Function at 0x484250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov dword [esp], 0
mov ebx, esp
push ebx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemes
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48442c
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [0x5052b0]
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push 0
push eax
push str.CurrentTheme
push dword [esp + 0xc]
call dbg.ffRegReadStrbuf
add esp, 0x10
test al, al
je 0x484409
mov edi, dword [esp + 8]
test edi, edi
je 0x4843d3
mov ebx, dword [esp + 0xc]
mov ecx, edi
mov eax, edi
nop word cs:[eax + eax]
sub eax, 1
jb 0x48435a
cmp byte [ebx + ecx - 1], 0x2e
mov ecx, eax
jne 0x4842e0
cmp edi, eax
jbe 0x48435a
cmp dword [esp + 4], 0
je 0x484303
add ebx, eax
mov dword [esp + 8], eax
mov esi, ebx
jmp 0x484353
mov dword [esp + 8], 0
lea eax, [edi + 1]
mov ecx, 0x20
nop word cs:[eax + eax]
mov ebp, ecx
add ecx, ecx
cmp eax, ebp
ja 0x484320
push ebp
call sym._malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
push edi
push ebx
push eax
call sym._memcpy
add esp, 0xc
mov dword [esp + 8], edi
add esi, edi
mov ebp, dword [esp + 0x34]
mov byte [esi], 0
mov edi, dword [esp + 8]
test edi, edi
je 0x4843d3
mov eax, dword [esp + 0xc]
mov esi, edi
neg esi
add eax, edi
dec eax
xor ecx, ecx
nop dword [eax + eax]
mov edx, edi
add edx, ecx
je 0x4843d3
lea ebx, [ecx - 1]
inc esi
cmp byte [eax + ecx], 0x5c
mov ecx, ebx
jne 0x484370
mov eax, edi
add eax, ebx
jae 0x4843d3
cmp dword [esp + 4], 0
je 0x4843c1
mov eax, dword [esp + 0xc]
lea ecx, [eax + edi]
add ecx, ebx
inc ecx
mov edx, ebx
not edx
push edx
push ecx
push eax
call sym._memmove
add esp, 0xc
mov eax, dword [esp + 8]
not edi
add edi, eax
sub edi, ebx
mov dword [esp + 8], edi
add eax, dword [esp + 0xc]
mov byte [esi + eax - 1], 0
jmp 0x4843d3
mov eax, ebx
neg eax
mov dword [esp + 8], eax
add edi, dword [esp + 0xc]
add edi, ebx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0xc]
movsx edi, byte [esi]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
test eax, eax
je 0x4843f8
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
add esp, 4
mov byte [esi], al
mov esi, dword [esp + 0xc]
mov ebx, esp
push esi
push 0x4fc7ce
push ebp
call dbg.ffStrbufAppendF
add esp, 0xc
cmp dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x48442c
mov dword [esp + 4], 0
push dword [esp + 0xc]
call sym._free
add esp, 4
mov eax, dword [esp]
test eax, eax
je 0x48443a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 4
lea edi, [esp + 0x10]
push edi
push ebx
push 0
push 0x10
push str.AccentColor
push str.SoftwareMicrosoftWindowsDWM
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x484497
lea eax, [esp + 4]
push edi
push eax
push 0
push 0x10
push str.ColorizationColor
push str.SoftwareMicrosoftWindowsDWM
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x484acc
mov eax, 0xffffff
and eax, dword [esp + 4]
jmp 0x4844b2
mov eax, dword [esp]
movzx ecx, al
shl ecx, 0x10
mov edx, eax
and edx, 0xff00
or edx, ecx
shr eax, 0x10
movzx eax, al
or eax, edx
mov dword [esp + 4], eax
mov edi, dword [ebp + 4]
test edi, edi
je 0x48455a
mov eax, dword [ebp]
test eax, eax
je 0x4844d3
mov ecx, edi
not ecx
add ecx, eax
cmp ecx, 3
jae 0x484512
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 4]
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x4844f0
test eax, eax
je 0x484517
push ebx
push dword [ebp + 8]
call sym._realloc
add esp, 8
mov esi, eax
mov dword [ebp + 8], eax
mov edi, dword [ebp + 4]
jmp 0x484535
mov esi, dword [ebp + 8]
jmp 0x48453a
push ebx
call sym._malloc
add esp, 4
mov esi, eax
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push esi
call sym._memcpy
add esp, 0xc
mov dword [ebp + 8], esi
mov dword [ebp], ebx
mov ebx, esp
mov byte [esi + edi + 2], 0x20
mov word [esi + edi], 0x2d20
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [eax + 3]
mov dword [ebp + 4], edx
mov byte [ecx + eax + 3], 0
mov eax, dword [esp + 4]
cmp eax, 0x744da8
jg 0x4845b1
cmp eax, 0x48685f
jle 0x484601
cmp eax, 0x567c72
lea edi, [esp + 0x10]
jle 0x484688
cmp eax, 0x687689
jle 0x484760
cmp eax, 0x69797d
jg 0x4848b8
cmp eax, 0x68768a
je 0x4848f8
mov ecx, str.Yellow_gold
cmp eax, 0x696cc3
je 0x4849fd
jmp 0x484bd6
cmp eax, 0xc30051
jle 0x484643
cmp eax, 0xe81122
lea edi, [esp + 0x10]
jle 0x4846be
cmp eax, 0xf7630b
jle 0x48478b
cmp eax, 0xff8bff
jg 0x4848d8
cmp eax, 0xf7630c
je 0x484902
cmp eax, 0xff4343
jne 0x484bd6
mov ecx, str.Mod_red
jmp 0x4849fd
cmp eax, 0xcc69
lea edi, [esp + 0x10]
jg 0x4846f4
cmp eax, 0x99bb
jg 0x4847b6
test eax, eax
je 0x48490c
cmp eax, 0x63b1
je 0x484916
cmp eax, 0x78d4
jne 0x484bd6
mov ecx, str.Blue
jmp 0x4849fd
cmp eax, 0x881797
lea edi, [esp + 0x10]
jg 0x48472a
cmp eax, 0x7a7573
jg 0x4847e1
cmp eax, 0x744da9
je 0x484920
cmp eax, 0x766c59
je 0x48492a
cmp eax, 0x767676
jne 0x484bd6
mov ecx, str.Overcast
jmp 0x4849fd
cmp eax, 0x4c4a47
jg 0x48480c
cmp eax, 0x486860
je 0x484934
cmp eax, 0x498205
je 0x48493e
cmp eax, 0x4a5459
jne 0x484bd6
mov ecx, str.Gray_dark
jmp 0x4849fd
cmp eax, 0xda3b00
jg 0x484837
cmp eax, 0xc30052
je 0x484948
cmp eax, 0xca5010
je 0x484952
cmp eax, 0xd13438
jne 0x484bd6
mov ecx, str.Brick_red
jmp 0x4849fd
cmp eax, 0x107c0f
jg 0x484862
cmp eax, 0xcc6a
je 0x48495c
cmp eax, 0x18574
je 0x484966
cmp eax, 0x38387
jne 0x484bd6
mov ecx, str.Seafoam_teal
jmp 0x4849fd
cmp eax, 0xb146c1
jg 0x48488d
cmp eax, 0x881798
je 0x484970
cmp eax, 0x8d8bd7
je 0x48497a
cmp eax, 0x9a0089
jne 0x484bd6
mov ecx, str.Orchid
jmp 0x4849fd
cmp eax, 0x567c73
je 0x484981
cmp eax, 0x5d5a58
je 0x484988
cmp eax, 0x647c64
jne 0x484bd6
mov ecx, str.Liddy_green
jmp 0x4849fd
cmp eax, 0xe81123
je 0x48498f
cmp eax, 0xea005e
je 0x484996
cmp eax, 0xef6950
jne 0x484bd6
mov ecx, str.Pale_rust
jmp 0x4849fd
cmp eax, 0x99bc
je 0x48499d
cmp eax, 0xb294
je 0x4849a4
cmp eax, 0xb7c3
jne 0x484bd6
mov ecx, str.Seafoam
jmp 0x4849fd
cmp eax, 0x7a7574
je 0x4849ab
cmp eax, 0x807143
je 0x4849b2
cmp eax, 0x8764b8
jne 0x484bd6
mov ecx, str.Iris_pastel
jmp 0x4849fd
cmp eax, 0x4c4a48
je 0x4849b9
cmp eax, 0x4c574e
je 0x4849c0
cmp eax, 0x515c6b
jne 0x484bd6
mov ecx, str.Metal_blue
jmp 0x4849fd
cmp eax, 0xda3b01
je 0x4849c7
cmp eax, 0xe3008c
je 0x4849ce
cmp eax, 0xe74856
jne 0x484bd6
mov ecx, str.Pale_red
jmp 0x4849fd
cmp eax, 0x107c10
je 0x4849d5
cmp eax, 0x10893e
je 0x4849dc
cmp eax, 0x2d7d9a
jne 0x484bd6
mov ecx, str.Cool_blue
jmp 0x4849fd
cmp eax, 0xb146c2
je 0x4849e3
cmp eax, 0xbf0077
je 0x4849ea
cmp eax, 0xc239b3
jne 0x484bd6
mov ecx, str.Orchid_light
jmp 0x4849fd
cmp eax, 0x69797e
je 0x4849f1
cmp eax, 0x6b69d6
jne 0x484bd6
mov ecx, str.Purple_shadow_dark
jmp 0x4849fd
cmp eax, 0xffffff
je 0x4849f8
cmp eax, 0xff8c00
jne 0x484bd6
mov ecx, str.Gold
jmp 0x4849fd
mov ecx, str.Steel_blue
jmp 0x4849fd
mov ecx, str.Orange_bright
jmp 0x4849fd
mov ecx, str.Black
jmp 0x4849fd
mov ecx, str.Navy_blue
jmp 0x4849fd
mov ecx, str.Iris_Spring
jmp 0x4849fd
mov ecx, str.Camouflage
jmp 0x4849fd
mov ecx, str.Moss
jmp 0x4849fd
mov ecx, str.Meadow_green
jmp 0x4849fd
mov ecx, str.Rose
jmp 0x4849fd
mov ecx, str.Orange_dark
jmp 0x4849fd
mov ecx, str.Turf_green
jmp 0x4849fd
mov ecx, str.Mint_dark
jmp 0x4849fd
mov ecx, str.Violet_red
jmp 0x4849fd
mov ecx, str.Purple_shadow
jmp 0x4849fd
mov ecx, str.Pale_moss
jmp 0x4849fd
mov ecx, str.Gray_brown
jmp 0x4849fd
mov ecx, 0x4fc5b4
jmp 0x4849fd
mov ecx, str.Rose_bright
jmp 0x4849fd
mov ecx, str.Cool_blue_bright
jmp 0x4849fd
mov ecx, str.Mint_light
jmp 0x4849fd
mov ecx, str.Gray
jmp 0x4849fd
mov ecx, str.Camouflage_desert
jmp 0x4849fd
mov ecx, str.Storm
jmp 0x4849fd
mov ecx, str.Sage
jmp 0x4849fd
mov ecx, str.Rust
jmp 0x4849fd
mov ecx, str.Plum_light
jmp 0x4849fd
mov ecx, str.Green
jmp 0x4849fd
mov ecx, str.Sport_green
jmp 0x4849fd
mov ecx, str.Violet_red_light
jmp 0x4849fd
mov ecx, str.Plum
jmp 0x4849fd
mov ecx, str.Blue_gray
jmp 0x4849fd
mov ecx, str.White
mov dword [esp + 0x14], ecx
push ecx
call sym._strlen
add esp, 4
test eax, eax
je 0x484acc
mov esi, eax
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
test eax, eax
je 0x484a28
mov ecx, ebx
not ecx
add ecx, eax
cmp ecx, esi
jae 0x484a64
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [esi + ebx]
inc edx
nop word [eax + eax]
mov ebp, ecx
add ecx, ecx
cmp edx, ebp
ja 0x484a40
test eax, eax
je 0x484a6d
push ebp
mov edi, dword [esp + 0x38]
push dword [edi + 8]
call sym._realloc
add esp, 8
mov dword [edi + 8], eax
mov ebx, dword [edi + 4]
jmp 0x484aa2
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
jmp 0x484aae
push ebp
call sym._malloc
add esp, 4
test ebx, ebx
je 0x484a98
lea ecx, [ebx + 1]
push ecx
mov edi, dword [esp + 0x38]
push dword [edi + 8]
push eax
mov dword [esp + 0x28], eax
call sym._memcpy
mov eax, dword [esp + 0x28]
add esp, 0xc
jmp 0x484a9f
mov byte [eax], 0
mov edi, dword [esp + 0x34]
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x14]
mov dword [edi], ebp
mov ebp, edi
lea edi, [esp + 0x10]
add ebx, eax
push esi
push ecx
push ebx
call sym._memcpy
add esp, 0xc
mov eax, dword [ebp + 4]
add eax, esi
mov dword [ebp + 4], eax
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 0
mov ebx, esp
mov dword [esp], 0
push ebx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x484ce5
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], 1
mov eax, dword [esp]
mov dword [esp + 4], 4
lea esi, [esp + 4]
push esi
push edi
push 0
push 0x18
push str.SystemUsesLightTheme
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x484ce5
mov eax, dword [esp]
mov dword [esp + 4], 4
lea ecx, [esp + 0x18]
push esi
push ecx
push 0
push 0x18
push str.AppsUseLightTheme
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x484ce5
