Function at 0x171b25850
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
and qword [rsp + 0x68], 0
mov r14d, ecx
and qword [rsp + 0x58], 0
call fcn.171b257a0
mov rdi, qword [rsp + 0x68]
xor sil, sil
mov r12b, al
test rdi, rdi
jne 0x171b3278e
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistory
and qword [rsp + 0x30], 0
mov r15d, 0x2001f
mov dword [rsp + 0x28], r15d
xor r9d, r9d
and dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x171b327bf
test ebx, ebx
js 0x171b327cd
mov rdi, qword [rsp + 0x58]
test rdi, rdi
jne 0x171b327d7
lea rax, [rsp + 0x58]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistoryColors
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jg 0x171b32808
js 0x171b32817
mov ecx, r14d
call fcn.171b25a0c
test al, al
je 0x171b328d8
test sil, sil
jne 0x171b328d8
mov rcx, qword [rsp + 0x68]
lea rdx, str.AutoColor
xor eax, eax
mov dword [rsp + 0x28], 4
test r12b, r12b
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x171b259bd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x171b259d3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.171b28ea0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x171b258af
movzx ebx, ax
or ebx, 0x80070000
jmp 0x171b258ff
mov edx, 0x17a
jmp 0x171b328bc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x171b25915
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x171b25947
mov ecx, r14d
call fcn.171b25a0c
mov rdi, qword [rsp + 0x58]
test al, al
setne sil
test rdi, rdi
je 0x171b3285a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
and qword [rsp + 0x58], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistoryColors
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov rcx, 0xffffffff80000001
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x171b328af
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x171b2594d
mov edx, 0x180
mov rcx, qword [rbp + 0x1c8]
lea r8, str.shell_themes_accentcolors_accentcolors.cpp
mov r9d, ebx
call fcn.171b36d04
nop
jmp 0x171b259a7
xor ebx, ebx
xor edi, edi
and dword [rsp + 0x50], ebx
test sil, sil
jne 0x171b328f6
cmp r14d, 0xbadf00d
je 0x171b328f6
mov dword [rsp + 0x78], r14d
lea edi, [rbx + 1]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.AutoColor
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x171b3293e
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x171b3297f
mov rcx, qword [rsp + 0x68]
lea rdx, str.AutoColor
xor eax, eax
mov dword [rsp + 0x28], 4
test r12b, r12b
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, edi
lea r15, [rsp + 0x78]
xor esi, esi
lea r15, [r15 + rax*4]
cmp esi, 5
jge 0x171b32a37
cmp dword [rsp + 0x50], 1
jne 0x171b329a4
test esi, esi
je 0x171b32a2d
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.171b05948
mov ebx, eax
test eax, eax
js 0x171b32a2d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x70]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x171b32a10
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x171b32a2d
mov ecx, dword [rsp + 0x64]
mov eax, ecx
xor eax, r14d
test eax, 0xffffff
je 0x171b32a2d
inc edi
mov dword [r15], ecx
add r15, 4
inc esi
test ebx, ebx
jns 0x171b3298c
xor esi, esi
movsxd rdi, edi
xor r14d, r14d
xor ebx, ebx
lea r15d, [rsi + 1]
cmp rbx, rdi
jge 0x171b32af0
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.171b05948
test eax, eax
js 0x171b32ae2
xor edx, edx
test rbx, rbx
jle 0x171b32a9c
mov r8d, dword [rsp + rbx*4 + 0x78]
and r8d, 0xffffff
mov ecx, dword [rsp + rdx*4 + 0x78]
and ecx, 0xffffff
cmp ecx, r8d
je 0x171b32ae2
add rdx, r15
cmp rdx, rbx
jl 0x171b32a85
movsxd rax, r14d
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x70]
mov r9d, 4
xor r8d, r8d
lea rcx, [rcx + rax*4]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x171b32adf
movzx eax, ax
or eax, 0x80070000
add esi, r15d
add r14d, r15d
add rbx, r15
test eax, eax
jns 0x171b32a45
xor ebx, ebx
movsxd r14, esi
xor edi, edi
cmp esi, 5
jge 0x171b25966
cmp ebx, 5
jge 0x171b25966
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.171b05948
mov ecx, eax
test eax, eax
js 0x171b32ba7
mov r9d, 0xffffff
cmp ebx, 4
jae 0x171b32ba7
lea rax, [0x171b847a0]
xor edx, edx
mov r8d, dword [rax + rdi*4]
mov dword [rsp + 0x64], r8d
test r14, r14
jle 0x171b32b68
and r8d, r9d
mov eax, dword [rsp + rdx*4 + 0x78]
and eax, r9d
cmp r8d, eax
je 0x171b32bbd
add rdx, r15
cmp rdx, r14
jl 0x171b32b54
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x70]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jle 0x171b32ba7
movzx ecx, ax
or ecx, 0x80070000
add esi, r15d
add ebx, r15d
add rdi, r15
test ecx, ecx
jns 0x171b32af7
jmp 0x171b25966
add ebx, r15d
add rdi, r15
cmp ebx, 5
jl 0x171b32b35
jmp 0x171b32ba7