Function at 0x412a9e
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e4a0
mov eax, dword fs:[0]
push eax
mov eax, 0x1a28
call fcn.0051cee0
mov eax, dword [0x592bb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
mov edi, ecx
push 0x184
push dword [edi + 0x244]
mov dword [ebp - 0x1a2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
inc esi
push esi
push esi
push esi
push 0x31a7
push str.Computer
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push ebx
push ebx
call fcn.00409113
push ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
mov ebx, esi
call fcn.004117b0
push esi
push esi
push esi
push 2
pop ebx
push 0x31a8
push str.Control_Panel
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push 0
push 0
push 3
pop ebx
call fcn.0040906f
push ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push 0
push esi
push 4
pop ebx
push 0x771d
push str.Devices_and_Printers
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push esi
push 5
pop ebx
push 0x870f
push str.Documents
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push 0
push 0x14
pop ebx
push 0x778b
push str.Downloads
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push 0
push esi
push 0
push 0x13
pop ebx
push 0x5524
push str.Favorites
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push esi
push 6
pop ebx
push 0x7773
push str.Games
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push 0
push esi
push 7
pop ebx
push 0x31a5
push str.Help_and_Support
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push 0
push 0
push 8
pop ebx
push 0x778c
push str.Homegroup
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push esi
push 9
pop ebx
push 0x8718
push str.Music
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push 0
push 0
push 0xa
pop ebx
call fcn.00408fd2
push ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push esi
push 0xb
pop ebx
push 0x7721
push str.Personal_Folder
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push esi
push 0xc
pop ebx
push 0x8723
push str.Pictures
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push 0
push esi
push 0
push 0x12
pop ebx
push 0x5525
push str.Recent_Items
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push 0
push 0xd
pop ebx
push 0x778d
push str.Recorded_TV
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push 0
push 0
push 0xe
pop ebx
call fcn.004091b7
push ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push 0
push 0xf
pop ebx
push 0x5502
push str.Administrative_Tools
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
push esi
push esi
push 0
push 0x10
pop ebx
push 0x778e
push str.Videos
call fcn.0040925b
pop ecx
mov ecx, esp
mov dword [ebp - 0x1a18], esp
push eax
call fcn.00403493
call fcn.004117b0
xor eax, eax
movzx ecx, word [eax + 0x5945a4]
mov word [ebp + eax - 0x1a14], cx
add eax, 2
test cx, cx
jne 0x412e0c
lea edi, [ebp - 0x1a14]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x412e2c
mov esi, 0x56c3fc
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1a14]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x412e47
push 0xe
pop ecx
lea eax, [ebp - 0x1a1c]
push eax
lea eax, [ebp - 0x1a14]
push eax
mov esi, str.Start8.iniStart8Locations
push SysReAllocStringLen
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor eax, eax
push 0x206
mov word [ebp - 0x628], ax
xor ebx, ebx
xor edi, edi
lea eax, [ebp - 0x216]
push ebx
inc edi
mov esi, 0x104
push eax
mov dword [ebp - 0x1a28], edi
mov dword [ebp - 0x1a20], esi
call fcn.0051b3c0
xor eax, eax
add esp, 0xc
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x1a24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1a28]
push eax
push ebx
lea eax, [ebp - 0x1a20]
push eax
lea eax, [ebp - 0x628]
push eax
push ebx
push dword [ebp - 0x1a1c]
mov dword [ebp - 0x1a24], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
mov word [ebp - 0x12], cx
mov word [ebp - 0x422], cx
mov dword [ebp - 0x1a18], edi
cmp eax, 0x103
je 0x412fe5
jmp 0x412f0d
xor edi, edi
inc edi
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x1a30]
call fcn.00403493
and dword [ebp - 4], 0
push edi
push edi
push edi
push ecx
lea eax, [ebp - 0x628]
mov ecx, esp
mov dword [ebp - 0x1a34], esp
push eax
mov ebx, 0x3e7
call fcn.00403493
mov edi, dword [ebp - 0x1a2c]
call fcn.004117b0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a30]
add ecx, 0xfffffff0
call fcn.004014d0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x1a20], esi
call fcn.0051b3c0
xor eax, eax
add esp, 0xc
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x1a24]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1a28]
push eax
push 0
lea eax, [ebp - 0x1a20]
push eax
lea eax, [ebp - 0x628]
push eax
push dword [ebp - 0x1a18]
mov dword [ebp - 0x1a24], esi
push dword [ebp - 0x1a1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
inc dword [ebp - 0x1a18]
mov word [ebp - 0x12], cx
mov word [ebp - 0x422], cx
cmp eax, 0x103
jne 0x412f0a
push dword [ebp - 0x1a1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005182a2
leave
ret