Function at 0x1002149
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3d8
mov eax, dword [0x100704c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x2e0], esi
mov dword [ebp - 0x2d8], edi
je 0x1002316
call dword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
je 0x100218c
push edi
push edi
push edi
call dword [sym.imp.UxTheme.dll_Ordinal_4]
lea eax, [ebp - 0x2dc]
push eax
push 0x1001308
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1002386
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x2e0]
push eax
push edi
push esi
push dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], 3
mov dword [ebp - 0x2d8], 0x2d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022fe
cmp word [ebp - 0x2d4], 2
je 0x1002207
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100238c
mov ebx, dword [ebp - 0x2d8]
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push edi
lea ecx, [ebp - 0x2d0]
mov eax, 0x1f4
push ecx
push eax
add ebx, 0xfffffdac
push 0x2a
shr ebx, 2
mov dword [ebp - 0x2d0], eax
call esi
push edi
lea eax, [ebp - 0xdc]
push eax
push 0x5c
push 0x22
call esi
cmp ebx, 0x19
jne 0x1002253
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x70]
push 2
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x64]
push edi
push 0x1023
mov dword [ebp - 0xc], eax
call esi
push 2
push edi
push edi
push 0x1025
call esi
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 8
mov esi, eax
push 0xc0dcc0
push esi
call sub.GDI32.dll_SetMagicColors
push 9
push 0xf0caa6
push esi
call sub.GDI32.dll_SetMagicColors
push 0xf6
push 0xf0fbff
push esi
call sub.GDI32.dll_SetMagicColors
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x80]
and ecx, 0xffffff
mov dword [ebp + eax*4 - 0x35c], eax
mov dword [ebp + eax*4 - 0x3d8], ecx
inc eax
cmp eax, 0x1f
jl 0x10022b2
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x35c]
push eax
push 0x1f
call dword [sym.imp.USER32.dll_SetSysColors]
push edi
push 0x1388
push 2
push edi
push 0x2a
push 0x1a
push pe_overlay
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2d8], 1
jmp 0x1002386
push esi
call fcn.01002033
cmp eax, edi
mov dword [ebp - 0x2d8], eax
jne 0x1002386
push 0x10012f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x1002386
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10012e8
push ebx
call esi
cmp eax, edi
mov dword [ebp - 0x2dc], eax
je 0x100237f
push edi
push edi
push 1
push edi
call eax
test eax, eax
je 0x100237f
push 0x10012d0
push ebx
call esi
cmp eax, edi
je 0x1002374
push dword [ebp - 0x2e0]
call eax
mov dword [ebp - 0x2d8], eax
push edi
push edi
push 7
push edi
call dword [ebp - 0x2dc]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002f9c
leave
ret 8