mov edi, dword [ebp + 4]
test edi, edi
je 0x484ba2
mov eax, dword [ebp]
test eax, eax
je 0x484b72
mov ecx, edi
not ecx
add ecx, eax
cmp ecx, 2
jae 0x484bea
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 3]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x484b80
test eax, eax
je 0x484bef
push ebx
push dword [ebp + 8]
call sym._realloc
add esp, 8
mov esi, eax
mov dword [ebp + 8], eax
mov edi, dword [ebp + 4]
jmp 0x484c0d
cmp dword [esp + 0x10], 0
mov eax, str.Dark
mov ecx, str.Light
mov edx, str.Light
cmove edx, eax
cmp dword [esp + 0x18], 0
cmove ecx, eax
push ecx
push edx
push str.System:__s__Apps:__s
push ebp
call dbg.ffStrbufAppendF
add esp, 0x10
jmp 0x484ce5
push eax
push str._06lX
push ebp
call dbg.ffStrbufAppendF
add esp, 0xc
jmp 0x484acc
mov esi, dword [ebp + 8]
jmp 0x484c10
push ebx
call sym._malloc
add esp, 4
mov esi, eax
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push esi
call sym._memcpy
add esp, 0xc
mov dword [ebp + 8], esi
mov dword [ebp], ebx
mov word [esi + edi], 0x2820
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [eax + 2]
mov dword [ebp + 4], edx
mov byte [ecx + eax + 2], 0
cmp dword [esp + 0x10], 0
mov eax, str.Dark
mov ecx, str.Light
mov edx, str.Light
cmove edx, eax
cmp dword [esp + 0x18], 0
cmove ecx, eax
push ecx
push edx
push str.System:__s__Apps:__s
push ebp
call dbg.ffStrbufAppendF
add esp, 0x10
mov eax, dword [ebp]
mov edi, dword [ebp + 4]
test eax, eax
je 0x484c67
lea ecx, [edi + 1]
cmp eax, ecx
jne 0x484ca2
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 2]
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x484c80
test eax, eax
je 0x484ca7
push ebx
push dword [ebp + 8]
call sym._realloc
add esp, 8
mov esi, eax
mov dword [ebp + 8], eax
mov edi, dword [ebp + 4]
jmp 0x484cce
mov esi, dword [ebp + 8]
jmp 0x484cd4
push ebx
call sym._malloc
add esp, 4
mov esi, eax
test edi, edi
je 0x484cc8
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push esi
call sym._memcpy
add esp, 0xc
jmp 0x484ccb
mov byte [esi], 0
mov dword [ebp + 8], esi
mov dword [ebp], ebx
lea ecx, [edi + 1]
mov dword [ebp + 4], ecx
mov byte [esi + edi], 0x29
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 0
mov eax, dword [esp]
test eax, eax
je 0x484cf3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 4]
test esi, esi
jne 0x484d84
mov eax, dword [ebp]
test eax, eax
je 0x484d11
cmp eax, 0x1d
jae 0x484d41
mov ecx, eax
cmp eax, 1
ja 0x484d20
mov ecx, 0x20
nop word cs:[eax + eax]
mov edi, ecx
add ecx, ecx
cmp edi, 0x1d
jb 0x484d20
test eax, eax
je 0x484d48
push edi
push dword [ebp + 8]
call sym._realloc
add esp, 8
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 4]
jmp 0x484d59
mov eax, dword [ebp + 8]
xor ecx, ecx
jmp 0x484d5c
push edi
call sym._malloc
add esp, 4
mov byte [eax], 0
mov dword [ebp + 8], eax
xor ecx, ecx
mov dword [ebp], edi
movups xmm0, xmmword [0x4fc94c]
movups xmmword [eax + ecx + 0xc], xmm0
movups xmm0, xmmword [str.Failed_to_find_current_theme]
movups xmmword [eax + ecx], xmm0
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [eax + 0x1c]
mov dword [ebp + 4], edx
mov byte [ecx + eax + 0x1c], 0
test esi, esi
setne al
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret