Function at 0x18002fbb0
Capabilities:
Encode data using xor
Hash data using fnv
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movzx edi, cl
xor ebx, ebx
test cl, 1
je 0x18002fc8c
mov dword [0x18007f108], 1
mov dword [rbp - 0x70], 4
lea ecx, [rbx + 0x10]
call fcn.18000a440
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [0x18007f108]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str.DisableGlassOnBattery
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002fc51
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002fc63
mov edx, eax
call fcn.18000bac0
xor eax, eax
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test eax, eax
je 0x18002fc86
cmp byte [rbp - 0x7d], bl
mov byte [0x18008515f], 1
jne 0x18002fc8c
mov byte [0x18008515f], bl
test dil, 2
je 0x1800300f5
mov dword [rbp - 0x70], ebx
mov dword [rbp - 0x80], 4
mov ecx, 0x10
call fcn.18000a440
mov edi, eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.EnableTransparency
xor edx, edx
mov rcx, qword [0x180085328]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002fce8
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002fcfa
mov edx, eax
call fcn.18000bac0
cmp dword [rbp - 0x70], ebx
setne byte [0x18007f101]
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.RoundRectRadius
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002fd4c
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002fd5e
mov edx, eax
call fcn.18000bac0
mov eax, dword [rsp + 0x78]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x180085624], xmm0
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.GlassOverrideBorder
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002fdba
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002fdcc
mov edx, eax
call fcn.18000bac0
cmp dword [rsp + 0x78], ebx
setne byte [0x180085628]
mov dword [rsp + 0x78], 0x57
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.GlassCrossFadeTime
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002fe23
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002fe35
mov edx, eax
call fcn.18000bac0
mov ecx, ebx
mov rax, qword [0x180085498]
cmp byte [rax + 0x16], cl
cmovne ecx, dword [rsp + 0x78]
mov eax, ecx
imul rcx, rax, 0x2710
mov qword [0x18007f178], rcx
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.GlassOverrideAccent
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002fe9e
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002feb0
mov edx, eax
call fcn.18000bac0
mov eax, dword [rsp + 0x78]
mov dword [0x180085208], eax
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.ColorizationGlassReflectionIntensity
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002ff02
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002ff14
mov edx, eax
call fcn.18000bac0
mov dword [rsp + 0x48], 0x3f800000
xorps xmm7, xmm7
mov dword [rsp + 0x40], ebx
mov eax, dword [rsp + 0x78]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
divss xmm0, dword [0x18006ec34]
movss dword [rsp + 0x44], xmm0
comiss xmm7, xmm0
seta al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x44]
test al, al
cmove rdx, rcx
comiss xmm0, dword [0x18006ebb4]
seta al
lea rcx, [rsp + 0x48]
test al, al
cmove rcx, rdx
movss xmm1, dword [rcx]
movss xmm0, dword [0x180085620]
ucomiss xmm0, xmm1
jp 0x18002ff7b
je 0x18002ff83
movss dword [0x180085620], xmm1
mov dword [rsp + 0x78], 0xa
mov dword [rbp - 0x80], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, str.ColorizationGlassReflectionParallaxIntensity
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x18002ffcf
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x18002ffe1
mov edx, eax
call fcn.18000bac0
mov dword [rsp + 0x54], 0x3f800000
mov dword [rsp + 0x4c], ebx
mov eax, dword [rsp + 0x78]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
divss xmm0, dword [0x18006ec34]
movss dword [rsp + 0x50], xmm0
comiss xmm7, xmm0
seta al
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x50]
test al, al
cmove rdx, rcx
comiss xmm0, dword [0x18006ebb4]
seta al
lea rcx, [rsp + 0x54]
test al, al
cmove rcx, rdx
movss xmm1, dword [rcx]
movss xmm0, dword [0x18007f170]
ucomiss xmm0, xmm1
jp 0x180030045
je 0x18003004d
