Function at 0x1002038
Capabilities:
Create process on windows
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x1003018]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 2
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x270]
push eax
push 4
push 0x1001228
xor ebx, ebx
push 0x10011b8
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], ebx
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
call fcn.01001cf3
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1002137
mov esi, 0x10011a8
lea edi, [ebp - 0x20c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7e
pop ecx
xor eax, eax
lea edi, [ebp - 0x1fc]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x20c]
push eax
call edi
lea esi, [ebp + eax*2 - 0x20c]
lea eax, [ebp - 0x20c]
push eax
call edi
mov edi, 0x104
mov ecx, edi
sub ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
jmp 0x10020f0
mov ax, word [esi]
cmp ax, 0x5c
jne 0x10020eb
push 0x2f
pop eax
mov word [esi], ax
inc esi
inc esi
cmp word [esi], bx
jne 0x10020df
cmp word [esi - 2], 0x2f
je 0x1002105
mov word [esi], 0x2f
mov word [esi + 2], bx
push 0x1001174
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01001d61
test eax, eax
jne 0x10022d3
push 1
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10022d3
push esi
call fcn.01001ee9
test eax, eax
je 0x10022c9
lea eax, [ebp - 0x27c]
push eax
mov dword [ebp - 0x27c], 8
mov dword [ebp - 0x278], 0x200
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0xc
pop ecx
xor eax, eax
lea edi, [ebp - 0x2e0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2e4]
push eax
mov dword [ebp - 0x2e4], 0x34
mov dword [ebp - 0x2dc], esi
mov dword [ebp - 0x2e0], 0x800
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2d8], 0x65
mov dword [ebp - 0x2cc], 0x1001f67
call dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
push 0x7c
pop ecx
mov dword [ebp - 0x26c], eax
xor eax, eax
lea edi, [ebp - 0x1f4]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x1f8]
push eax
push ebx
push 0x29
mov dword [ebp - 0x1f8], 0x1f4
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x17
pop ecx
push 0x20
lea eax, [ebp - 0x24c]
push eax
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x268]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x274]
push 0x5dc
push edi
mov dword [ebp - 0x258], 0x2bc
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
cmp esi, ebx
je 0x100225a
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul eax, eax, 0xfffffff4
push 0x48
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push esi
push ebx
mov dword [0x1003020], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x2b0]
push eax
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2b0], 0x34
mov dword [ebp - 0x2ac], 0x1008004
mov dword [ebp - 0x288], 0xc8
mov dword [ebp - 0x2a0], 0x64
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x298], 1
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov eax, dword [0x1003020]
cmp eax, ebx
je 0x10022d3
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x10022d3
push 0x5e7
call fcn.01001e9c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.01002382
leave
ret 4