Function at 0x479b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
push ebx
push esi
push edi
push 0x114
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x174], 0x11c
push 0
push eax
mov ebx, edx
mov dword [ebp - 0x170], 0xa
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.ntdll.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0xc], edi
push 3
push 2
push 0
push 0
call edi
push 3
push 1
push edx
push eax
call edi
push edx
push eax
mov cl, bl
lea eax, [ebp - 0x174]
push 3
and cl, 1
push eax
mov eax, dword [sym.imp.ntdll.dll_RtlVerifyVersionInfo]
mov byte [ebp - 6], cl
mov dword [ebp - 0x20], eax
call eax
test eax, eax
jne 0x479ce7
test bl, 2
jne 0x479ce7
cmp byte [ebp - 6], al
jne 0x479d10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsDWM
push SysReAllocString
call ebx
test eax, eax
jne 0x479c70
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 4
push eax
push 0
push 0x10
push str.ColorPrevalence
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x479c70
cmp dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
setne bl
test eax, eax
je 0x479ce3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x479ce3
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x479c87
push eax
call edi
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push SysReAllocString
call ebx
test eax, eax
jne 0x479d06
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], 4
push eax
push 0
push 0x10
push str.ColorPrevalence
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x479d06
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
setne bl
test eax, eax
je 0x479ce3
push eax
call edi
test bl, bl
je 0x479d10
mov bh, 1
lea ecx, [ebp - 0x38]
call fcn.004795c0
test eax, eax
setns byte [ebp - 7]
test eax, eax
js 0x479d14
cmp byte [ebp - 0x30], 0
je 0x479d14
mov edi, dword [ebp - 0x2c]
jmp 0x479d62
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x479d10
push eax
call edi
xor bh, bh
jmp 0x479ce9
lea ecx, [ebp - 0x54]
call fcn.004792b0
test eax, eax
js 0x479d25
mov edi, dword [ebp - 0x54]
jmp 0x479d62
lea ecx, [ebp - 0x48]
call fcn.004795c0
test eax, eax
js 0x479d58
mov edx, dword [ebp - 0x48]
or ecx, 0xffffffff
mov eax, edx
or edx, 0xff000000
shr eax, 0x18
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x4f4ae8]
call fcn.004791d0
jmp 0x479d60
push 2
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, eax
push 0x10c
lea eax, [ebp - 0x164]
mov dword [ebp - 0x174], 0x11c
push 0
push eax
mov dword [ebp - 0x170], 0xa
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0x47ba
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 3
push 2
push 0
push 0
call dword [ebp - 0xc]
push 3
push 1
push edx
push eax
call dword [ebp - 0xc]
push 3
push 4
push edx
push eax
call dword [ebp - 0xc]
push edx
push eax
push 7
lea eax, [ebp - 0x174]
push eax
call dword [ebp - 0x20]
test eax, eax
jne 0x479de9
mov edx, str.AppsUseLightTheme
mov byte [ebp - 5], 1
lea ecx, [ebp - 5]
call fcn.0047a030
cmp byte [ebp - 5], 0
sete bl
jmp 0x479deb
xor bl, bl
test bh, bh
je 0x479df3
mov edx, edi
jmp 0x479e02
test bl, bl
mov edx, 0xfff3f3f3
mov eax, 0xff000000
cmovne edx, eax
mov eax, edx
mov dword [esi + 4], edx
shr eax, 0x10
movzx ecx, al
movzx eax, dx
shr eax, 8
lea eax, [eax + eax*4]
add ecx, eax
movzx eax, dl
lea eax, [ecx + eax*2]
mov ecx, 0x400
cmp ecx, eax
sbb eax, eax
and eax, 0xff000001
dec eax
cmp byte [ebp - 6], 0
mov dword [esi], eax
je 0x479e3f
mov eax, edx
mov dword [esi + 8], eax
jmp 0x479ef0
push 0x10c
lea eax, [ebp - 0x164]
mov dword [ebp - 0x174], 0x11c
push 0
push eax
mov dword [ebp - 0x170], 0xa
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0x4563
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 3
push 2
push 0
push 0
call dword [ebp - 0xc]
push 3
push 1
push edx
push eax
call dword [ebp - 0xc]
push 3
push 4
push edx
push eax
call dword [ebp - 0xc]
push edx
push eax
push 7
lea eax, [ebp - 0x174]
push eax
call dword [ebp - 0x20]
test eax, eax
jne 0x479eb9
test bh, bh
jne 0x479eb9
mov dword [esi + 8], 0xb2323232
jmp 0x479ef0
cmp byte [ebp - 7], 0
je 0x479eed
mov eax, dword [ebp - 0x34]
test eax, eax
js 0x479eed
mov edx, dword [ebp - 0x38]
mov ecx, 0xffd9d9d9
movd xmm2, eax
or edx, 0xff000000
cvtdq2ps xmm2, xmm2
mulss xmm2, dword [0x4f4968]
call fcn.004791d0
mov dword [esi + 8], eax
jmp 0x479ef0
mov dword [esi + 8], edi
test bl, bl
mov dword [esi + 0x14], 0x7f565656
mov eax, 0xff2b2b2b
mov edx, 0xfff3f3f3
cmovne edx, eax
mov ecx, 0x5b2
mov eax, 0x102
mov dword [esi + 0x10], edx
cmovne ecx, eax
mov edi, 0x56
mov eax, 0x1e6
cmovne eax, edi
add ecx, eax
mov eax, 0x400
cmp eax, ecx
sbb ecx, ecx
and ecx, 0xff000001
dec ecx
test bl, bl
je 0x479f52
movss xmm2, dword [0x4f4998]
call fcn.004791d0
mov dword [esi + 0xc], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movss xmm2, dword [0x4f49cc]
call fcn.004791d0
pop edi
mov dword [esi + 0xc], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret