Function at 0x1001baa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.1001c210
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
xor ecx, ecx
cmp eax, 7
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x1005d074
push 0
push 0x10
push str.MetroHotkey
push str.SoftwareStartIsBack
setg cl
push SHChangeNotifyRegister
mov dword [0x1005dc30], ecx
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d070
push 0
push 0x10
push str.CombineWinX
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc1c
push 0
push 0x10
push str.HideUserFrame
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc30
push 0
push 0x10
push str.FadeUserFrame
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc20
push 0
push 0x10
push str.AllProgramsFlyout
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005e0b8
push 0
push 0x10
push str.StartScreenShortcut
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005e0b4
push 0
push 0x10
push str.WinkeyFunction
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x1005e0b0
push 0
push 0x10
push str.MetroHotkeyFunction
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc34
push 0
push 0x10
push str.Start_AlignMenuSide
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d068
push 0
push 0x10
push str.StartMenuMonitor
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005e0ac
push 0
push 0x10
push str.TerminateOnClose
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d06c
push 0
push 0x10
push str.StartMetroAppsMFU
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d030
push 0
push 0x10
push str.StartMetroAppsFolder
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005e0a8
push 0
push 0x10
push str.TaskbarLargerIcons
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc50
push 0
push 0x10
push str.TaskbarCenterIcons
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x1005dc54
push 0
push 0x10
push str.TaskbarTranslucentEffect
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005e0a4
push 0
push 0x10
push str.TaskbarSpacierIcons
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d060
push 0
push 0x10
push str.TaskbarJumpList
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d028
push 0
push 0x10
push str.ModernIconsUnplated
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d058
push 0
push 0x10
push str.ModernIconsBadgesStartMenu
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dbfc
push 0
push 0x10
push str.ModernIconsColorful
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d050
push 0
push 0x10
push str.ImmersiveMenus
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
xor eax, eax
mov dword [ebp - 8], 0x104
mov word [0x1005de98], ax
lea eax, [ebp - 8]
push eax
push 0x1005de98
push 0
push 2
push str.AlterStyle
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
push 0x1005de98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x1001be55
cmp dword [0x1005dc18], 0
je 0x1001be49
push str.Plain10.msstyles
jmp 0x1001be4e
push str.Plain8.msstyles
push 0x1005de98
call edi
mov edx, str.Styles
mov ecx, 0x1005de98
call fcn.1001ba00
xor eax, eax
mov dword [ebp - 8], 0x104
mov word [0x1005dc90], ax
lea eax, [ebp - 8]
push eax
push 0x1005dc90
push 0
push 2
push str.TaskbarStyle
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
push 0x1005dc90
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1001beac
push 0x1005de98
push 0x1005dc90
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d020
push 0
push 0x10
push str.Start_NotifyNewApps
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d020
push 0
push 0x10
push str.Start_NotifyNewApps
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d03c
push 0
push 0x10
push str.Start_AutoCascade
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d03c
push 0
push 0x10
push str.Start_AutoCascade
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d024
push 0
push 0x10
push str.Start_SortByName
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d024
push 0
push 0x10
push str.Start_SortByName
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc04
push 0
push 0x10
push str.Start_SortFoldersFirst
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d040
push 0
push 0x10
push str.StartMenuDefaultView
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x1005d038
push 0
push 0x10
push str.Start_TrackProgs
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d044
push 0
push 0x10
push str.TaskbarAnimations
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d04c
push 0
push 0x10
push str.Start_SearchFiles
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d048
push 0
push 0x10
push str.Start_SearchPrograms
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005e0a0
push 0
push 0x10
push str.TaskbarSmallIcons
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d054
push 0
push 0x10
push str.TaskbarBadges
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005d05c
push 0
push 0x10
push str.MMTaskbarEnabled
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x1005dc8c
push 0
push 0x10
push str.MMTaskbarMode
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1042
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [0x1005d044]
xor ecx, ecx
cmp dword [ebp - 0xc], ecx
push 0x40000020
cmove eax, ecx
mov dword [0x1005d044], eax
call dword [sym.imp.SHELL32.dll_SHRestricted]
mov ecx, dword [0x1005d064]
xor edx, edx
test eax, eax
mov dword [ebp - 4], edx
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
cmovne ecx, edx
push eax
push edx
push 0x10
push str.NoStartApps
push str.SoftwarePoliciesStartIsBack
push SHChangeNotifyRegister
mov dword [0x1005d064], ecx
call esi
cmp dword [ebp - 4], 0
je 0x1001c202
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x29a
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push 0
push 0x10
push str.StartMetroApps
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov eax, dword [ebp - 8]
cmp eax, 2
jne 0x1001c1ca
mov ecx, 1
mov dword [0x1005d06c], 1
cmp dword [0x1005d030], ecx
pop edi
cmova ecx, dword [0x1005d030]
mov dword [0x1005d030], ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1001c1f4
mov ecx, eax
mov dword [0x1005d06c], 0
cmp dword [0x1005d030], ecx
pop edi
cmova ecx, dword [0x1005d030]
mov dword [0x1005d030], ecx
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1001c202
mov dword [0x1005d030], eax
mov dword [0x1005d06c], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret