Function at 0x10016710
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100967f1
mov eax, dword fs:[0]
push eax
sub esp, 0x6fc
mov eax, dword [0x100c7394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.10017620
test eax, eax
je 0x10016753
mov edx, 4
jmp 0x10016bef
push 0
mov ecx, ebx
call fcn.10018980
test eax, eax
je 0x10016775
mov ecx, ebx
call fcn.100190d0
test eax, eax
je 0x10016775
mov edx, 8
jmp 0x10016bef
mov ecx, ebx
call fcn.10018640
test eax, eax
je 0x1001678a
mov edx, 0x10
jmp 0x10016bef
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
jle 0x100167a1
mov edx, 0x40
jmp 0x10016bef
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x10016978
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10056af0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x668]
mov dword [ebp - 0x668], 0
push eax
lea eax, [ebp - 0x210]
push str.PP_dFrameClass
push eax
call fcn.1001a320
add esp, 0xc
cmp eax, 1
je 0x10016963
xor esi, esi
nop word [eax + eax]
mov ecx, dword [esi + 0x100c60f8]
lea eax, [ebp - 0x210]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10016846
test dx, dx
je 0x10016842
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10016846
add eax, 4
add ecx, 4
test dx, dx
jne 0x10016820
xor eax, eax
jmp 0x1001684b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10016963
add esi, 4
cmp esi, 0xc
jb 0x10016810
push 0x200
lea eax, [ebp - 0x618]
push 0
push eax
call fcn.10056af0
add esp, 0xc
lea eax, [ebp - 0x618]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x618]
push str.Microsoft_PowerPoint
push eax
call fcn.1005587b
add esp, 8
test eax, eax
jne 0x10016963
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x664]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.10056af0
push 0x104
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x664]
call fcn.10006c50
add esp, 0x18
mov dword [ebp - 0x620], 0
xor eax, eax
mov dword [ebp - 0x61c], 7
lea ecx, [ebp - 0x418]
mov word [ebp - 0x630], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10016907
sub ecx, edx
lea eax, [ebp - 0x418]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x630]
call fcn.1000aaa0
cmp dword [ebp - 0x620], 0
jbe 0x1001696d
cmp dword [ebp - 0x61c], 8
lea eax, [ebp - 0x630]
push str.wpp.exe
cmovae eax, dword [ebp - 0x630]
push eax
call fcn.10059e37
add esp, 8
test eax, eax
jne 0x1001696d
lea ecx, [ebp - 0x630]
call fcn.10004de0
mov edx, 0x80
jmp 0x10016bef
lea ecx, [ebp - 0x630]
call fcn.10004de0
call fcn.1002d8d0
test al, al
je 0x1001698b
mov edx, 0x100
jmp 0x10016bef
lea eax, [ebp - 0x668]
mov dword [ebp - 0x664], 0
push eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x66c], 4
push eax
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x668], 4
push eax
push str.advtool_PopWndTracker
push str.QJjheDPGgIfLdCr7I0tfziPXgetl01lS
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100169e8
cmp dword [ebp - 0x664], 1
jne 0x100169e8
lea edx, [eax + 1]
jmp 0x10016bef
mov ecx, ebx
call fcn.10017af0
test eax, eax
je 0x100169fd
mov edx, 2
jmp 0x10016bef
call fcn.10017530
mov ecx, eax
call fcn.10014b60
test eax, eax
je 0x10016a17
mov edx, 0x200
jmp 0x10016bef
call fcn.10017530
mov ecx, eax
call fcn.10014b30
test eax, eax
je 0x10016a31
mov edx, 0x400
jmp 0x10016bef
call fcn.1003e190
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10016b13
push 0x75
push str.d:jenkins.jenkinsworkspacelib_commonmodeidentifymodeidentifyldsmodeidentifyldsmodeidentifymodeidentifyex.cpp
lea ecx, [ebp - 0x660]
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], al
call fcn.1000a9b0
push 3
push 0x1009ee28
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.1000a9b0
mov byte [ebp - 4], 1
call fcn.1003e190
mov edi, eax
lea ecx, [ebp - 0x708]
push 0x35
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.10004330
mov esi, eax
push str.Start_to_Init_36OUtil
push esi
mov byte [ebp - 4], 2
call fcn.10005560
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x708]
call fcn.10005880
lea ecx, [ebp - 0x648]
call fcn.10004d90
lea ecx, [ebp - 0x660]
mov dword [ebp - 4], 0xffffffff
call fcn.10004d90
mov ecx, ebx
call fcn.10016040
mov esi, eax
xor edx, edx
mov ecx, esi
and ecx, 1
or ecx, edx
je 0x10016b2c
mov edx, 0x800
mov eax, esi
and eax, 4
or eax, 0
je 0x10016b3c
or edx, 0x1000
mov eax, esi
and eax, 0x80
or eax, 0
je 0x10016b4e
or edx, 0x2000
mov eax, esi
and eax, 0x100
or eax, 0
je 0x10016b60
or edx, 0x4000
mov eax, esi
and eax, 0x200
or eax, 0
je 0x10016b72
or edx, 0x8000
mov eax, esi
and eax, 0x400
or eax, 0
je 0x10016b84
or edx, 0x10000
mov eax, esi
and eax, 0x800
or eax, 0
je 0x10016b96
or edx, 0x20000
mov eax, esi
and eax, 0x2000
or eax, 0
je 0x10016ba8
or edx, 0x40000
mov eax, esi
and eax, 0x4000
or eax, 0
je 0x10016bba
or edx, 0x80000
mov eax, esi
and eax, 0x10000
or eax, 0
je 0x10016bcc
or edx, 0x100000
mov eax, esi
and eax, 0x8000
or eax, 0
je 0x10016bde
or edx, 0x200000
and esi, 0x1000
or esi, 0
je 0x10016bef
or edx, 0x400000
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d14a
mov esp, ebp
pop ebp
ret