Function at 0x403d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x46f20c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x60]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push str.SoftwareSysinternalsShareEnum
push SysReAllocString
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x50], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], 4
push eax
push 0
push 0
push str.xywh
push dword [ebp - 0x60]
call esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x460cf4
push dword [ebp - 0x60]
call esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x460cf8
push dword [ebp - 0x60]
call esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x460cfc
push dword [ebp - 0x60]
call esi
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xffffffff
je 0x403e1e
mov eax, dword [ebp - 0x50]
cmp eax, 0xffffffff
je 0x403e1e
push 1
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [ebp + 0x14]
push eax
push eax
push 0x1036
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x403ef2
nop word [eax + eax]
mov eax, dword [edi]
xorps xmm0, xmm0
mov dword [ebp - 0x88], eax
mov eax, dword [edi + 4]
push esi
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x44]
push 0x460d00
push eax
mov dword [ebp - 0x90], 0
movlpd qword [ebp - 0x84], xmm0
movlpd qword [ebp - 0x7c], xmm0
movlpd qword [ebp - 0x74], xmm0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x94], 6
call fcn.004044a0
add esp, 0xc
mov dword [ebp - 0x58], 0xffffffff
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 4
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x58], 0x258
push eax
cmovb ecx, dword [ebp - 0x58]
push esi
push 0x1061
push ebx
mov dword [ebp - 0x8c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
lea edi, [edi + 0x10]
cmp esi, dword [ebp + 0x10]
jl 0x403e40
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x1e
push 0xa
push 0xfe
push 0x32
mov dword [ebp - 0x64], eax
call esi
push eax
push 0x31
call esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
mov ebx, eax
push 5
mov dword [ebp - 0x58], ebx
call edi
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
push eax
push ebx
call esi
push 0x8020
push 0x10
push 0x10
push 1
push 0x14c
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
call ebx
push 0xf
call edi
push eax
push dword [ebp - 0x58]
call esi
push 0x8020
push 0x10
push 0x10
push 1
push 0x14b
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x58]
call ebx
push 0x8020
push 0x10
push 0x10
push 1
push 0x14a
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x58]
call ebx
push 5
call edi
mov edi, dword [ebp - 0x58]
push eax
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_LoadImageW]
push 0x8020
push 0x10
push 0x10
push 1
push 0x14d
push dword [ebp - 0x64]
call esi
push eax
push 0xffffffffffffffff
push edi
call ebx
push 0x8020
push 0x10
push 0x10
push 1
push 0x143
push dword [ebp - 0x64]
call esi
push eax
push 0xffffffffffffffff
push edi
call ebx
push edi
push 1
push 0x1003
push dword [ebp - 0x68]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409118
mov esp, ebp
pop ebp
ret