Function at 0x42d060
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x150
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
mov ebx, dword [esp + 0x158]
mov dword [esp + 4], 0
test ebx, ebx
je 0x42dbb7
cmp dword [ebx], 0x708
jne 0x42dbb7
push ebp
push esi
push edi
push 0x704
lea eax, [ebx + 4]
push 0
push eax
call fcn.0052b3e0
add esp, 0xc
mov dword [ebx], 0x708
cmp dword [0x7ea8c8], 0
je 0x42d492
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
push reloc.ace32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42d492
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42d492
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x18], 0x104
push ecx
push 0
push 0
push str.ThemeActive
push eax
call ebp
test eax, eax
je 0x42d121
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d492
lea eax, [esp + 0x58]
push eax
call fcn.0053537f
add esp, 4
test eax, eax
jne 0x42d141
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d492
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push str.DllName
push dword [esp + 0x24]
call ebp
test eax, eax
je 0x42d175
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d492
push 0x103
lea edi, [ebx + 0x10]
push edi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea esi, [esp + 0x58]
mov ecx, edi
sub esi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x42d191
lea eax, [esp + 0x58]
push eax
call fcn.00535666
lea eax, [esp + 0x5c]
push str..msstyles
push eax
call fcn.0052b990
add esp, 0xc
test eax, eax
jne 0x42d1dd
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
push 0
push edi
call fcn.0052b3e0
add esp, 0xc
jmp 0x42d492
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea ebp, [ebx + 0x114]
push ebp
push 0
push 0
push str.ColorName
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x10]
test eax, eax
je 0x42d214
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d240
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x42d220
lea eax, [esp + 0x58]
push 0x5c
push eax
call fcn.0052b850
add esp, 8
test eax, eax
jne 0x42d262
push 0x104
push 0
push edi
call fcn.0052b3e0
push 0x104
push 0
push ebp
call fcn.0052b3e0
add esp, 0x18
jmp 0x42d492
lea ecx, [esp + 0x58]
mov byte [eax], 0
dec ecx
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42d270
mov eax, dword [str._shell_]
mov esi, ebp
mov dword [ecx], eax
mov eax, dword [0x693d14]
mov dword [ecx + 4], eax
nop dword [eax + eax]
mov al, byte [ebp]
inc ebp
test al, al
jne 0x42d290
lea edi, [esp + 0x58]
sub ebp, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42d2a0
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x58]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42d2c0
mov eax, dword [str._shellstyle.dll]
lea esi, [ebx + 0x218]
mov dword [ecx], eax
mov edx, esi
mov eax, dword [0x693d1c]
mov dword [ecx + 4], eax
mov eax, dword [0x693d20]
mov dword [ecx + 8], eax
mov eax, dword [0x693d24]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x58]
mov eax, ecx
sub edx, eax
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x42d300
cmp dword [esp + 0x168], 0
jne 0x42d492
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebp, eax
test ebp, ebp
je 0x42d492
push str.UIFILE
push 1
push ebp
mov dword [ebx + 0xc], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x42d48b
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x42d48b
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
je 0x42d484
test eax, eax
je 0x42d484
push esi
push eax
call fcn.0042fcb0
mov esi, eax
add esp, 8
test esi, esi
je 0x42d484
push ebp
push ebx
push esi
call fcn.0042dff0
add esp, 0xc
test eax, eax
jne 0x42d5f0
mov eax, dword [ebx + 0x4e8]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x42d3c0
push eax
call edi
mov eax, dword [ebx + 0x530]
test eax, eax
je 0x42d3cd
push eax
call edi
mov eax, dword [ebx + 0x534]
test eax, eax
je 0x42d3da
push eax
call edi
mov eax, dword [ebx + 0x538]
test eax, eax
je 0x42d3e7
push eax
call edi
mov eax, dword [ebx + 0x53c]
test eax, eax
je 0x42d3f4
push eax
call edi
mov eax, dword [ebx + 0x540]
test eax, eax
je 0x42d401
push eax
call edi
mov eax, dword [ebx + 0x544]
test eax, eax
je 0x42d40e
push eax
call edi
mov eax, dword [ebx + 0x67c]
test eax, eax
je 0x42d41b
push eax
call edi
mov eax, dword [ebx + 0x6c4]
test eax, eax
je 0x42d428
push eax
call edi
mov eax, dword [ebx + 0x6c8]
test eax, eax
je 0x42d435
push eax
call edi
mov eax, dword [ebx + 0x6cc]
test eax, eax
je 0x42d442
push eax
call edi
mov eax, dword [ebx + 0x6d0]
test eax, eax
je 0x42d44f
push eax
call edi
mov eax, dword [ebx + 0x6d4]
test eax, eax
je 0x42d45c
push eax
call edi
mov eax, dword [ebx + 0x6d8]
test eax, eax
je 0x42d470
push eax
call edi
nop dword [eax]
push esi
mov esi, dword [esi + 4]
call fcn.00534e4a
add esp, 4
test esi, esi
jne 0x42d470
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 5
mov dword [ebx + 4], 1
call esi
push 5
mov dword [ebx + 0x33c], eax
call esi
push 0x12
mov dword [ebx + 0x340], eax
mov dword [ebx + 0x344], 0
mov dword [ebx + 0x354], 0xc
mov dword [ebx + 0x350], 0xc
mov dword [ebx + 0x34c], 0xc
mov dword [ebx + 0x348], 0xc
mov dword [ebx + 0x36c], 6
mov dword [ebx + 0x370], 0
mov dword [ebx + 0x374], 4
mov dword [ebx + 0x378], 0
mov dword [ebx + 0x37c], 0
mov dword [ebx + 0x380], 4
mov dword [ebx + 0x384], 0
mov dword [ebx + 0x388], 0
mov dword [ebx + 0x38c], 0
mov dword [ebx + 0x390], 4
mov dword [ebx + 0x394], 0
mov dword [ebx + 0x398], 0
call esi
push 0x1a
mov dword [ebx + 0x39c], eax
call esi
mov ebp, dword [sym.imp.GDI32.dll_GetStockObject]
lea edi, [ebx + 0x3dc]
mov dword [ebx + 0x3a0], eax
lea eax, [esp + 0x1c]
movups xmm0, xmmword [ebx + 0x36c]
push eax
push 0x11
movups xmmword [ebx + 0x3a4], xmm0
movups xmm0, xmmword [ebx + 0x37c]
movups xmmword [ebx + 0x3b4], xmm0
movups xmm0, xmmword [ebx + 0x38c]
movups xmmword [ebx + 0x3c4], xmm0
movq xmm0, qword [ebx + 0x39c]
movq qword [ebx + 0x3d4], xmm0
call ebp
push eax
call fcn.0042dbe0
test eax, eax
je 0x42d62e
lea ecx, [esp + 0x38]
mov eax, ecx
sub edi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x42d5d2
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x4e0], eax
jmp 0x42d649
push esi
mov esi, dword [esi + 4]
call fcn.00534e4a
add esp, 4
test esi, esi
jne 0x42d5f0
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00529c8c
add esp, 0x150
ret 8
mov eax, dword [str.Arial]
mov dword [edi], eax
mov ax, word [0x693ca8]
mov word [edi + 4], ax
mov dword [ebx + 0x4e0], 0xfffffff3
push 0x12
mov dword [ebx + 0x4e4], 0xf
call esi
push 0x12
mov dword [ebx + 0x4f4], eax
call esi
push 0xf
mov dword [ebx + 0x4f8], eax
mov dword [ebx + 0x4fc], 0x21
mov dword [ebx + 0x500], 0x2bc
mov dword [ebx + 0x504], 0xa
mov dword [ebx + 0x508], 0
mov dword [ebx + 0x50c], 1
mov dword [ebx + 0x510], 0
mov dword [ebx + 0x514], 2
mov dword [ebx + 0x518], 2
mov dword [ebx + 0x51c], 2
mov dword [ebx + 0x520], 0
call esi
mov dword [ebx + 0x524], eax
lea eax, [ebx + 0x52c]
push eax
lea eax, [ebx + 0x528]
mov dword [ebx + 0x4ec], 0xba
push eax
push 0xff
push 0x12
mov dword [ebx + 0x4f0], 0x15
call esi
push eax
push 0xf0e0d
push 0x6b
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x530], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x6c
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x534], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x6d
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x538], eax
push 0
push 0
push 0xff
push 0x12
call esi
