Function at 0x14007b5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
movsxd rbx, edx
mov r14, rcx
mov esi, 0xffff00ff
test r8b, r8b
jne 0x14007b678
mov eax, dword [0x14037be18]
test eax, eax
je 0x14007b621
cmp r9d, 1
jne 0x14007b669
mov edi, 2
mov dword [rbp - reloc.OLEAUT32.dll_SafeArrayGetDim], 0x10
xor eax, eax
mov dword [0x14037be18], edi
xor r9d, r9d
mov qword [rbp - 0xc], rax
lea r8, [rbp - 0x10]
mov dword [rbp - 4], eax
lea edx, [rdi + 0xe]
lea ecx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14007b669
test byte [rbp - 0xc], 1
jne 0x14017b5ee
xchg dword [0x14037be18], edi
mov eax, dword [0x14037be18]
cmp eax, 1
je 0x14017b5f8
xor edi, edi
lea rdx, [0x140000000]
cmp ebx, 0xd1
jbe 0x14007b71a
mov qword [rsp + 0xc8], r15
cmp ebx, 2
je 0x14007b748
cmp ebx, 1
je 0x14007b80a
lea eax, [rbx - 3]
cmp eax, 4
jbe 0x14007b80a
cmp ebx, 0xd7
je 0x14017b68b
cmp ebx, 8
je 0x14017b68b
cmp ebx, 0xd2
je 0x14017b69b
test ebx, ebx
je 0x14017b68b
cmp ebx, 0xd1
jbe 0x14017b676
lea eax, [rbx - 0xd2]
cmp eax, 0x3f8
ja 0x14007b803
movsxd rax, ebx
mov eax, dword [rdx + rax*4 + 0x314d88]
mov r15, qword [rsp + 0xc8]
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rbx + rbx*2]
mov r8b, 1
lea r9, [rdx + 0x379d20]
mov r10d, edi
lea r9, [r9 + rcx*4]
test r8b, r8b
je 0x14007b68d
mov eax, dword [r9]
test al, 0x40
je 0x14007b68d
jmp 0x14017b636
lea r14, [0x14037c344]
lea r15, [0x14037c340]
cmp dword [0x14037d280], edi
mov qword [rbp - 0x40], rdi
jne 0x14017b70c
mov rax, qword [0x14037b700]
mov qword [rbp - 0x40], rax
movzx eax, byte [0x14037be05]
test al, al
je 0x14017b73b
mov rbx, qword [0x14037be10]
mov rbx, qword [rbx]
mov rsi, rbx
shr rsi, 0x20
cmp qword [0x14037e558], rdi
jne 0x14017b925
shr rbx, 0x20
cmp ebx, dword [0x140379a58]
jne 0x14007b849
mov al, 1
lea rdx, [rbp - 0x20]
mov byte [0x14037be1c], al
mov ecx, 1
mov dword [0x140379a58], ebx
mov qword [rbp - 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
cmp byte [0x14037be1c], dil
mov dword [rbp - 0x18], 1
je 0x14007b850
mov rcx, qword [rbp - 0x20]
mov esi, dword [r14]
test rcx, rcx
je 0x14007b7fd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
or esi, 0xff000000
mov eax, esi
jmp 0x14007b703
cmp ebx, 2
je 0x14007b748
dec ebx
cmp ebx, 6
ja case.0x14007b82b.2
movsxd rax, ebx
mov ecx, dword [rdx + rax*4 + 0x7b8c0]
add rcx, rdx
jmp rcx
lea r14, [0x14037c34c]
jmp 0x14007b74f
lea r14, [0x14037c348]
jmp 0x14007b74f
xor al, al
jmp 0x14007b7b0
mov rax, qword [0x14037e558]
lea r8, str.AccentPalette
mov rcx, qword [rbp - 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
test rax, rax
mov dword [rbp + 0x40], 0x20
mov r9d, 8
cmovne rcx, rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jg 0x14017b96a
js 0x14017b979
cmp dword [rbp + 0x40], 0x20
jne 0x14017b979
mov byte [0x14037be1c], 1
jmp 0x14007b7e5
mov edi, 1
jmp 0x14007b663
cmp ebx, 0x4ca
ja 0x14007b678
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbx*4 + 0x33fc50]
cmp ecx, 0x1f
jne 0x14017b620
xor edi, edi
mov eax, edi
jmp 0x14007b70b
call qword [sym.imp.USER32.dll_GetSysColor]
nop dword [rax + rax]
or eax, 0xff000000
jmp 0x14007b70b
mov ebx, eax
shr ebx, 0x10
cmp ebx, 0x4ca
jae 0x14017b65c
cmp ebx, 0xd2
jae 0x14017b661
lea rcx, [rbx + rbx*2]
lea r9, [rdx + 0x379d20]
lea r9, [r9 + rcx*4]
jmp 0x14017b664
mov ebx, 0x4ca
xor r8b, r8b
inc r10d
cmp r10d, 0xa
jb 0x14007b72f
jmp 0x14007b68d
mov edx, dword [r14 + 4]
mov r8d, ebx
mov ecx, dword [r14]
call fcn.140255150
nop
jmp 0x14007b703
cmp ebx, 0xd2
