Function at 0x10021ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004c9bb
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x10063068]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
mov eax, dword [0x10063068]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x20], eax
cmp dword [eax + 8], ebx
je 0x100224a9
xor edi, edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0xe8], ebx
xor eax, eax
mov word [esp + 0xac], ax
push 0x37
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
lea esi, [esp + 0xb0]
mov dword [esp + 0xc4], 7
mov dword [esp + 0xc0], ebx
call fcn.1000a770
push 0x26
mov eax, str.FB16E5C3_A9E2_47A2_8EFC_319E775E62CC
mov ecx, esi
mov byte [esp + 0xec], 1
call fcn.1000a640
cmp dword [esp + 0xc0], 8
mov eax, dword [esp + 0xac]
jae 0x100220af
mov eax, esi
lea ecx, [esp + 0x24]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10022120
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.Flags
mov edi, eax
mov esi, 4
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10022126
cmp dword [esp + 0x14], esi
jne 0x10022126
cmp dword [esp + 0x1c], 1
jne 0x10022126
mov byte [esp + 0x13], bl
jmp 0x1002212b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 1
mov byte [esp + 0xe8], bl
cmp dword [esp + 0xc0], 8
jb 0x1002214d
mov eax, dword [esp + 0xac]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], cx
cmp edi, ebx
je 0x10022174
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0xe8], 2
xor edx, edx
push 0x37
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
lea esi, [esp + 0xb0]
mov dword [esp + 0xc4], 7
mov dword [esp + 0xc0], ebx
mov word [esp + 0xb0], dx
call fcn.1000a770
push 0x26
mov eax, str.2F5C139F_79BD_4C84_A95A_E7140525BC55
mov ecx, esi
mov byte [esp + 0xec], 3
call fcn.1000a640
mov eax, dword [esp + 0xac]
mov esi, 8
cmp dword [esp + 0xc0], esi
jae 0x100221ee
lea eax, [esp + 0xac]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10022247
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push str.Flags
push edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1002224d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xe8], 2
cmp dword [esp + 0xc0], esi
jb 0x1002226f
mov edx, dword [esp + 0xac]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
or esi, 0xffffffff
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], ax
mov dword [esp + 0xe8], esi
cmp edi, ebx
je 0x100222a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [0x100663d0], 1
jne 0x100222d4
or dword [0x100663d0], 1
mov dword [esp + 0xe8], 4
call fcn.1001ca20
push 0x1004e4a0
call fcn.10045bf9
add esp, 4
mov dword [esp + 0xe8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x10066338
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esp + 0x14]
lea eax, [esp + 0x18]
mov ecx, 0x10066328
xor edi, edi
call fcn.1001d240
mov eax, dword [esp + 0x18]
cmp eax, dword [0x1006632c]
je 0x1002230c
mov edi, dword [eax + 0x10]
push 0x10066338
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
cmp edi, esi
je 0x100224a9
cmp byte [esp + 0x13], 0
je 0x100224a9
mov edi, dword [esp + 0x20]
lea ecx, [edi - 0xc]
call fcn.10021d80
test eax, eax
jns 0x100224a5
mov ecx, dword [edi + 0x14]
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
push esi
push str.CommandBarClass
push esi
push ecx
call ebx
cmp eax, esi
je 0x100224a9
push esi
push str.ReBarWindow32
push esi
push eax
call ebx
cmp eax, esi
je 0x100224a9
push esi
push str.CommandToolbarBand
push esi
push eax
call ebx
mov ebx, eax
cmp ebx, esi
je 0x100224a9
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc100u.dll_CWnd::CWnd]
mov dword [esp + 0xe8], 5
mov edx, dword [edi + 0x14]
push edx
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc100u.dll_CWnd::Attach]
lea eax, [esp + 0xc8]
push eax
push ebx
mov dword [esp + 0xd0], esi
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], esi
mov dword [esp + 0xdc], esi
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [edi + 0x18], esi
jne 0x10022435
push 0x184
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0xe8], 6
cmp eax, esi
je 0x10022403
lea edi, [esp + 0x34]
mov esi, eax
call fcn.10014e20
mov edi, dword [esp + 0x20]
jmp 0x10022405
xor eax, eax
mov byte [esp + 0xe8], 5
lea ecx, [esp + 0x34]
mov dword [edi + 0x18], eax
mov edx, dword [eax]
mov edx, dword [edx + 0x16c]
push ecx
push 0xce
mov ecx, eax
call edx
mov esi, dword [edi + 8]
mov edi, dword [edi + 0x18]
call fcn.10015950
mov edi, dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0xd0]
push eax
push ebx
call esi
lea ecx, [esp + 0xc8]
push ecx
push ebx
call esi
mov edx, dword [esp + 0xd4]
mov eax, dword [esp + 0xd0]
mov ecx, dword [edi + 0x18]
push 1
push 0x190
push 0x168
push edx
add eax, 0xfffffe98
push eax
call dword [sym.imp.mfc100u.dll_CWnd::MoveWindow]
mov ecx, dword [edi + 0x18]
push 5
call dword [sym.imp.mfc100u.dll_CWnd::ShowWindow]
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc100u.dll_CWnd::Detach]
lea ecx, [esp + 0x34]
mov dword [esp + 0xe8], 0xffffffff
call dword [0x1004f638]
xor eax, eax
jmp 0x100224ae
mov eax, 0x80004005
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.10045a28
mov esp, ebp
pop ebp
ret 0x18