Function at 0x429540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
push edi
call fcn.0042b780
mov eax, dword [0x9f45cc]
test eax, eax
je 0x42973c
lea ecx, [esp + 0x38]
push ecx
call eax
test eax, eax
js 0x42973c
cmp dword [esp + 0x38], 0
je 0x42973c
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push str.ColorizationColor
push str.SoftwareMicrosoftWindowsDWM
mov edi, 4
push SysReAllocString
mov dword [esp + 0x50], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42973c
cmp dword [esp + 0x38], edi
jne 0x42973c
mov eax, dword [esp + 0x34]
fld qword [0x9ad788]
shr eax, 0x18
cmp byte [ebp + 8], 0
jne 0x429618
mov dword [esp + 0x38], eax
fild dword [esp + 0x38]
sub esp, 8
fmul st(1)
faddp st(1)
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
fstp qword [esp]
call fcn.0065d120
fnstcw word [esp + 0x38]
add esp, 8
movzx eax, word [esp + 0x30]
fstp dword [esp + 0x38]
fld dword [esp + 0x38]
or eax, 0xc00
mov dword [esp + 0x38], eax
fldcw word [esp + 0x38]
fistp dword [esp + 0x38]
mov al, byte [esp + 0x38]
fldcw word [esp + 0x30]
fld qword [0x9ad788]
movzx edx, al
mov dword [esp + 0x38], edx
or bl, 0xff
fild dword [esp + 0x38]
sub bl, al
mov eax, dword [esp + 0x34]
shr eax, 8
fdiv qword [0x9ad798]
movzx ecx, al
mov dword [esp + 0x30], ecx
sub esp, 8
fstp dword [esp + 0x40]
fild dword [esp + 0x38]
fmul dword [esp + 0x40]
faddp st(1)
fstp dword [esp + 0x38]
fld dword [esp + 0x38]
fstp qword [esp]
call fcn.0065d120
fnstcw word [esp + 0x38]
movzx eax, word [esp + 0x38]
or eax, 0xc00
mov dword [esp + 0x44], eax
movzx eax, byte [esp + 0x3c]
fldcw word [esp + 0x44]
fistp dword [esp + 0x44]
mov dl, byte [esp + 0x44]
mov dword [esp + 0x44], eax
add dl, bl
movzx edi, dl
fldcw word [esp + 0x38]
fild dword [esp + 0x44]
fmul dword [esp + 0x40]
fadd qword [0x9ad788]
fstp dword [esp + 0x44]
fld dword [esp + 0x44]
fstp qword [esp]
call fcn.0065d120
fnstcw word [esp + 0x38]
movzx eax, word [esp + 0x38]
or eax, 0xc00
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x3c]
fldcw word [esp + 0x44]
shr eax, 0x10
movzx eax, al
fistp dword [esp + 0x44]
movzx ecx, byte [esp + 0x44]
mov dword [esp + 0x44], eax
add cl, bl
movzx edx, cl
fldcw word [esp + 0x38]
shl edx, 8
or edi, edx
shl edi, 8
fild dword [esp + 0x44]
fmul dword [esp + 0x40]
fadd qword [0x9ad788]
fstp dword [esp + 0x44]
fld dword [esp + 0x44]
fstp qword [esp]
call fcn.0065d120
fnstcw word [esp + 0x38]
add esp, 8
movzx eax, word [esp + 0x30]
or eax, 0xc00
mov dword [esp + 0x3c], eax
fldcw word [esp + 0x3c]
fistp dword [esp + 0x3c]
movzx ecx, byte [esp + 0x3c]
add cl, bl
movzx edx, cl
fldcw word [esp + 0x30]
or edi, edx
mov dword [esi + 0x80], edi
jmp 0x42978a
mov edi, dword [esi + 0x7c]
test edi, edi
je 0x429772
call fcn.0042b6b0
mov eax, dword [0x9f45c8]
test eax, eax
je 0x429772
xor edx, edx
cmp byte [ebp + 8], dl
lea ecx, [esi + 0x80]
sete dl
push ecx
add edx, 0xeed
push edx
push 0
push 1
push edi
call eax
test eax, eax
jns 0x42978a
cmp byte [ebp + 8], 0
je 0x42977c
push 0x1b
jmp 0x42977e
push 0x1c
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0x80], eax
cmp dword [esi + 0x7c], 0
je 0x4297e6
cmp byte [ebp + 8], 0
jne 0x4297bd
call fcn.0042b780
mov eax, dword [0x9f45cc]
test eax, eax
je 0x4297b6
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
js 0x4297b6
cmp dword [esp + 0x3c], 0
jne 0x4297bd
mov ebx, 0x654
jmp 0x4297c2
mov ebx, 0x64a
mov edi, dword [esi + 0x7c]
call fcn.0042b6b0
mov eax, dword [0x9f45c8]
test eax, eax
je 0x4297e6
lea edx, [esi + 0x84]
push edx
push ebx
push 0
push 1
push edi
call eax
test eax, eax
jns 0x429830
cmp byte [ebp + 8], 0
jne 0x429822
call fcn.0042b780
mov eax, dword [0x9f45cc]
test eax, eax
je 0x42980c
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
js 0x42980c
cmp dword [esp + 0x3c], 0
jne 0x429822
push 0x13
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0x84], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0x84], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4