Function at 0x140002bc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r9
mov r15, r8
mov rbx, rdx
mov edi, ecx
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
test ecx, ecx
je 0x140002ef4
sub ecx, 1
je 0x140002ec3
cmp ecx, 1
jne 0x140002ef4
mov ecx, 8
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008f004], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008f000], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008effc], eax
mov ecx, 8
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008eff8], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002cc3
mov dword [rbp - 0x14], 4
mov dword [rbp - 0x10], 4
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea rax, [0x14008f004]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x14007c068]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002ced
lea rax, [0x14008f004]
mov qword [rsp + 0x20], rax
lea r9, [0x14007c068]
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140013a90
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002d5e
mov dword [rbp - 0x10], 4
mov dword [rbp - 0x14], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [0x14008f000]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, str.color10
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002d88
lea rax, [0x14008f000]
mov qword [rsp + 0x20], rax
lea r9, str.color10
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140013a90
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002df9
mov dword [rbp - 0x10], 4
mov dword [rbp - 0x14], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [0x14008effc]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, str.color11
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002e23
lea rax, [0x14008effc]
mov qword [rsp + 0x20], rax
lea r9, str.color11
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140013a90
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002e97
mov dword [rbp - 0x10], 4
mov dword [rbp - 0x14], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [0x14008eff8]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, str.color12
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002f38
lea rax, [0x14008eff8]
mov qword [rsp + 0x20], rax
lea r9, str.color12
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140013a90
jmp 0x140002f38
mov dword [0x14008f004], 0xc8c8c8
mov dword [0x14008f000], 0x1e1e1e
mov dword [0x14008effc], 0x383838
mov dword [0x14008eff8], 0xffffff
mov byte [0x14008f091], 1
jmp 0x140002f3f
mov ecx, 8
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008f004], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008f000], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008effc], eax
mov ecx, 8
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14008eff8], eax
mov byte [0x14008f091], 0
cmp byte [0x14008f090], 0
je 0x140002f60
movzx edx, byte [0x14008f091]
mov rcx, rbx
call qword [0x14008f088]
mov rcx, rbx
call fcn.1400108e0
mov rbx, qword [r15]
mov rsi, qword [r15 + 8]
cmp rbx, rsi
je 0x140003048
mov ecx, edi
test edi, edi
je 0x140002f84
sub ecx, 1
je 0x140003199
cmp ecx, 1
jne 0x140002fbe
xor r8d, r8d
lea rdx, str.Explorer
mov rcx, qword [rbx]
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.Explorer
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
cmp byte [0x14008f090], 0
je 0x140002fdf
mov rax, qword [0x14008f088]
test rax, rax
je 0x140002fdf
movzx edx, byte [0x14008f091]
mov rcx, qword [rbx]
call rax
mov r9d, dword [0x14008f000]
xor r8d, r8d
mov edx, 0x1001
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [0x14008f004]
xor r8d, r8d
mov edx, 0x1024
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [0x14008f000]
xor r8d, r8d
mov edx, 0x1026
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_RedrawWindow]
add rbx, 8
cmp rbx, rsi
jne 0x140002f70
mov rbx, qword [r14]
mov rsi, qword [r14 + 8]
cmp rbx, rsi
je 0x1400030b5
mov ecx, edi
test edi, edi
je 0x140003064
sub ecx, 1
je 0x140003064
cmp ecx, 1
jne 0x140003098
cmp byte [0x14008f090], 0
je 0x140003085
mov rax, qword [0x14008f088]
test rax, rax
je 0x140003085
movzx edx, byte [0x14008f091]
mov rcx, qword [rbx]
call rax
xor r8d, r8d
lea rdx, str.Explorer
mov rcx, qword [rbx]
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_RedrawWindow]
add rbx, 8
cmp rbx, rsi
jne 0x140003054
xor ebx, ebx
mov rcx, qword [0x14008eff0]
test rcx, rcx
je 0x1400030d0
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x14008eff0], rbx
mov ecx, dword [0x14008effc]
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x14008eff0], rax
mov rcx, qword [r15]
test rcx, rcx
je 0x140003133
mov rax, qword [r15 + 0x10]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
jb 0x140003123
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400031cc
mov rcx, r8
call fcn.140045b20
mov qword [r15], rbx
mov qword [r15 + 8], rbx
mov qword [r15 + 0x10], rbx
mov rcx, qword [r14]
test rcx, rcx
je 0x140003177
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140003167
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400031d2
mov rcx, r8
call fcn.140045b20
mov qword [r14], rbx
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rbx
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400454d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
lea rdx, str.ItemsView
mov rcx, qword [rbx]
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.Header
jmp 0x140002fb2
call fcn.14004cd2c
nop
call fcn.14004cd2c
int3