Function at 0x401c70
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov dword [esp], 1
call sub.combase.dll_RoInitialize
sub esp, 4
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x113
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.RoInitialize_failed__hr__lx_n
call fcn.00401af0
mov dword [esp], 0x407308
call dword [sym.imp.msvcrt.dll_wcslen]
lea edx, [ebp - 0x60]
mov dword [esp], 0x407308
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.combase.dll_WindowsCreateString
sub esp, 0xc
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xc1
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.got_hr__lx._n
call fcn.00401af0
lea eax, [ebp - 0x6c]
mov dword [esp + 4], 0x408208
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.combase.dll_RoGetActivationFactory
sub esp, 0xc
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xc4
test ebx, ebx
je 0x401db0
mov edx, dword [0x41c030]
test edx, edx
jne 0x4024f0
cmp ebx, 0x80040154
jne 0x402570
mov dword [esp + 8], 0x80040154
mov dword [esp + 4], str.got_hr__lx._n
mov dword [esp], 1
call fcn.00401af0
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xc7
mov eax, 0x407308
call fcn.004011b0
mov dword [esp], str._s_runtimeclass_not_registered__skipping_tests._n
mov dword [esp + 4], eax
call fcn.004019b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp 0x403378
mov dword [esp + 8], 0
mov dword [esp + 4], str.got_hr__lx._n
mov dword [esp], 1
call fcn.00401af0
mov dword [esp], 1
mov edx, dword [ebp - 0x6c]
mov ecx, 0x408a28
mov eax, 0xcb
call fcn.00401b10
mov ecx, 0x408218
mov eax, 0xcc
mov dword [esp], 1
mov edx, dword [ebp - 0x6c]
call fcn.00401b10
mov ecx, 0x4089f8
mov eax, 0xcd
mov dword [esp], 0
mov edx, dword [ebp - 0x6c]
call fcn.00401b10
mov ecx, 0x407588
mov eax, 0xce
mov dword [esp], 0
mov edx, dword [ebp - 0x6c]
call fcn.00401b10
lea eax, [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.combase.dll_RoActivateInstance
sub esp, 8
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xd1
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Got_unexpected_hr__lx._n
call fcn.00401af0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.combase.dll_WindowsDeleteString
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x68]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x407588
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xd5
test ebx, ebx
jne 0x402498
mov dword [esp + 8], 0
mov dword [esp + 4], str.Got_unexpected_hr__lx._n
mov dword [esp], 1
call fcn.00401af0
mov dword [esp], 1
mov edx, dword [ebp - 0x64]
mov eax, 0xdc
mov ecx, 0x4089f8
call fcn.00401b10
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x4c]
mov esi, dword [ebp - 0x68]
mov dword [ebp - 0x5c], 0x20
mov dword [ebp - 0x58], 0x20
call fcn.00401020
test eax, eax
jne 0x401f16
mov dword [ebp - 0x5c], 0
call fcn.004026e0
lea ebx, [ebp - 0x2c]
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x9a
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov dword [esp], 0x80000001
call edi
sub esp, 0x14
test eax, eax
je 0x402520
xor edx, edx
cmp eax, 2
sete dl
mov dword [esp], edx
mov dword [esp + 4], str.failed_to_delete_AccentPalette_key._n
call fcn.00401af0
call fcn.004026e0
lea edx, [ebp - 0x58]
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x9b
mov eax, ebx
call fcn.00401020
mov dword [esp + 4], str.AccentPalette_should_not_be_available._n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401af0
mov ecx, 0xd77800
mov edx, 5
mov eax, esi
call fcn.00401b90
call fcn.004026e0
lea edx, [ebp - 0x58]
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x9e
mov eax, ebx
call fcn.00401020
mov dword [esp + 4], str.failed_to_retrieve_AccentPalette_key._n
mov dword [esp], eax
call fcn.00401af0
mov eax, esi
mov ecx, 0x9e5a00
mov edx, 4
call fcn.00401b90
mov eax, esi
mov ecx, 0x754200
mov edx, 3
call fcn.00401b90
mov eax, esi
mov ecx, 0x422600
mov edx, 2
call fcn.00401b90
mov eax, esi
mov ecx, 0xe39c42
mov edx, 6
call fcn.00401b90
mov eax, esi
mov ecx, 0xedb976
mov edx, 7
call fcn.00401b90
mov eax, esi
mov ecx, 0xffd8a6
mov edx, 8
call fcn.00401b90
mov ecx, dword [ebp - 0x20]
mov eax, esi
mov edx, 5
call fcn.00401b90
mov ecx, dword [ebp - 0x1c]
mov eax, esi
mov edx, 4
call fcn.00401b90
mov ecx, dword [ebp - 0x18]
mov eax, esi
mov edx, 3
call fcn.00401b90
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edx, 2
call fcn.00401b90
mov ecx, dword [ebp - 0x24]
mov eax, esi
mov edx, 6
call fcn.00401b90
mov ecx, dword [ebp - 0x28]
mov eax, esi
mov edx, 7
call fcn.00401b90
mov ecx, dword [ebp - 0x2c]
mov eax, esi
mov edx, 8
call fcn.00401b90
mov esi, dword [ebp - 0x5c]
test esi, esi
jne 0x4025b8
mov dword [ebp - 0x54], 0
mov esi, 1
mov dword [ebp - 0x50], 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
mov dword [esp], 0x80000001
call edi
sub esp, 0x14
test eax, eax
jne 0x402158
lea eax, [ebp - 0x50]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x54]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.AppsUseLightTheme
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x402560
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [ebp - 0x54]
sub esp, 4
mov eax, 1
call fcn.004010d0
test eax, eax
je 0x402425
