Function at 0x484020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov dword [esp], 0
mov ebx, esp
push ebx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemes
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4841fc
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [0x5052b0]
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push 0
push eax
push str.CurrentTheme
push dword [esp + 0xc]
call fcn.00485460
add esp, 0x10
test al, al
je 0x4841d9
mov edi, dword [esp + 8]
test edi, edi
je 0x4841a3
mov ebx, dword [esp + 0xc]
mov ecx, edi
mov eax, edi
nop word cs:[eax + eax]
sub eax, 1
jb 0x48412a
cmp byte [ebx + ecx - 1], 0x2e
mov ecx, eax
jne 0x4840b0
cmp edi, eax
jbe 0x48412a
cmp dword [esp + 4], 0
je 0x4840d3
add ebx, eax
mov dword [esp + 8], eax
mov esi, ebx
jmp 0x484123
mov dword [esp + 8], 0
lea eax, [edi + 1]
mov ecx, 0x20
nop word cs:[eax + eax]
mov ebp, ecx
add ecx, ecx
cmp eax, ebp
ja 0x4840f0
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
push edi
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 8], edi
add esi, edi
mov ebp, dword [esp + 0x34]
mov byte [esi], 0
mov edi, dword [esp + 8]
test edi, edi
je 0x4841a3
mov eax, dword [esp + 0xc]
mov esi, edi
neg esi
add eax, edi
dec eax
xor ecx, ecx
nop dword [eax + eax]
mov edx, edi
add edx, ecx
je 0x4841a3
lea ebx, [ecx - 1]
inc esi
cmp byte [eax + ecx], 0x5c
mov ecx, ebx
jne 0x484140
mov eax, edi
add eax, ebx
jae 0x4841a3
cmp dword [esp + 4], 0
je 0x484191
mov eax, dword [esp + 0xc]
lea ecx, [eax + edi]
add ecx, ebx
inc ecx
mov edx, ebx
not edx
push edx
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov eax, dword [esp + 8]
not edi
add edi, eax
sub edi, ebx
mov dword [esp + 8], edi
add eax, dword [esp + 0xc]
mov byte [esi + eax - 1], 0
jmp 0x4841a3
mov eax, ebx
neg eax
mov dword [esp + 8], eax
add edi, dword [esp + 0xc]
add edi, ebx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0xc]
movsx edi, byte [esi]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
test eax, eax
je 0x4841c8
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
add esp, 4
mov byte [esi], al
mov esi, dword [esp + 0xc]
mov ebx, esp
push esi
push 0x4fc6ee
push ebp
call fcn.00472860
add esp, 0xc
cmp dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x4841fc
mov dword [esp + 4], 0
push dword [esp + 0xc]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp]
test eax, eax
je 0x48420a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 4
lea edi, [esp + 0x10]
push edi
push ebx
push 0
push 0x10
push str.AccentColor
push str.SoftwareMicrosoftWindowsDWM
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x484267
lea eax, [esp + 4]
push edi
push eax
push 0
push 0x10
push str.ColorizationColor
push str.SoftwareMicrosoftWindowsDWM
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x48489c
mov eax, 0xffffff
and eax, dword [esp + 4]
jmp 0x484282
mov eax, dword [esp]
movzx ecx, al
shl ecx, 0x10
mov edx, eax
and edx, 0xff00
or edx, ecx
shr eax, 0x10
movzx eax, al
or eax, edx
mov dword [esp + 4], eax
mov edi, dword [ebp + 4]
test edi, edi
je 0x48432a
mov eax, dword [ebp]
test eax, eax
je 0x4842a3
mov ecx, edi
not ecx
