Function at 0x20a314f
Capabilities:
Hide graphical window
Query or enumerate registry key

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
push 0x14
mov edi, dword [eax]
call fcn.020a62c1
add esp, 4
mov dword [0x20ab064], eax
test eax, eax
jne 0x20a317b
xor eax, eax
jmp 0x20a34b7
push 0x1b
call fcn.020a62c1
add esp, 4
mov dword [0x20ab068], eax
test eax, eax
jne 0x20a3195
xor eax, eax
jmp 0x20a34b7
push 0x16
call fcn.020a62c1
add esp, 4
mov dword [0x20ab06c], eax
test eax, eax
jne 0x20a31af
xor eax, eax
jmp 0x20a34b7
push 0x19
call fcn.020a62c1
add esp, 4
mov dword [0x20ab070], eax
test eax, eax
jne 0x20a31c9
xor eax, eax
jmp 0x20a34b7
push 0x1a
call fcn.020a62c1
add esp, 4
mov dword [0x20ab074], eax
test eax, eax
jne 0x20a31e3
xor eax, eax
jmp 0x20a34b7
push 0x17
call fcn.020a62c1
add esp, 4
mov dword [0x20ab078], eax
test eax, eax
jne 0x20a31fd
xor eax, eax
jmp 0x20a34b7
push 0x18
call fcn.020a62c1
add esp, 4
mov dword [0x20ab07c], eax
test eax, eax
jne 0x20a3217
xor eax, eax
jmp 0x20a34b7
xor esi, esi
mov eax, dword [0x20af580]
push esi
push eax
push 1
push dword [ebp + 8]
push esi
push esi
push esi
push esi
push 0x5001001f
push esi
push str.SysTreeView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x20ab040], eax
cmp eax, esi
jne 0x20a324f
xor eax, eax
jmp 0x20a34b7
xor esi, esi
mov eax, dword [0x20af580]
push esi
push eax
push 2
push dword [ebp + 8]
push esi
push esi
push esi
push esi
push 0x52018a41
push esi
push 0x20a9540
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x20ab044], eax
cmp eax, esi
jne 0x20a3287
xor eax, eax
jmp 0x20a34b7
push 3
push dword [ebp + 8]
push 0
push 0x40000110
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowA]
mov dword [0x20ab048], eax
test eax, eax
jne 0x20a32a9
xor eax, eax
jmp 0x20a34b7
mov eax, dword [edi + 0x38]
and eax, 1
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
and eax, 5
push eax
mov dword [0x20ab060], eax
push dword [0x20ab048]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.020a3f4b
test eax, eax
jne 0x20a32df
xor eax, eax
jmp 0x20a34b7
xor esi, esi
call fcn.020a4021
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x30], 0xffff0000
push 0x13
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], 0xffff0002
mov dword [ebp - 0x28], 0x67
mov dword [ebp - 8], 1
call fcn.020a62c1
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x1100
push dword [0x20ab040]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x20a96b4
mov dword [ebp - 0x30], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], 3
cmp ebx, 0x20a96e4
je 0x20a3394
mov eax, dword [ebx - 4]
push 0x100
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
push ecx
push esi
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 1
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x1100
push dword [0x20ab040]
call dword [sym.imp.USER32.dll_SendMessageA]
add ebx, 8
cmp ebx, 0x20a96e4
jb 0x20a3353
push dword [ebp - 0x30]
push 2
push 0x1102
push dword [0x20ab040]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x30]
push 9
push 0x110b
xor esi, esi
push dword [0x20ab040]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x20ab040]
mov dword [0x20ab05c], esi
push 0x11
mov dword [0x20ab04c], ecx
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x50], 6
lea ebx, [ebp - 0x50]
mov dword [0x20ab050], eax
mov edx, dword [edi + 0x30]
mov dword [ebp - 0x48], edx
call fcn.020a62c1
add esp, 4
mov dword [ebp - 0x44], eax
mov eax, dword [0x20ab044]
push ebx
push esi
push 0x101b
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi + 0x34]
push 0x12
mov dword [ebp - 0x48], eax
call fcn.020a62c1
add esp, 4
mov dword [ebp - 0x44], eax
mov eax, dword [0x20ab044]
push ebx
push 1
mov edi, 0x20ab1f0
push 0x101b
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetMenu]
push 0x3f
mov dword [0x20ab084], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
and eax, 1
mov dword [0x20ab08c], eax
cmp eax, esi
jne 0x20a34b2
push esi
mov eax, dword [0x20ab084]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, eax
push esi
push 0x291
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
push edi
call ebx
push esi
push 0x300
push edi
call ebx
push esi
push 0x2a1
push edi
call ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8