Function at 0x406bf0
Capabilities:
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x108
mov eax, dword [ecx]
mov dword [ebp - 0xec], eax
mov eax, dword [ecx + 4]
mov edx, dword [eax + 4]
test edx, edx
je 0x406c59
mov edx, dword [edx + 8]
lea ebx, [ebp - 0xbe]
mov dword [ebp - 0xe0], 0
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 0x10], edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], str.Control_PanelAppearanceClassicSchemes
mov dword [esp + 4], 0x40e4bc
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call edi
cmp eax, 0x2a
jg 0x406c78
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea eax, [ebp - 0xe0]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x406c59
xor ebx, ebx
jmp 0x406cdc
lea edx, [ebx + ebx*2]
mov dword [edx*4 + 0x40d028], eax
mov dword [esp + 4], ebx
add ebx, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
call fcn.00406b00
cmp ebx, 0xa
je 0x406da0
lea eax, [ebp - 0xce]
mov esi, dword [ebp - 0xe0]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Size_d
mov dword [esp], eax
call edi
cmp eax, 4
jle 0x406d86
mov dword [ebp - 0xd4], 4
lea eax, [ebp - 0xd4]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xdc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xce]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x406d86
cmp dword [ebp - 0xdc], 4
jne 0x406d86
mov edx, dword [0x41300c]
mov eax, dword [ebp - 0xd8]
cmp edx, 0x60
je 0x406d7e
mov dword [esp + 8], 0x60
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub esp, 0xc
test eax, eax
jns 0x406cb0
mov dword [esp + 4], ebx
mov dword [esp], 0x4130a0
call fcn.00406840
jmp 0x406cb0
mov dword [ebp - 0xf0], 1
xor ebx, ebx
mov esi, ebx
mov ebx, edi
lea eax, [ebp - 0xce]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Font_d
mov dword [esp], eax
call ebx
cmp eax, 4
jg 0x406de0
cmp esi, 5
ja case.0x406dd5.0
jmp dword [esi*4 + 0x40e4ec]
cmp esi, 5
ja case.0x406de9.0
jmp dword [esi*4 + 0x40e504]
mov edi, dword [ebp - 0xec]
lea eax, [ebp - 0xce]
movdqu xmm0, xmmword [0x41311c]
movups xmmword [edi + 0x7c], xmm0
movdqu xmm1, xmmword [0x41312c]
movups xmmword [edi + 0x8c], xmm1
movdqu xmm2, xmmword [0x41313c]
movups xmmword [edi + 0x9c], xmm2
movdqu xmm3, xmmword [0x41314c]
movups xmmword [edi + 0xac], xmm3
movdqu xmm4, xmmword [0x41315c]
movups xmmword [edi + 0xbc], xmm4
movdqu xmm5, xmmword [0x413168]
movups xmmword [edi + 0xc8], xmm5
mov dword [esp + 8], 2
mov dword [esp + 4], str.Font_d
mov dword [esp], eax
call ebx
cmp eax, 4
jg case.0x406de9.2
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xce]
movdqu xmm6, xmmword [0x413180]
movups xmmword [ecx + 0xe0], xmm6
movdqu xmm7, xmmword [0x413190]
movups xmmword [ecx + 0xf0], xmm7
movdqu xmm0, xmmword [0x4131a0]
movups xmmword [ecx + 0x100], xmm0
movdqu xmm1, xmmword [0x4131b0]
movups xmmword [ecx + 0x110], xmm1
movdqu xmm2, xmmword [0x4131c0]
movups xmmword [ecx + 0x120], xmm2
movdqu xmm3, xmmword [0x4131cc]
movups xmmword [ecx + 0x12c], xmm3
mov dword [esp + 8], 3
mov dword [esp + 4], str.Font_d
mov dword [esp], eax
call ebx
cmp eax, 4
jg case.0x406de9.3
mov edi, dword [ebp - 0xec]
lea eax, [ebp - 0xce]
movdqu xmm4, xmmword [0x4131dc]
movups xmmword [edi + 0x13c], xmm4
movdqu xmm5, xmmword [0x4131ec]
movups xmmword [edi + 0x14c], xmm5