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2c], 0x1010101
mov edx, dword [eax]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov edi, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xe8
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.GetColorValue_returned__lx_n
call fcn.00401af0
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xe9
movzx ecx, byte [ebp - 0x2a]
movzx edi, byte [ebp - 0x29]
movzx edx, byte [ebp - 0x2b]
mov eax, edi
mov dword [esp + 0x14], edi
movzx edi, cl
mov dword [esp + 0x10], edi
movzx edi, dl
or eax, ecx
mov dword [esp + 0xc], edi
movzx edi, byte [ebp - 0x2c]
or al, dl
sete dl
mov dword [esp + 4], str.got_unexpected_value.A___d_value.R___d_value.G___d_value.B___d_n
xor eax, eax
mov dword [esp + 8], edi
cmp byte [ebp - 0x2c], 0xff
sete al
and eax, edx
mov dword [esp], eax
call fcn.00401af0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2c], 0x1010101
mov edx, dword [eax]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov edi, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xef
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.GetColorValue_returned__lx_n
call fcn.00401af0
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xf0
movzx edi, byte [ebp - 0x29]
movzx ecx, byte [ebp - 0x2a]
movzx edx, byte [ebp - 0x2b]
mov eax, edi
mov dword [esp + 0x14], edi
movzx edi, cl
and eax, ecx
mov dword [esp + 0x10], edi
movzx edi, dl
and eax, edx
mov dword [esp + 0xc], edi
movzx edi, byte [ebp - 0x2c]
mov dword [esp + 4], str.got_unexpected_value.A___d_value.R___d_value.G___d_value.B___d_n
mov dword [esp + 8], edi
and al, byte [ebp - 0x2c]
cmp al, 0xff
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401af0
xor eax, eax
call fcn.004010d0
test eax, eax
je 0x402425
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2c], 0x1010101
mov edx, dword [eax]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov edi, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xf9
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.GetColorValue_returned__lx_n
call fcn.00401af0
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xfa
movzx ecx, byte [ebp - 0x2a]
movzx edi, byte [ebp - 0x29]
movzx edx, byte [ebp - 0x2b]
mov eax, edi
mov dword [esp + 0x14], edi
movzx edi, cl
mov dword [esp + 0x10], edi
movzx edi, dl
and eax, ecx
mov dword [esp + 0xc], edi
movzx edi, byte [ebp - 0x2c]
and eax, edx
mov dword [esp + 4], str.got_unexpected_value.A___d_value.R___d_value.G___d_value.B___d_n
mov dword [esp + 8], edi
and al, byte [ebp - 0x2c]
cmp al, 0xff
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401af0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2c], 0x1010101
mov edx, dword [eax]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x100
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.GetColorValue_returned__lx_n
call fcn.00401af0
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x101
movzx edi, byte [ebp - 0x29]
movzx ebx, byte [ebp - 0x2a]
movzx ecx, byte [ebp - 0x2b]
mov eax, edi
movzx edx, byte [ebp - 0x2c]
mov dword [esp + 0x14], edi
or eax, ebx
movzx edi, bl
mov dword [esp + 4], str.got_unexpected_value.A___d_value.R___d_value.G___d_value.B___d_n
or al, cl
mov dword [esp + 0x10], edi
movzx edi, cl
sete cl
xor eax, eax
cmp dl, 0xff
mov dword [esp + 0xc], edi
sete al
movzx edi, dl
and eax, ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.00401af0
mov eax, esi
call fcn.004010d0
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov ebx, eax
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0x10b
xor eax, eax
cmp ebx, 1
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.got_ref__ld._n
mov dword [esp], eax
call fcn.00401af0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp 0x403378
mov eax, dword [0x41c030]
test eax, eax
jne 0x4024ad
cmp ebx, 0x80004002
je 0x402590
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Got_unexpected_hr__lx._n
mov dword [esp], 0
call fcn.00401af0
test ebx, ebx
jns 0x401ed6
call fcn.004026e0
mov dword [eax], 0x40724d
mov dword [eax + 4], 0xd8
mov dword [esp], str.IUISettings3_not_supported._n
call fcn.004019b0
jmp 0x40243a
mov dword [esp + 8], ebx
mov dword [esp + 4], str.got_hr__lx._n
mov dword [esp], 0
call fcn.00401af0
cmp ebx, 0x80040154
jne 0x401dcc
jmp 0x401d78
mov dword [esp + 4], str.AccentPalette
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
xor edx, edx
sub esp, 8
and eax, 0xfffffffd
mov eax, dword [ebp - 0x2c]
sete dl
mov dword [ebp - 0x70], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebp - 0x70]
sub esp, 4
jmp 0x401f69
cmp dword [ebp - 0x4c], 4
jne 0x40213f
jmp 0x402146
mov dword [esp + 8], ebx
mov dword [esp + 4], str.got_hr__lx._n
mov dword [esp], 0
call fcn.00401af0
jmp 0x401dcc
mov dword [esp + 8], 0x80004002
mov dword [esp + 4], str.Got_unexpected_hr__lx._n
mov dword [esp], 1
call fcn.00401af0
jmp 0x4024cd
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov dword [esp], 0x80000001
call edi
sub esp, 0x14
test eax, eax
jne 0x4020c4
lea eax, [ebp - 0x54]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.AccentPalette
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x50]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x4020c4
jmp dword [sym.imp.combase.dll_RoUninitialize]