movss dword [0x18007f170], xmm1
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x50]
call sub.ucrtbase.dll_memset
mov dword [rbp - 0x80], 0x20a
mov ecx, 1
call fcn.18000a440
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str.CustomThemeReflection
xor edx, edx
mov rcx, qword [0x180085320]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jle 0x1800300ab
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x1f8]
test eax, eax
jns 0x1800300bd
mov edx, eax
call fcn.18000bac0
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1800300d0
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call fcn.1800130e0
mov byte [0x180085720], bl
mov r15, qword [0x180085728]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x78], r15
cmp byte [0x18008515f], 0
je 0x18003011c
cmp dword [0x18007f108], 0
jne 0x180030125
cmp byte [0x18007f101], 0
jne 0x18003016e
call fcn.180018c70
nop
test r15, r15
je 0x180030139
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.18003efb0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm7, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rbp - 0x80], rbx
mov ecx, dword [0x180085114]
mov rax, qword gs:[0x58]
mov r12d, 4
mov rsi, qword [rax + rcx*8]
mov eax, dword [rsi + r12]
cmp dword [0x18008570c], eax
jle 0x1800301dc
lea rcx, [0x18008570c]
call fcn.18003f414
cmp dword [0x18008570c], 0xffffffff
jne 0x1800301dc
lea rcx, [0x180067b60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetDesktopID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180085710], rax
lea rcx, [0x18008570c]
call fcn.18003f3a8
mov rax, qword [0x180085710]
test rax, rax
je 0x1800301f3
lea rdx, [rbp - 0x80]
mov ecx, 1
call rax
mov eax, dword [0x180085858]
cmp eax, 0x55f0
jae 0x180030210
mov rax, qword [0x180085498]
mov rdi, qword [rax + 0x1e8]
jmp 0x18003022e
cmp eax, 0x585d
mov rax, qword [0x180085498]
jae 0x180030227
mov rdi, qword [rax + 0x1a0]
jmp 0x18003022e
mov rdi, qword [rax + 0x1b0]
mov r14, qword [rbp - 0x80]
mov eax, dword [rsi + r12]
cmp dword [0x180085748], eax
jle 0x180030317
lea rcx, [0x180085748]
call fcn.18003f414
cmp dword [0x180085748], 0xffffffff
jne 0x180030317
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov r8d, 0x24
lea rdx, str.CWindowList::GetWindowListForDesktop
lea rcx, [rsp + 0x58]
call fcn.18001c580
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rcx, qword [rsp + 0x58]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1800302d3
movabs r8, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x1800302c0
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x60]
lea rcx, [0x18007f1d0]
call fcn.18001ad30
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x180030428
mov rax, qword [rax + 0x30]
mov qword [0x180085750], rax
lea rcx, [rsp + 0x58]
call fcn.18000b590
nop
lea rcx, [0x180085748]
call fcn.18003f3a8
mov rax, qword [0x180085750]
mov rdx, r14
mov rcx, rdi
call rax
mov rsi, rax
mov rdi, qword [rax + 8]
cmp rdi, rax
je 0x18003012b
mov rcx, rdi
call fcn.18002e540
test al, al
je 0x180030416
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x180030416
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180030416
cmp dword [0x180085858], 0x55f0
jae 0x180030376
mov rbx, qword [rdi + 0x180]
jmp 0x18003037d
mov rbx, qword [rdi + 0x1b8]
test rbx, rbx
je 0x180030416
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov byte [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.180011f50
mov rcx, qword [rbp + 0x1f8]
test rax, rax
je 0x180030435
cmp dword [rbp - 0x60], 0xffff8300
jle 0x180030416
cmp dword [rbp - 0x5c], 0xffff8300
jle 0x180030416
xor edx, edx
mov rcx, rbx
call fcn.1800120a0
test al, al
jne 0x1800303e2
call fcn.18002e670
cmp al, 1
je 0x1800303e2
xor r8d, r8d
jmp 0x1800303e5
mov r8b, 1
xor r9d, r9d
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180018250
nop
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x180030408
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x40]
nop
test rbx, rbx
je 0x180030416
lea rcx, [rbp - 0x70]
call fcn.180008c60
mov rdi, qword [rdi + 8]
cmp rdi, rsi
jne 0x180030336
jmp 0x18003012b
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18003e4c8
nop
mov edx, 0x80070057
call fcn.18000baa0
int3