Function at 0x4721e0
Capabilities:
Find taskbar
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov esi, 0x518188
lea edx, [ebx + 0x1120]
mov eax, edx
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x472222
test cl, cl
je 0x47221e
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x472222
add eax, 2
add esi, 2
test cl, cl
jne 0x472202
xor eax, eax
jmp 0x472227
sbb eax, eax
or eax, 1
test eax, eax
je 0x4725df
mov eax, str.SYSTEM
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x472254
test cl, cl
je 0x472250
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x472254
add edx, 2
add eax, 2
test cl, cl
jne 0x472234
xor eax, eax
jmp 0x472259
sbb eax, eax
or eax, 1
test eax, eax
je 0x4725df
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4722ad
mov ecx, dword [ebx]
mov byte [ebx + 0x1244], al
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x4725f0
mov eax, dword [ecx + 0xec]
test eax, eax
jne 0x472297
inc dword [ebx + 0x1248]
call fcn.004834e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0
push 0
mov ecx, ebx
call fcn.00472630
mov ecx, dword [ebx]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x4725fd
mov eax, dword [ecx + 0x134]
test eax, eax
je 0x4725df
call fcn.004716b0
test al, al
je 0x4725c0
mov ecx, dword [ebx]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x472605
mov eax, dword [ecx + 0xdc]
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x47246f
push dword [0x56a0b0]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Killwallpaper__i_n
push 8
push 0x558c50
call fcn.0041c840
add esp, 0x10
cmp dword [0x56a0b0], 0
jne 0x47246f
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x472376
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xa
push eax
push 0x56a0b8
push 0
push 0
push str.WallpaperStyle
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x569cb0
push 0x400
push 0x73
call esi
push 2
push 0x518188
push 0
push 0x14
call esi
push str.shell32.dll
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x472446
push str.DllGetVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4723e5
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0x14
lea ecx, [ebp - 0x18]
movlpd qword [ebp - 0x14], xmm0
push ecx
movlpd qword [ebp - 0xc], xmm0
call eax
test eax, eax
js 0x4723e5
movzx esi, word [ebp - 0x14]
movzx eax, word [ebp - 0x10]
shl esi, 0x10
or esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0x40047
jb 0x472446
push str.shell32.dll
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x472446
push str.SHGetSettings
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47242b
push 0x200
lea ecx, [ebp - 0x1c]
push ecx
call eax
mov esi, dword [ebp - 0x1c]
shl esi, 0x19
sar esi, 0x1f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x472446
xor cl, cl
call fcn.00426010
xor ecx, ecx
test eax, eax
setns cl
jmp 0x472448
xor ecx, ecx
push ecx
push 1
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Killwallpaper__i__i_n
push 8
push 0x558c50
mov dword [0x56a0b4], ecx
mov dword [0x56a0b0], 1
call fcn.0041c840
add esp, 0x14
mov ecx, dword [ebx]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x472610
mov eax, dword [ecx + 0xe0]
test eax, eax
je 0x4725a6
cmp byte [0x569c17], 0
jne 0x4725a6
xorps xmm0, xmm0
mov byte [0x569c17], 1
movaps xmmword [0x55abb0], xmm0
xor esi, esi
movaps xmmword [0x55abc0], xmm0
movq qword [0x55abd0], xmm0
nop dword [eax + eax]
push 0
lea edi, [esi + 0x55abb0]
push edi
push 0
push dword [esi + 0x518c40]
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x4724fd
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push dword [esi + 0x518c40]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Failed_to_get_SPI_value_for_0x_04x__0x_08x__n
push 8
push 0x558c50
call fcn.0041c840
jmp 0x47251c
push dword [edi]
push dword [esi + 0x518c40]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Retrieved_SPI_value_for_0x_04x:_0x_08x_n
push 9
push 0x558c50
call fcn.0041c840
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esi, 4
add esp, 0x14
cmp esi, 0x28
jb 0x4724c0
xor esi, esi
nop dword [eax]
mov eax, dword [esi + 0x55ab80]
cmp dword [esi + 0x55abb0], eax
je 0x47259e
push 2
push eax
mov eax, dword [esi + 0x518c40]
push 0
inc eax
push eax
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x47257c
call edi
push eax
push dword [esi + 0x55ab80]
mov eax, dword [esi + 0x518c40]
inc eax
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Failed_to_set_SPI_value_for_0x_04x_to_0x_08x__0x_08x__n
push 8
push 0x558c50
call fcn.0041c840
add esp, 0x18
jmp 0x47259e
push dword [esi + 0x55ab80]
mov eax, dword [esi + 0x518c40]
inc eax
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Set_SPI_value_for_0x_04x_to_0x_08x_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x14
add esi, 4
cmp esi, 0x28
jb 0x472530
mov ecx, dword [ebx]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x47261b
mov eax, dword [ecx + 0xe4]
test eax, eax
je 0x4725c0
call fcn.004265e0
mov ecx, dword [ebx]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x472623
mov eax, dword [ecx + 0xe8]
test eax, eax
je 0x4725da
call fcn.00471590
call fcn.004775b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
call dword [eax + 0x178]
mov ecx, dword [ebx]
jmp 0x47228d
call dword [eax + 0x20]
jmp 0x4722cd
call dword [eax + 0x200]
jmp 0x4722f7
call dword [eax + 0x208]
jmp 0x472484
call dword [eax + 0x210]
jmp 0x4725b7
call dword [eax + 0x218]
jmp 0x4725d1