movdqu xmm6, xmmword [0x4131fc]
movups xmmword [edi + 0x15c], xmm6
movdqu xmm7, xmmword [0x41320c]
movups xmmword [edi + 0x16c], xmm7
movdqu xmm0, xmmword [0x41321c]
movups xmmword [edi + 0x17c], xmm0
movdqu xmm1, xmmword [0x413228]
movups xmmword [edi + 0x188], xmm1
mov dword [esp + 8], 4
mov dword [esp + 4], str.Font_d
mov dword [esp], eax
call ebx
cmp eax, 4
jg case.0x406de9.4
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xce]
movdqu xmm2, xmmword [0x413238]
movups xmmword [ecx + 0x198], xmm2
movdqu xmm3, xmmword [0x413248]
movups xmmword [ecx + 0x1a8], xmm3
movdqu xmm4, xmmword [0x413258]
movups xmmword [ecx + 0x1b8], xmm4
movdqu xmm5, xmmword [0x413268]
movups xmmword [ecx + 0x1c8], xmm5
movdqu xmm6, xmmword [0x413278]
movups xmmword [ecx + 0x1d8], xmm6
movdqu xmm7, xmmword [0x413284]
movups xmmword [ecx + 0x1e4], xmm7
mov dword [esp + 8], 5
mov dword [esp + 4], str.Font_d
mov dword [esp], eax
call ebx
cmp eax, 4
jg case.0x406de9.5
movdqu xmm0, xmmword [0x413298]
mov edi, dword [ebp - 0xec]
movups xmmword [edi + 0x1f8], xmm0
movdqu xmm1, xmmword [0x4132a8]
movups xmmword [edi + 0x208], xmm1
movdqu xmm2, xmmword [0x4132b8]
movups xmmword [edi + 0x218], xmm2
movdqu xmm3, xmmword [0x4132c8]
movups xmmword [edi + 0x228], xmm3
movdqu xmm4, xmmword [0x4132d8]
movups xmmword [edi + 0x238], xmm4
movdqu xmm5, xmmword [0x4132e4]
movups xmmword [edi + 0x244], xmm5
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x406c63
mov eax, dword [ebp - 0xec]
lea edi, [eax + 0x7c]
lea esi, [esi]
mov dword [ebp - 0xd4], 0x5c
lea eax, [ebp - 0xd4]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xce]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x407190
cmp dword [ebp - 0xd8], 3
jne 0x407190
cmp dword [ebp - 0xd4], 0x5c
jne 0x407190
mov eax, dword [0x41300c]
cmp eax, 0x60
jne 0x4071f0
add esi, 1
cmp esi, 6
jne 0x406db0
jmp 0x40705d
mov eax, dword [ebp - 0xec]
mov esi, 5
lea edi, [eax + 0x1f8]
jmp 0x407088
mov eax, dword [ebp - 0xec]
mov esi, 4
lea edi, [eax + 0x198]
jmp 0x407088
mov eax, dword [ebp - 0xec]
mov esi, 3
lea edi, [eax + 0x13c]
jmp 0x407088
mov eax, dword [ebp - 0xec]
mov esi, 2
lea edi, [eax + 0xe0]
jmp 0x407088
mov eax, dword [esi*4 + 0x40e5c8]
test eax, eax
je 0x4071cf
movdqu xmm6, xmmword [eax]
movups xmmword [edi], xmm6
movdqu xmm7, xmmword [eax + 0x10]
movups xmmword [edi + 0x10], xmm7
movdqu xmm6, xmmword [eax + 0x20]
movups xmmword [edi + 0x20], xmm6
movdqu xmm7, xmmword [eax + 0x30]
movups xmmword [edi + 0x30], xmm7
movdqu xmm0, xmmword [eax + 0x40]
movups xmmword [edi + 0x40], xmm0
movdqu xmm1, xmmword [eax + 0x4c]
movups xmmword [edi + 0x4c], xmm1
mov dword [ebp - 0xf0], 0
jmp 0x4070fe
mov eax, dword [ebp - 0xec]
xor esi, esi
lea edi, [eax + 0x18]
jmp 0x407088
mov dword [esp + 8], 0x60
mov edx, dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
mov dword [ebp - 0xf4], edx
call edx
sub esp, 0xc
mov dword [edi], eax
mov dword [esp + 8], 0x60
mov eax, dword [0x41300c]
mov dword [esp + 4], eax
mov eax, dword [edi + 4]
mov dword [esp], eax
mov edx, dword [ebp - 0xf4]
call edx
mov dword [edi + 4], eax
sub esp, 0xc
jmp 0x4070fe
mov eax, dword [ebp - 0xec]
mov esi, 0x4130b8
mov ecx, 0x17
add eax, 0x18
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, 1
jmp 0x406db0