Function at 0x140257158
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
and qword [rsp + 0x68], 0
mov r14d, ecx
and qword [rsp + 0x58], 0
call fcn.140256c48
mov edi, 0x2001f
lea rcx, [rsp + 0x78]
mov edx, edi
mov r12b, al
xor sil, sil
call fcn.14007ba80
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.14006ee3c
mov rdx, qword [0x14037e558]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
test rdx, rdx
cmovne rcx, rdx
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistory
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov r15d, 0x80070000
test eax, eax
jle 0x140257223
movzx ebx, ax
or ebx, r15d
test ebx, ebx
jns 0x140257231
mov edx, 0x16b
jmp 0x1402572ff
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14006ee3c
mov rax, qword [0x14037e558]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistoryColors
mov rcx, qword [rsp + 0x78]
test rax, rax
mov r9d, edi
cmovne rcx, rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jle 0x14025727f
movzx eax, ax
or eax, r15d
test eax, eax
jns 0x14025731a
mov ecx, r14d
call fcn.1402576e4
test al, al
lea rcx, [rsp + 0x58]
setne sil
xor edx, edx
call fcn.14006ee3c
mov rax, qword [0x14037e558]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistoryColors
mov rcx, qword [rsp + 0x78]
test rax, rax
cmovne rcx, rax
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1402572f6
movzx ebx, ax
or ebx, r15d
test ebx, ebx
jns 0x14025731a
mov edx, 0x171
mov rcx, qword [rbp + 0x1d8]
lea r8, [0x14030e608]
mov r9d, ebx
call fcn.14001eb0c
jmp 0x14025764f
mov ecx, r14d
call fcn.1402576e4
test al, al
je 0x14025732f
test sil, sil
je 0x14025760e
xor ebx, ebx
xor edi, edi
and dword [rsp + 0x50], ebx
test sil, sil
jne 0x14025734c
cmp r14d, 0xbadf00d
je 0x14025734c
mov dword [rbp - 0x78], r14d
lea edi, [rbx + 1]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.AutoColor
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x140257392
movzx eax, ax
or eax, r15d
test eax, eax
jns 0x1402573d3
mov rcx, qword [rsp + 0x68]
lea rdx, str.AutoColor
xor eax, eax
mov dword [rsp + 0x28], 4
test r12b, r12b
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, edi
lea r15, [rbp - 0x78]
xor esi, esi
lea r15, [r15 + rax*4]
cmp esi, 5
jge 0x14025748a
cmp dword [rsp + 0x50], 1
jne 0x1402573f7
test esi, esi
je 0x140257480
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002e4b8
mov ebx, eax
test eax, eax
js 0x140257480
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140257463
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140257480
mov ecx, dword [rsp + 0x64]
mov eax, ecx
xor eax, r14d
test eax, 0xffffff
je 0x140257480
inc edi
mov dword [r15], ecx
add r15, 4
inc esi
test ebx, ebx
jns 0x1402573df
xor esi, esi
movsxd rdi, edi
xor r14d, r14d
xor ebx, ebx
lea r15d, [rsi + 1]
cmp rbx, rdi
jge 0x140257542
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002e4b8
test eax, eax
js 0x140257534
xor edx, edx
test rbx, rbx
jle 0x1402574ef
mov r8d, dword [rbp + rbx*4 - 0x78]
and r8d, 0xffffff
mov ecx, dword [rbp + rdx*4 - 0x78]
and ecx, 0xffffff
cmp ecx, r8d
je 0x140257534
add rdx, r15
cmp rdx, rbx
jl 0x1402574d8
movsxd rax, r14d
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x60]
mov r9d, 4
xor r8d, r8d
lea rcx, [rcx + rax*4]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x140257531
movzx eax, ax
or eax, 0x80070000
add esi, r15d
add r14d, r15d
add rbx, r15
test eax, eax
jns 0x140257498
xor ebx, ebx
movsxd r14, esi
xor edi, edi
cmp esi, 5
jge 0x14025760e
cmp ebx, 5
jge 0x14025760e
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002e4b8
mov ecx, eax
test eax, eax
js 0x1402575fd
mov r9d, 0xffffff
cmp ebx, 4
jae 0x1402575fd
lea rax, [0x140336430]
xor edx, edx
mov r8d, dword [rax + rdi*4]
mov dword [rsp + 0x64], r8d
test r14, r14
jle 0x1402575be
and r8d, r9d
mov eax, dword [rbp + rdx*4 - 0x78]
and eax, r9d
cmp r8d, eax
je 0x1402576ca
add rdx, r15
cmp rdx, r14
jl 0x1402575a6
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x60]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jle 0x1402575fd
movzx ecx, ax
or ecx, 0x80070000
add esi, r15d
add ebx, r15d
add rdi, r15
test ecx, ecx
jns 0x140257549
mov rcx, qword [rsp + 0x68]
lea rdx, str.AutoColor
xor eax, eax
mov dword [rsp + 0x28], 4
test r12b, r12b
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14025766b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140257681
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140257697
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400a2260
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
add ebx, r15d
add rdi, r15
cmp ebx, 5
jl 0x140257587
jmp 0x1402575fd