je 0x14017b69b
test ebx, ebx
je 0x14017b69b
xor cl, cl
jmp 0x14017b69d
mov cl, 1
test ebx, 0xfffffff7
sete dl
call fcn.1402550f0
mov ecx, eax
call fcn.140055e60
nop
jmp 0x14007b703
lea r15, [0x14037c340]
mov r14, r15
jmp 0x14007b756
lea r14, [0x14037c350]
jmp 0x14007b74f
lea r14, [0x14037c354]
jmp 0x14007b74f
lea r14, [0x14037c358]
jmp 0x14007b74f
mov rcx, qword [rbp + 0x28]
lea r8, [0x14030e608]
mov r9d, 0x80070057
mov edx, Ordinal_548
call fcn.14001eb0c
nop
jmp 0x14007b7fd
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x40]
call fcn.140254e0c
cmp dword [0x14037d280], edi
je 0x14007b771
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x40]
call fcn.140254e0c
mov rbx, qword [rbp - 0x40]
jmp 0x14007b79e
call fcn.1400988a4
mov ebx, eax
test eax, eax
js 0x14017b91c
movzx ecx, byte [0x14037be05]
test cl, cl
jne 0x14017b8f5
mov qword [rsp + 0xb0], r12
mov edx, 1
mov qword [rsp + 0xb8], r13
mov ecx, 0xf001f
lea r13, str.LocalSessionImmersiveColorPreference
mov sil, 1
mov r8, r13
xor r12b, r12b
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
mov ebx, 4
test rax, rax
jne 0x14017b7ea
mov r8, r13
lea edx, [rbx - 3]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
xor sil, sil
test rax, rax
jne 0x14017b7ea
mov qword [rsp + 0x28], r13
lea rcx, [rax - 1]
xor r9d, r9d
mov dword [rsp + 0x20], 8
mov r8d, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
nop dword [rax + rax]
mov sil, 1
movzx r12d, sil
test rax, rax
je 0x14017b8e0
mov qword [0x14037be08], rax
mov byte [0x14037be04], sil
movzx eax, byte [0x14037be04]
mov rcx, qword [0x14037be08]
test al, al
mov eax, 0xf001f
mov qword [rsp + 0x20], 8
cmovne ebx, eax
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [0x14037be10], rax
mov rax, qword [0x14037be10]
test rax, rax
je 0x14017b8e0
mov ebx, edi
test r12b, r12b
je 0x14017b8b0
mov rcx, qword [0x14037be10]
call fcn.14007b970
call fcn.14025507c
test al, al
jne 0x14017b8b0
lea rcx, [rbp - 0x28]
call fcn.1400211e0
test eax, eax
js 0x14017b8b0
mov rsi, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [0x14039e2d0]
nop dword [rax + rax]
test eax, eax
je 0x14017b8a1
mov rcx, qword [rbp - 0x30]
call fcn.140255468
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
call fcn.14009a1f8
mov rcx, qword [0x14037b700]
test eax, eax
cmovne rcx, qword [0x14037b6f8]
mov qword [0x14037b700], rcx
call fcn.14007b8e4
call fcn.140088b40
mov byte [0x14037be05], 1
jmp 0x14017b8e5
mov ebx, 0x80004005
mov r13, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xb0]
mov rax, qword [0x14037d278]
test rax, rax
je 0x14017b914
mov rcx, qword [0x14037d278]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
nop dword [rax + rax]
test ebx, ebx
jns 0x14007b780
mov rbx, qword [rbp - 0x40]
jmp 0x14007b79e
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rdi
call fcn.14007b970
cmp qword [0x14037e558], rdi
jne 0x14017b961
mov byte [0x14037be1c], dil
cmp dword [rbp - 0x38], ebx
jne 0x14017b94c
cmp dword [rbp - 0x34], esi
je 0x14017b961
call fcn.14025507c
test al, al
jne 0x14017b961
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.140255584
mov rbx, qword [rbp - 0x38]
jmp 0x14007b79e
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x14007b8a4
mov rax, qword [0x14037e558]
mov ecx, 0xd77800
mov rdx, qword [rbp - 0x20]
test rax, rax
cmovne rdx, rax
xor r8d, r8d
call fcn.140257008
test eax, eax
jns 0x14007b8b4
mov rcx, qword [rbp + 0x28]
lea r8, [0x14030e608]
mov r9d, eax
mov edx, 0x23c
call fcn.14009d7ec
nop
jmp 0x14007b8b4