Function at 0x140263b68
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
and qword [rsp + 0x68], 0
mov r14d, ecx
and qword [rsp + 0x58], 0
call fcn.140263658
mov edi, 0x2001f
lea rcx, [rsp + 0x78]
mov edx, edi
mov r12b, al
xor sil, sil
call fcn.14007ae40
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.14006e14c
mov rdx, qword [0x14038c658]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
test rdx, rdx
cmovne rcx, rdx
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistory
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov r15d, 0x80070000
test eax, eax
jle 0x140263c33
movzx ebx, ax
or ebx, r15d
test ebx, ebx
jns 0x140263c41
mov edx, 0x16b
jmp 0x140263d0f
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14006e14c
mov rax, qword [0x14038c658]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistoryColors
mov rcx, qword [rsp + 0x78]
test rax, rax
mov r9d, edi
cmovne rcx, rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jle 0x140263c8f
movzx eax, ax
or eax, r15d
test eax, eax
jns 0x140263d2a
mov ecx, r14d
call fcn.1402640f4
test al, al
lea rcx, [rsp + 0x58]
setne sil
xor edx, edx
call fcn.14006e14c
mov rax, qword [0x14038c658]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesHistoryColors
mov rcx, qword [rsp + 0x78]
test rax, rax
cmovne rcx, rax
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140263d06
movzx ebx, ax
or ebx, r15d
test ebx, ebx
jns 0x140263d2a
mov edx, 0x171
mov rcx, qword [rbp + 0x1d8]
lea r8, [0x14031c128]
mov r9d, ebx
call fcn.14001e09c
jmp 0x14026405f
mov ecx, r14d
call fcn.1402640f4
test al, al
je 0x140263d3f
test sil, sil
je 0x14026401e
xor ebx, ebx
xor edi, edi
and dword [rsp + 0x50], ebx
test sil, sil
jne 0x140263d5c
cmp r14d, 0xbadf00d
je 0x140263d5c
mov dword [rbp - 0x78], r14d
lea edi, [rbx + 1]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.AutoColor
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x140263da2
movzx eax, ax
or eax, r15d
test eax, eax
jns 0x140263de3
mov rcx, qword [rsp + 0x68]
lea rdx, str.AutoColor
xor eax, eax
mov dword [rsp + 0x28], 4
test r12b, r12b
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, edi
lea r15, [rbp - 0x78]
xor esi, esi
lea r15, [r15 + rax*4]
cmp esi, 5
jge 0x140263e9a
cmp dword [rsp + 0x50], 1
jne 0x140263e07
test esi, esi
je 0x140263e90
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002d868
mov ebx, eax
test eax, eax
js 0x140263e90
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140263e73
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140263e90
mov ecx, dword [rsp + 0x64]
mov eax, ecx
xor eax, r14d
test eax, 0xffffff
je 0x140263e90
inc edi
mov dword [r15], ecx
add r15, 4
inc esi
test ebx, ebx
jns 0x140263def
xor esi, esi
movsxd rdi, edi
xor r14d, r14d
xor ebx, ebx
lea r15d, [rsi + 1]
cmp rbx, rdi
jge 0x140263f52
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002d868
test eax, eax
js 0x140263f44
xor edx, edx
test rbx, rbx
jle 0x140263eff
mov r8d, dword [rbp + rbx*4 - 0x78]
and r8d, 0xffffff
mov ecx, dword [rbp + rdx*4 - 0x78]
and ecx, 0xffffff
cmp ecx, r8d
je 0x140263f44
add rdx, r15
cmp rdx, rbx
jl 0x140263ee8
movsxd rax, r14d
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x60]
mov r9d, 4
xor r8d, r8d
lea rcx, [rcx + rax*4]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x140263f41
movzx eax, ax
or eax, 0x80070000
add esi, r15d
add r14d, r15d
add rbx, r15
test eax, eax
jns 0x140263ea8
xor ebx, ebx
movsxd r14, esi
xor edi, edi
cmp esi, 5
jge 0x14026401e
cmp ebx, 5
jge 0x14026401e
lea r9, str.ColorHistory
mov dword [rsp + 0x20], esi
lea r8, str._s_u
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002d868
mov ecx, eax
test eax, eax
js 0x14026400d
mov r9d, 0xffffff
cmp ebx, 4
jae 0x14026400d
lea rax, [0x1403443b8]
xor edx, edx
mov r8d, dword [rax + rdi*4]
mov dword [rsp + 0x64], r8d
test r14, r14
jle 0x140263fce
and r8d, r9d
mov eax, dword [rbp + rdx*4 - 0x78]
and eax, r9d
cmp r8d, eax
je 0x1402640da
add rdx, r15
cmp rdx, r14
jl 0x140263fb6
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x60]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jle 0x14026400d
movzx ecx, ax
or ecx, 0x80070000
add esi, r15d
add ebx, r15d
add rdi, r15
test ecx, ecx
jns 0x140263f59
mov rcx, qword [rsp + 0x68]
lea rdx, str.AutoColor
xor eax, eax
mov dword [rsp + 0x28], 4
test r12b, r12b
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14026407b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140264091
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1402640a7
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
add ebx, r15d
add rdi, r15
cmp ebx, 5
jl 0x140263f97
jmp 0x14026400d