add ecx, eax
cmp ecx, 3
jae 0x4842e2
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 4]
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x4842c0
test eax, eax
je 0x4842e7
push ebx
push dword [ebp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov esi, eax
mov dword [ebp + 8], eax
mov edi, dword [ebp + 4]
jmp 0x484305
mov esi, dword [ebp + 8]
jmp 0x48430a
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebp + 8], esi
mov dword [ebp], ebx
mov ebx, esp
mov byte [esi + edi + 2], 0x20
mov word [esi + edi], 0x2d20
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [eax + 3]
mov dword [ebp + 4], edx
mov byte [ecx + eax + 3], 0
mov eax, dword [esp + 4]
cmp eax, 0x744da8
jg 0x484381
cmp eax, 0x48685f
jle 0x4843d1
cmp eax, 0x567c72
lea edi, [esp + 0x10]
jle 0x484458
cmp eax, 0x687689
jle 0x484530
cmp eax, 0x69797d
jg 0x484688
cmp eax, 0x68768a
je 0x4846c8
mov ecx, str.Yellow_gold
cmp eax, 0x696cc3
je 0x4847cd
jmp 0x4849a6
cmp eax, 0xc30051
jle 0x484413
cmp eax, 0xe81122
lea edi, [esp + 0x10]
jle 0x48448e
cmp eax, 0xf7630b
jle 0x48455b
cmp eax, 0xff8bff
jg 0x4846a8
cmp eax, 0xf7630c
je 0x4846d2
cmp eax, 0xff4343
jne 0x4849a6
mov ecx, str.Mod_red
jmp 0x4847cd
cmp eax, 0xcc69
lea edi, [esp + 0x10]
jg 0x4844c4
cmp eax, 0x99bb
jg 0x484586
test eax, eax
je 0x4846dc
cmp eax, 0x63b1
je 0x4846e6
cmp eax, 0x78d4
jne 0x4849a6
mov ecx, str.Blue
jmp 0x4847cd
cmp eax, 0x881797
lea edi, [esp + 0x10]
jg 0x4844fa
cmp eax, 0x7a7573
jg 0x4845b1
cmp eax, 0x744da9
je 0x4846f0
cmp eax, 0x766c59
je 0x4846fa
cmp eax, 0x767676
jne 0x4849a6
mov ecx, str.Overcast
jmp 0x4847cd
cmp eax, 0x4c4a47
jg 0x4845dc
cmp eax, 0x486860
je 0x484704
cmp eax, 0x498205
je 0x48470e
cmp eax, 0x4a5459
jne 0x4849a6
mov ecx, str.Gray_dark
jmp 0x4847cd
cmp eax, 0xda3b00
jg 0x484607
cmp eax, 0xc30052
je 0x484718
cmp eax, 0xca5010
je 0x484722
cmp eax, 0xd13438
jne 0x4849a6
mov ecx, str.Brick_red
jmp 0x4847cd
cmp eax, 0x107c0f
jg 0x484632
cmp eax, 0xcc6a
je 0x48472c
cmp eax, 0x18574
je 0x484736
cmp eax, 0x38387
jne 0x4849a6
mov ecx, str.Seafoam_teal
jmp 0x4847cd
cmp eax, 0xb146c1
jg 0x48465d
cmp eax, 0x881798
je 0x484740
cmp eax, 0x8d8bd7
je 0x48474a
cmp eax, 0x9a0089
jne 0x4849a6
mov ecx, str.Orchid
jmp 0x4847cd
cmp eax, 0x567c73
je 0x484751
cmp eax, 0x5d5a58
je 0x484758
cmp eax, 0x647c64
jne 0x4849a6
mov ecx, str.Liddy_green
jmp 0x4847cd
cmp eax, 0xe81123
je 0x48475f
cmp eax, 0xea005e
je 0x484766
cmp eax, 0xef6950
jne 0x4849a6
mov ecx, str.Pale_rust
jmp 0x4847cd
cmp eax, 0x99bc
je 0x48476d
cmp eax, 0xb294
je 0x484774
cmp eax, 0xb7c3
jne 0x4849a6
mov ecx, str.Seafoam
jmp 0x4847cd
cmp eax, 0x7a7574
je 0x48477b
cmp eax, 0x807143
je 0x484782
cmp eax, 0x8764b8
jne 0x4849a6
mov ecx, str.Iris_pastel
jmp 0x4847cd
cmp eax, 0x4c4a48
je 0x484789
cmp eax, 0x4c574e
je 0x484790
cmp eax, 0x515c6b
jne 0x4849a6
mov ecx, str.Metal_blue
jmp 0x4847cd
cmp eax, 0xda3b01
je 0x484797
cmp eax, 0xe3008c
je 0x48479e
cmp eax, 0xe74856
jne 0x4849a6
mov ecx, str.Pale_red
jmp 0x4847cd
cmp eax, 0x107c10
je 0x4847a5
cmp eax, 0x10893e
je 0x4847ac
cmp eax, 0x2d7d9a
jne 0x4849a6
mov ecx, str.Cool_blue
jmp 0x4847cd
cmp eax, 0xb146c2
je 0x4847b3
cmp eax, 0xbf0077
je 0x4847ba
cmp eax, 0xc239b3
jne 0x4849a6
mov ecx, str.Orchid_light
jmp 0x4847cd
cmp eax, 0x69797e
je 0x4847c1
cmp eax, 0x6b69d6
jne 0x4849a6
mov ecx, str.Purple_shadow_dark
jmp 0x4847cd
cmp eax, 0xffffff
je 0x4847c8
cmp eax, 0xff8c00
jne 0x4849a6
mov ecx, str.Gold
jmp 0x4847cd
mov ecx, str.Steel_blue
jmp 0x4847cd
mov ecx, str.Orange_bright
jmp 0x4847cd
mov ecx, str.Black
jmp 0x4847cd
mov ecx, str.Navy_blue
jmp 0x4847cd
mov ecx, str.Iris_Spring
jmp 0x4847cd
mov ecx, str.Camouflage
jmp 0x4847cd
mov ecx, str.Moss
jmp 0x4847cd
mov ecx, str.Meadow_green
jmp 0x4847cd
mov ecx, str.Rose
jmp 0x4847cd
mov ecx, str.Orange_dark
jmp 0x4847cd
mov ecx, str.Turf_green
jmp 0x4847cd
mov ecx, str.Mint_dark
jmp 0x4847cd
mov ecx, str.Violet_red
jmp 0x4847cd
mov ecx, str.Purple_shadow
jmp 0x4847cd
mov ecx, str.Pale_moss
jmp 0x4847cd
mov ecx, str.Gray_brown
jmp 0x4847cd
mov ecx, 0x4fc4d4
jmp 0x4847cd
mov ecx, str.Rose_bright
jmp 0x4847cd
mov ecx, str.Cool_blue_bright
jmp 0x4847cd
mov ecx, str.Mint_light
jmp 0x4847cd
mov ecx, str.Gray
jmp 0x4847cd
mov ecx, str.Camouflage_desert
jmp 0x4847cd
mov ecx, str.Storm
jmp 0x4847cd
mov ecx, str.Sage
jmp 0x4847cd
mov ecx, str.Rust
jmp 0x4847cd
mov ecx, str.Plum_light
jmp 0x4847cd
mov ecx, str.Green
jmp 0x4847cd
mov ecx, str.Sport_green
jmp 0x4847cd
mov ecx, str.Violet_red_light
jmp 0x4847cd
mov ecx, str.Plum
jmp 0x4847cd
mov ecx, str.Blue_gray
jmp 0x4847cd
mov ecx, str.White
mov dword [esp + 0x14], ecx
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
je 0x48489c
mov esi, eax
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
test eax, eax
je 0x4847f8
mov ecx, ebx
not ecx
add ecx, eax
cmp ecx, esi
jae 0x484834
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [esi + ebx]
inc edx
nop word [eax + eax]
mov ebp, ecx
add ecx, ecx
cmp edx, ebp
ja 0x484810
test eax, eax
je 0x48483d
push ebp
mov edi, dword [esp + 0x38]
push dword [edi + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov dword [edi + 8], eax
mov ebx, dword [edi + 4]
jmp 0x484872
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
jmp 0x48487e
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test ebx, ebx
je 0x484868
lea ecx, [ebx + 1]
push ecx
mov edi, dword [esp + 0x38]
push dword [edi + 8]
push eax
mov dword [esp + 0x28], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [esp + 0x28]
add esp, 0xc
jmp 0x48486f
mov byte [eax], 0
mov edi, dword [esp + 0x34]
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x14]
mov dword [edi], ebp
mov ebp, edi
lea edi, [esp + 0x10]
add ebx, eax
push esi
push ecx
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 4]
add eax, esi
mov dword [ebp + 4], eax
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 0
mov ebx, esp
mov dword [esp], 0
push ebx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x484ab5
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], 1
mov eax, dword [esp]
mov dword [esp + 4], 4
lea esi, [esp + 4]
push esi
push edi
push 0
push 0x18
push str.SystemUsesLightTheme
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x484ab5
mov eax, dword [esp]
mov dword [esp + 4], 4
lea ecx, [esp + 0x18]
push esi
push ecx