push eax
push 0xf0e0d
push 0x6e
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x53c], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x6f
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x540], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x70
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x544], eax
push 5
call esi
push 0xf
mov dword [ebx + 0x548], eax
call esi
mov dword [ebx + 0x55c], eax
lea edi, [ebx + 0x570]
lea eax, [esp + 0x1c]
mov dword [ebx + 0x54c], 1
push eax
push 0x11
mov dword [ebx + 0x554], 1
mov dword [ebx + 0x550], 0
mov dword [ebx + 0x558], 1
mov dword [ebx + 0x568], 0xc
mov dword [ebx + 0x560], 0xc
mov dword [ebx + 0x56c], 0xa
mov dword [ebx + 0x564], 0xa
call ebp
push eax
call fcn.0042dbe0
test eax, eax
je 0x42d889
lea ecx, [esp + 0x38]
mov eax, ecx
sub edi, eax
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x42d870
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x674], eax
jmp 0x42d8a4
mov eax, dword [str.Arial]
mov dword [edi], eax
mov ax, word [0x693ca8]
mov word [edi + 4], ax
mov dword [ebx + 0x674], 0xfffffff3
push 0xe
mov dword [ebx + 0x678], 0xf
call esi
push 0xe
mov dword [ebx + 0x688], eax
call esi
push 0xd
mov dword [ebx + 0x68c], eax
mov dword [ebx + 0x690], 0x21
mov dword [ebx + 0x694], 0x2bc
mov dword [ebx + 0x698], 0xa
mov dword [ebx + 0x69c], 0
mov dword [ebx + 0x6a0], 1
mov dword [ebx + 0x6a4], 0
mov dword [ebx + 0x6a8], 2
mov dword [ebx + 0x6ac], 2
mov dword [ebx + 0x6b0], 2
mov dword [ebx + 0x6b4], 0
call esi
mov dword [ebx + 0x6b8], eax
lea eax, [ebx + 0x6c0]
push eax
lea eax, [ebx + 0x6bc]
mov dword [ebx + 0x680], 0xba
push eax
push 0xff
push 0xe
mov dword [ebx + 0x684], 0x15
call esi
push eax
push 0xf0e0d
push 0x6b
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x6c4], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6c
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x6c8], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6d
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x6cc], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6e
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x6d0], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x6f
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x6d4], eax
push 0
push 0
push 0xff
push 0xe
call esi
push eax
push 0xf0e0d
push 0x70
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x6d8], eax
push 5
call esi
push 0xd
mov dword [ebx + 0x6dc], eax
call esi
mov dword [ebx + 0x6f4], eax
lea eax, [ebx + 0x320]
push eax
lea eax, [ebx + 0x31c]
mov dword [ebx + 0x6e0], 0x44
push eax
push 0xff
push 0x12
mov dword [ebx + 0x6e4], 1
mov dword [ebx + 0x6ec], 1
mov dword [ebx + 0x6e8], 0
mov dword [ebx + 0x6f0], 1
mov dword [ebx + 0x700], 0xc
mov dword [ebx + 0x6f8], 0xc
mov dword [ebx + 0x704], 0xa
mov dword [ebx + 0x6fc], 0xa
call esi
push eax
push 0xf0e0d
push 0x74
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x324], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x75
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x328], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x76
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x32c], eax
push 0
push 0
push 0xff
push 0x12
call esi
push eax
push 0xf0e0d
push 0x71
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x330], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x72
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x334], eax
push 0
push 0
push 0xff
push 0x1a
call esi
push eax
push 0xf0e0d
push 0x73
push dword [0x7ea8cc]
call fcn.0042f9e0
add esp, 0x1c
mov dword [ebx + 0x338], eax
jmp 0x42d60e
mov ecx, dword [esp + 0x150]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.00529c8c
add esp, 0x150
ret 8