Function at 0x437a20
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
sub esp, 0x10
cmp dword [0x75dbb8], 0
push ebx
mov ebx, ecx
je 0x437ca7
push ebp
push str.RtlGetNtVersionNumbers
push 0x68087c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x437ca6
push edi
lea edi, [ebx + 0x44]
push edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
call eax
and dword [edi], 0xfffffff
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
cmp eax, 0xa
jne 0x437ab9
test edx, edx
ja 0x437a9b
cmp ecx, 0x4563
jb 0x437ca5
test edx, edx
jne 0x437a9b
cmp ecx, 0x47ba
jae 0x437a9b
mov byte [ebx + 0x43], 1
mov ecx, 1
mov dword [0x75da78], ecx
cmp eax, 0xa
jne 0x437ac1
test edx, edx
ja 0x437ac3
cmp dword [edi], 0x4f2e
jae 0x437ac3
jmp 0x437ace
jbe 0x437ca5
jmp 0x437a9b
jbe 0x437ac9
mov dword [0x75da7c], ecx
cmp eax, 0xa
jne 0x437adc
test edx, edx
ja 0x437ade
cmp dword [edi], 0x55f0
jae 0x437ade
jmp 0x437ae1
jbe 0x437ae1
mov byte [ebx + 0x42], cl
push esi
push str.uxtheme.dll
call fcn.00447cb0
mov esi, eax
add esp, 4
test esi, esi
je 0x437ca4
push 0x31
push esi
call ebp
push 0x68
push esi
mov dword [0x75daa0], eax
call ebp
push 0x6a
push esi
mov dword [0x75da94], eax
call ebp
push 0x84
push esi
mov dword [0x75da9c], eax
call ebp
push 0x85
push esi
mov dword [0x75da84], eax
call ebp
push 0x87
push esi
mov dword [0x75da88], eax
call ebp
cmp dword [edi], 0x47ba
jae 0x437b48
mov dword [0x75da8c], eax
jmp 0x437b4d
mov dword [0x75daac], eax
push 0x89
push esi
call ebp
push str.SetWindowCompositionAttribute
push 0x68082c
mov dword [0x75da98], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebp
push str.SetWindowTheme
push esi
mov dword [0x75da80], eax
call ebp
push str.OpenThemeData
push esi
mov dword [0x75daa4], eax
call ebp
push str.GetThemeColor
push esi
mov dword [0x75dab0], eax
call ebp
push str.CloseThemeData
push esi
mov dword [0x75dab4], eax
call ebp
cmp dword [0x75daa0], 0
mov dword [0x75dab8], eax
je 0x437ca4
call fcn.00437830
test eax, eax
je 0x437ca4
cmp dword [0x75da94], 0
je 0x437ca4
cmp dword [0x75da84], 0
je 0x437ca4
cmp dword [0x75daa4], 0
je 0x437ca4
cmp dword [0x75da88], 0
je 0x437ca4
cmp dword [0x75da8c], 0
jne 0x437c0a
cmp dword [0x75daac], 0
je 0x437ca4
cmp dword [0x75da98], 0
je 0x437ca4
mov byte [ebx + 0x41], 1
call fcn.00437920
mov byte [ebx + 0x40], al
mov eax, dword [0x75dbe4]
test eax, eax
je 0x437c8f
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push str.bDkMdAllowed
push eax
mov dword [esp + 0x34], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x437c64
cmp dword [esp + 0x10], eax
setne al
mov byte [ebx + 0x3c], al
cmp byte [ebx + 0x3c], 0
je 0x437c8b
call dword [0x75da84]
test al, al
je 0x437c84
cmp byte [ebx + 0x40], 0
jne 0x437c84
mov eax, 1
mov byte [ebx + 0x3d], al
jmp 0x437c8f
xor eax, eax
mov byte [ebx + 0x3d], al
jmp 0x437c8f
mov byte [ebx + 0x3d], 0
cmp byte [ebx + 0x3d], 0
je 0x437ca4
push 1
mov ecx, ebx
call fcn.004379f0
call dword [0x75da94]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret