mov edi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x10023593
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x66
mov ecx, edi
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffects
call fcn.10004060
test al, al
jne 0x100228ff
push 0x52
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffects
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x67
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov edi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x1002359d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0x68
mov ecx, edi
push str.REG_DWORD
call fcn.10004060
test al, al
jne 0x1002295a
push 9
push str.REG_DWORD
mov ecx, edi
call fcn.10006ab0
mov dword [ebp - 4], 0x69
push ecx
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x20], edi
call fcn.100049d0
mov ecx, eax
test ecx, ecx
je 0x100235a7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x6a
mov ecx, edi
push str.DefaultApplied
call fcn.10004060
test al, al
jne 0x100229a5
push 0xe
push str.DefaultApplied
mov ecx, edi
call fcn.10006ab0
mov byte [ebp - 4], 0x6b
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffectsCursorShadow
call fcn.10003660
mov byte [ebp - 4], 0x6c
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x6d
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DefaultApplied
call fcn.10003660
mov byte [ebp - 4], 0x6e
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffectsDropShadow
call fcn.10003660
mov byte [ebp - 4], 0x6f
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x70
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DefaultApplied
call fcn.10003660
mov byte [ebp - 4], 0x71
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffectsMenuAnimation
call fcn.10003660
mov byte [ebp - 4], 0x72
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x73
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DefaultApplied
call fcn.10003660
mov byte [ebp - 4], 0x74
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffectsTaskbarAnimations
call fcn.10003660
mov byte [ebp - 4], 0x75
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x76
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EnableAutoLayout
call fcn.10003660
mov byte [ebp - 4], 0x77
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionOptimalLayout
call fcn.10003660
mov byte [ebp - 4], 0x78
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_SZ
call fcn.10003660
mov dword [ebp - 4], 0x79
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Auto
call fcn.10003660
mov byte [ebp - 4], 0x7a
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
call fcn.10003660
mov byte [ebp - 4], 0x7b
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x7c
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DoReport
call fcn.10003660
mov byte [ebp - 4], 0x7d
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftPCHealthErrorReporting
call fcn.10003660
mov byte [ebp - 4], 0x7e
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_SZ
call fcn.10003660
mov dword [ebp - 4], 0x7f
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Enable
call fcn.10003660
mov byte [ebp - 4], 0x80
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftDfrgBootOptimizeFunction
call fcn.10003660
mov byte [ebp - 4], 0x81
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x82
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.NtfsDisableLastAccessUpdate
call fcn.10003660
mov byte [ebp - 4], 0x83
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem
call fcn.10003660
mov byte [ebp - 4], 0x84
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_SZ
call fcn.10003660
mov dword [ebp - 4], 0x85
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Auto
call fcn.10003660
mov byte [ebp - 4], 0x86
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
call fcn.10003660
mov byte [ebp - 4], 0x87
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x88
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.ShowUI
call fcn.10003660
mov byte [ebp - 4], 0x89
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftPCHealthErrorReporting
call fcn.10003660
mov byte [ebp - 4], 0x8a
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x8b
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.ShowUI
call fcn.10003660
mov byte [ebp - 4], 0x8c
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftPCHealthErrorReporting
call fcn.10003660
mov byte [ebp - 4], 0x8d
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x8e
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DoReport
call fcn.10003660
mov byte [ebp - 4], 0x8f
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftPCHealthErrorReporting
call fcn.10003660
mov byte [ebp - 4], 0x90
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x91
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.NoLowDiskSpaceChecks
call fcn.10003660
mov byte [ebp - 4], 0x92
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call fcn.10003660
mov byte [ebp - 4], 0x93
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_SZ
call fcn.10003660
mov dword [ebp - 4], 0x94
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Max_Cached_Icons
call fcn.10003660
mov byte [ebp - 4], 0x95
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorer
call fcn.10003660
mov byte [ebp - 4], 0x96
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x97
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.NoDriveTypeAutoRun
call fcn.10003660
mov byte [ebp - 4], 0x98
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT___n______L_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call fcn.10003660
mov byte [ebp - 4], 0x99
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x9a
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.AutoChkTimeout
call fcn.10003660
mov byte [ebp - 4], 0x9b
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_Manager
call fcn.10003660
mov byte [ebp - 4], 0x9c
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0x9d
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.NoSimpleNetIDList
call fcn.10003660
mov byte [ebp - 4], 0x9e
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
call fcn.10003660
mov byte [ebp - 4], 0x9f
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xa0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DefaultTTL
call fcn.10003660
mov byte [ebp - 4], 0xa1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xa2
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xa3
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EnablePMTUDiscovery
call fcn.10003660
mov byte [ebp - 4], 0xa4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xa5
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xa6
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Tcp1323Opts
call fcn.10003660
mov byte [ebp - 4], 0xa7
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xa8
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xa9
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.NameSrvQueryTimeout
call fcn.10003660
mov byte [ebp - 4], 0xaa
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xab
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xac
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.NameSrvQueryTimeout
call fcn.10003660
mov byte [ebp - 4], 0xad
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNetBTParameters
call fcn.10003660
mov byte [ebp - 4], 0xae
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xaf
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.SackOpts
call fcn.10003660
mov byte [ebp - 4], 0xb0
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xb1
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xb2
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EnablePMTUBHDetect
call fcn.10003660
mov byte [ebp - 4], 0xb3
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xb4
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xb5
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.MaxConnectionsPerServer
call fcn.10003660
mov byte [ebp - 4], 0xb6
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xb7
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xb8
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.MaxCmds
call fcn.10003660
mov byte [ebp - 4], 0xb9
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanWorkstationParameters
call fcn.10003660
mov byte [ebp - 4], 0xba
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xbb
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.MaxThreads
call fcn.10003660
mov byte [ebp - 4], 0xbc
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanWorkstationParameters
call fcn.10003660
mov byte [ebp - 4], 0xbd
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xbe
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.MaxCollectionCount
call fcn.10003660
mov byte [ebp - 4], 0xbf
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanWorkstationParameters
call fcn.10003660
mov byte [ebp - 4], 0xc0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xc1
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.AlwaysShowMenus
call fcn.10003660
mov byte [ebp - 4], 0xc2
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.10003660
mov byte [ebp - 4], 0xc3
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xc4
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.ExtendedUIHoverTime
call fcn.10003660
mov byte [ebp - 4], 0xc5
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.10003660
mov byte [ebp - 4], 0xc6
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xc7
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DesktopLivePreviewHoverTime
call fcn.10003660
mov byte [ebp - 4], 0xc8
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.10003660
mov byte [ebp - 4], 0xc9
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.REG_DWORD
call fcn.10003660
mov dword [ebp - 4], 0xca
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.TcpMaxDupAcks
call fcn.10003660
mov byte [ebp - 4], 0xcb
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters
call fcn.10003660
mov byte [ebp - 4], 0xcc
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10026a20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
push 0x80004005
call fcn.10004040
int3