Function at 0x1880f9ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, eax
movzx eax, byte [ebx + 0x243c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push str.Hide_Systray_Icon_for_Non_Admins
push dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x1880f9ff
cmp dword [ebp - 0xc], edi
setne al
mov byte [ebx + 0x18], al
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
or eax, 1
push eax
push edi
push str.Shortcuts
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1880fa47
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x2b4]
push eax
push edi
push edi
push str.Shell_Shortcut_Directory
push dword [ebp - 8]
mov dword [ebp - 4], 0x208
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push str.NoWelcomeMsg
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x1880fa6f
cmp dword [ebp - 0xc], edi
setne al
mov byte [ebx + 0x38], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push str.SingleMonNoAutoStart
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x1880fa94
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x3c], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x1b28]
push eax
push edi
push edi
push 0x18834d28
push dword [ebp + 8]
mov dword [ebp - 4], 0xc8
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x1bf0]
push eax
push edi
push edi
push str.LinkBuy
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x1df8]
push eax
push edi
push edi
push str.LinkProduct
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x2000]
push eax
push edi
push edi
push str.LinkIcons
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push str.HwIds
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x1880fb95
lea eax, [ebx + 0x2208]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edi
jb 0x1880fb35
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
cmp eax, 1
jbe 0x1880fb95
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.18819abb
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x1880fb95
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push edi
push str.HwIds
push dword [ebp + 8]
call esi
push dword [ebp - 0x10]
call fcn.18819456
pop ecx
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebx + 0x2208]
call fcn.18802934
push dword [ebp - 0x10]
call fcn.18819a19
pop ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push edi
push str.SplashScreen
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1880fc52
lea eax, [ebp + 8]
push eax
lea eax, [ebx + 0x2224]
push eax
push edi
push edi
push str.Duration
push dword [ebp - 8]
mov dword [ebp + 8], 4
call esi
lea eax, [ebp + 8]
push eax
lea eax, [ebx + 0x2228]
push eax
push edi
push edi
push str.File
push dword [ebp - 8]
mov dword [ebp + 8], 0x208
call esi
lea eax, [ebp + 8]
push eax
lea eax, [ebx + 0x2430]
push eax
push edi
push edi
push str.Mode
push dword [ebp - 8]
mov dword [ebp + 8], 4
call esi
lea eax, [ebp + 8]
push eax
lea eax, [ebx + 0x2434]
push eax
push edi
push edi
push str.Transparency
push dword [ebp - 8]
mov dword [ebp + 8], 4
call esi
lea eax, [ebp + 8]
push eax
add ebx, 0x2438
push ebx
push edi
push edi
push str.TransparentColor
push dword [ebp - 8]
mov dword [ebp + 8], 4
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4