Function at 0x171b1c5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov r14b, dl
mov rbx, rcx
cmp byte [rcx + 0x3e8], r15b
jne 0x171b32216
mov esi, dword [rcx + 0x54]
call fcn.171b098a0
test eax, eax
jne 0x171b32221
cmp esi, 1
je 0x171b1c6e9
mov al, r14b
neg al
sbb ecx, ecx
and ecx, 0xffffffd8
add ecx, 0x157
call fcn.171b08194
mov edi, eax
mov ecx, 9
cmp esi, 1
lea eax, [rcx + 0xa]
cmovne ecx, eax
call qword [sym.imp.USER32.dll_GetSysColor]
nop dword [rax + rax]
movzx ecx, di
mov r10d, 0x400
mov r8d, eax
shr ecx, 8
mov eax, edi
shr eax, 0x10
movzx eax, al
lea edx, [rcx + rcx*4]
add edx, eax
movzx eax, dil
lea r9d, [rdx + rax*2]
mov edx, r15d
movzx eax, r8w
shr eax, 8
lea ecx, [rax + rax*4]
mov eax, r8d
shr eax, 0x10
movzx eax, al
add ecx, eax
movzx eax, r8b
lea ecx, [rcx + rax*2]
mov eax, r15d
cmp ecx, r10d
seta dl
cmp r9d, r10d
seta al
cmp eax, edx
je 0x171b32279
cmp esi, 1
je 0x171b1c7d0
mov edx, r8d
mov ecx, edi
test r14b, r14b
jne 0x171b32294
movss xmm2, dword [0x171b6945c]
call fcn.171b1d0c8
mov r8d, eax
mov dword [rbx + 0x3e4], eax
mov byte [rbx + 0x3e8], 1
mov eax, r8d
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp - 8]
mov qword [rbp - 8], r15
mov ecx, 0x20019
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea r8, str.TabletMode
mov edi, 4
mov dword [rbp + 0x30], r15d
lea rax, [rbp + 0x40]
mov dword [rbp - 0x10], edi
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionImmersiveShell
mov qword [rsp + 0x20], r15
lea r9d, [rdi + 0xc]
mov dword [rbp + 0x40], r15d
mov dword [rbp + 0x48], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x40]
test eax, eax
cmovne ecx, r15d
mov dword [rbp + 0x40], ecx
test ecx, ecx
jne 0x171b1c7dc
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 0xc]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, str.ColorPrevalence
lea rdx, str.SoftwareMicrosoftWindowsDWM
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov edx, dword [rbp + 0x30]
test eax, eax
cmovne edx, r15d
mov dword [rbp + 0x30], edx
test edx, edx
jne 0x171b32241
mov al, r14b
neg al
sbb ecx, ecx
and ecx, 0xffffffe1
add ecx, 0x157
call fcn.171b08194
lea rcx, [rbp - 8]
mov edi, eax
call fcn.171b08884
jmp 0x171b1c629
mov dword [rbx + 0x3e4], r8d
jmp 0x171b1c6ca
mov edx, dword [rbp + 0x30]
jmp 0x171b1c7a3
mov eax, dword [rcx + 0x3e4]
jmp 0x171b1c6d4
mov ecx, 9
cmp esi, 1
lea eax, [rcx + 0xa]
cmovne ecx, eax
call qword [sym.imp.USER32.dll_GetSysColor]
nop dword [rax + rax]
nop
jmp 0x171b1c6c1
mov ecx, 2
cmp edx, ecx
jbe 0x171b32272
cmp edx, 3
je 0x171b32268
cmp edx, edi
je 0x171b1c7bb
cmp edx, 5
jne 0x171b1c7ab
lea ecx, [rdx - 4]
jmp 0x171b1c7bb
mov ecx, 3
jmp 0x171b1c7bb
mov ecx, edi
jmp 0x171b1c7bb
mov ecx, 0x141
cmp r9d, r10d
lea eax, [rcx - 0x1d]
cmovbe ecx, eax
call fcn.171b08194
mov r8d, eax
jmp 0x171b1c69d
movss xmm2, dword [0x171b85c0c]
jmp 0x171b1c6bc