Function at 0x437490
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
sub esp, 0x10
cmp dword [0x75dbb8], 0
push ebx
mov ebx, ecx
je 0x437717
push ebp
push str.RtlGetNtVersionNumbers
push 0x680864
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x437716
push edi
lea edi, [ebx + 0x44]
push edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
call eax
and dword [edi], 0xfffffff
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
cmp eax, 0xa
jne 0x437529
test edx, edx
ja 0x43750b
cmp ecx, 0x4563
jb 0x437715
test edx, edx
jne 0x43750b
cmp ecx, 0x47ba
jae 0x43750b
mov byte [ebx + 0x43], 1
mov ecx, 1
mov dword [0x75da78], ecx
cmp eax, 0xa
jne 0x437531
test edx, edx
ja 0x437533
cmp dword [edi], 0x4f2e
jae 0x437533
jmp 0x43753e
jbe 0x437715
jmp 0x43750b
jbe 0x437539
mov dword [0x75da7c], ecx
cmp eax, 0xa
jne 0x43754c
test edx, edx
ja 0x43754e
cmp dword [edi], 0x55f0
jae 0x43754e
jmp 0x437551
jbe 0x437551
mov byte [ebx + 0x42], cl
push esi
push str.uxtheme.dll
call fcn.004476d0
mov esi, eax
add esp, 4
test esi, esi
je 0x437714
push 0x31
push esi
call ebp
push 0x68
push esi
mov dword [0x75daa0], eax
call ebp
push 0x6a
push esi
mov dword [0x75da94], eax
call ebp
push 0x84
push esi
mov dword [0x75da9c], eax
call ebp
push 0x85
push esi
mov dword [0x75da84], eax
call ebp
push 0x87
push esi
mov dword [0x75da88], eax
call ebp
cmp dword [edi], 0x47ba
jae 0x4375b8
mov dword [0x75da8c], eax
jmp 0x4375bd
mov dword [0x75daac], eax
push 0x89
push esi
call ebp
push str.SetWindowCompositionAttribute
push 0x680814
mov dword [0x75da98], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebp
push str.SetWindowTheme
push esi
mov dword [0x75da80], eax
call ebp
push str.OpenThemeData
push esi
mov dword [0x75daa4], eax
call ebp
push str.GetThemeColor
push esi
mov dword [0x75dab0], eax
call ebp
push str.CloseThemeData
push esi
mov dword [0x75dab4], eax
call ebp
cmp dword [0x75daa0], 0
mov dword [0x75dab8], eax
je 0x437714
call fcn.004372a0
test eax, eax
je 0x437714
cmp dword [0x75da94], 0
je 0x437714
cmp dword [0x75da84], 0
je 0x437714
cmp dword [0x75daa4], 0
je 0x437714
cmp dword [0x75da88], 0
je 0x437714
cmp dword [0x75da8c], 0
jne 0x43767a
cmp dword [0x75daac], 0
je 0x437714
cmp dword [0x75da98], 0
je 0x437714
mov byte [ebx + 0x41], 1
call fcn.00437390
mov byte [ebx + 0x40], al
mov eax, dword [0x75dbe4]
test eax, eax
je 0x4376ff
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push str.bDkMdAllowed
push eax
mov dword [esp + 0x34], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4376d4
cmp dword [esp + 0x10], eax
setne al
mov byte [ebx + 0x3c], al
cmp byte [ebx + 0x3c], 0
je 0x4376fb
call dword [0x75da84]
test al, al
je 0x4376f4
cmp byte [ebx + 0x40], 0
jne 0x4376f4
mov eax, 1
mov byte [ebx + 0x3d], al
jmp 0x4376ff
xor eax, eax
mov byte [ebx + 0x3d], al
jmp 0x4376ff
mov byte [ebx + 0x3d], 0
cmp byte [ebx + 0x3d], 0
je 0x437714
push 1
mov ecx, ebx
call fcn.00437460
call dword [0x75da94]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret