Function at 0x4427b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78c
mov eax, dword [0x60f074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x48]
mov dword [ebp - 0x788], edx
push 0
push eax
mov ebx, ecx
mov dword [ebp - 0x77c], 0x60
call fcn.0056f6e0
add esp, 0xc
push 2
push ebx
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push str.SHCore.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x442823
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x442823
lea ecx, [ebp - 0x77c]
push ecx
push ecx
push 0
push esi
call eax
test eax, eax
je 0x442863
push 0x58
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x77c], eax
push ecx
push eax
call fcn.00576f39
lea edi, [ebp - 0x48]
add esp, 0xc
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x442850
mov eax, dword [0x5ce1d8]
mov dword [edi], eax
mov ecx, 0x2b
lea edi, [ebp - 0xf8]
mov esi, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagsAllFoldersShell
lea eax, [ebp - 0x2f8]
rep movsd dword es:[edi], dword [esi]
push 0x200
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0056f6e0
add esp, 0xc
mov dword [ebp - 0x778], 0x100
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x774], 0x100
mov dword [ebp - 0x784], 0
push 0x200
push 0
push eax
call fcn.0056f6e0
add esp, 0xc
lea eax, [ebp - 0x4f8]
push 0x200
push 0
push eax
call fcn.0056f6e0
add esp, 0xc
push 0
push 1
push 1
call dword [sym.imp.USER32.dll_MonitorFromPoint]
test eax, eax
je 0x442931
lea ecx, [ebp - 0x770]
mov dword [ebp - 0x770], 0x68
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x442931
mov eax, dword [ebp - 0x760]
sub eax, dword [ebp - 0x768]
push eax
mov eax, dword [ebp - 0x764]
sub eax, dword [ebp - 0x76c]
push eax
lea eax, [ebp - 0x4f8]
push str._dx_d
push eax
call fcn.00446720
add esp, 0x10
lea eax, [ebp - 0x708]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x788]
sub dword [ebp - 0x704], eax
sub dword [ebp - 0x6fc], eax
lea eax, [ebp - 0x780]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xf8]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHEnumValueW]
lea eax, [ebp - 0x774]
push eax
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x778], 0x100
push eax
lea eax, [ebp - 0x784]
mov dword [ebp - 0x774], 0x100
push eax
lea eax, [ebp - 0x778]
xor edi, edi
push eax
lea eax, [ebp - 0x2f8]
push eax
push edi
push dword [ebp - 0x780]
call ebx
test eax, eax
jne 0x442b06
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop word [eax + eax]
lea eax, [ebp - 0x2f8]
push str.WinPos
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442abd
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442abd
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442abd
lea eax, [ebp - 0x2f8]
push str..left
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442a45
lea eax, [ebp - 0x708]
jmp 0x442aa3
lea eax, [ebp - 0x2f8]
push 0x5ce1dc
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442a65
lea eax, [ebp - 0x704]
jmp 0x442aa3
lea eax, [ebp - 0x2f8]
push str..right
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442a85
lea eax, [ebp - 0x700]
jmp 0x442aa3
lea eax, [ebp - 0x2f8]
push str..bottom
push eax
call fcn.0056e746
add esp, 8
test eax, eax
je 0x442abd
lea eax, [ebp - 0x6fc]
push 4
push eax
push 4
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xf8]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x774]
mov dword [ebp - 0x778], 0x100
push eax
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x774], 0x100
push eax
lea eax, [ebp - 0x784]
inc edi
push eax
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x2f8]
push eax
push edi
push dword [ebp - 0x780]
call ebx
test eax, eax
je 0x4429d0
push dword [ebp - 0x780]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00550156
mov esp, ebp
pop ebp
ret