push 0
push 0x18
push str.AppsUseLightTheme
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x484ab5
mov edi, dword [ebp + 4]
test edi, edi
je 0x484972
mov eax, dword [ebp]
test eax, eax
je 0x484942
mov ecx, edi
not ecx
add ecx, eax
cmp ecx, 2
jae 0x4849ba
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 3]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x484950
test eax, eax
je 0x4849bf
push ebx
push dword [ebp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov esi, eax
mov dword [ebp + 8], eax
mov edi, dword [ebp + 4]
jmp 0x4849dd
cmp dword [esp + 0x10], 0
mov eax, str.Dark
mov ecx, str.Light
mov edx, str.Light
cmove edx, eax
cmp dword [esp + 0x18], 0
cmove ecx, eax
push ecx
push edx
push str.System:__s__Apps:__s
push ebp
call fcn.00472860
add esp, 0x10
jmp 0x484ab5
push eax
push str._06lX
push ebp
call fcn.00472860
add esp, 0xc
jmp 0x48489c
mov esi, dword [ebp + 8]
jmp 0x4849e0
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebp + 8], esi
mov dword [ebp], ebx
mov word [esi + edi], 0x2820
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [eax + 2]
mov dword [ebp + 4], edx
mov byte [ecx + eax + 2], 0
cmp dword [esp + 0x10], 0
mov eax, str.Dark
mov ecx, str.Light
mov edx, str.Light
cmove edx, eax
cmp dword [esp + 0x18], 0
cmove ecx, eax
push ecx
push edx
push str.System:__s__Apps:__s
push ebp
call fcn.00472860
add esp, 0x10
mov eax, dword [ebp]
mov edi, dword [ebp + 4]
test eax, eax
je 0x484a37
lea ecx, [edi + 1]
cmp eax, ecx
jne 0x484a72
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 2]
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x484a50
test eax, eax
je 0x484a77
push ebx
push dword [ebp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov esi, eax
mov dword [ebp + 8], eax
mov edi, dword [ebp + 4]
jmp 0x484a9e
mov esi, dword [ebp + 8]
jmp 0x484aa4
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
test edi, edi
je 0x484a98
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x484a9b
mov byte [esi], 0
mov dword [ebp + 8], esi
mov dword [ebp], ebx
lea ecx, [edi + 1]
mov dword [ebp + 4], ecx
mov byte [esi + edi], 0x29
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 0
mov eax, dword [esp]
test eax, eax
je 0x484ac3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 4]
test esi, esi
jne 0x484b54
mov eax, dword [ebp]
test eax, eax
je 0x484ae1
cmp eax, 0x1d
jae 0x484b11
mov ecx, eax
cmp eax, 1
ja 0x484af0
mov ecx, 0x20
nop word cs:[eax + eax]
mov edi, ecx
add ecx, ecx
cmp edi, 0x1d
jb 0x484af0
test eax, eax
je 0x484b18
push edi
push dword [ebp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 4]
jmp 0x484b29
mov eax, dword [ebp + 8]
xor ecx, ecx
jmp 0x484b2c
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
mov dword [ebp + 8], eax
xor ecx, ecx
mov dword [ebp], edi
movups xmm0, xmmword [0x4fc86c]
movups xmmword [eax + ecx + 0xc], xmm0
movups xmm0, xmmword [str.Failed_to_find_current_theme]
movups xmmword [eax + ecx], xmm0
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [eax + 0x1c]
mov dword [ebp + 4], edx
mov byte [ecx + eax + 0x1c], 0
test esi, esi
setne al
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret