Function at 0x70d914f0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x70d8f900
push dword [ecx - 4]
push ebp
movd xmm3, eax
mov eax, 0x70d93a90
mov ebp, esp
movd xmm4, eax
push edi
mov edi, 0x70d82c00
push esi
movd xmm1, edi
mov esi, 0x70d8ef10
push ebx
punpckldq xmm1, xmm4
movd xmm0, esi
movdqa xmm2, xmm1
push ecx
punpckldq xmm0, xmm3
punpcklqdq xmm2, xmm0
sub esp, 0x88
movaps xmmword [ebp - 0x68], xmm2
mov ebx, dword [sym.imp.kernel32.dll_GlobalAddAtomW]
mov dword [esp], str.ux_theme
call ebx
sub esp, 4
mov word [0x70dae350], ax
mov dword [esp], str.ux_subapp
call ebx
sub esp, 4
mov word [0x70dae34e], ax
mov dword [esp], str.ux_subidlst
call ebx
sub esp, 4
mov word [0x70dae34c], ax
mov dword [esp], str.ux_dialogtheme
call ebx
mov word [0x70dae030], ax
lea eax, [ebp - 0x4c]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
jne 0x70d91778
test byte [0x70d9508c], 8
jne 0x70d91910
mov dword [ebp - 0x48], 0x14
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea edi, [ebp - 0x48]
mov dword [esp + 0xc], 0
lea esi, [ebp - 0x38]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.ThemeActive
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x70d91830
xor eax, eax
cmp word [ebp - 0x38], 0x30
setne al
mov dword [0x70dae348], eax
mov dword [ebp - 0x48], pe_nt_image_headers32
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x70dae0c0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ColorName
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x70d91659
xor ecx, ecx
mov word [0x70dae0c0], cx
mov dword [ebp - 0x48], pe_nt_image_headers32
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x70dae040
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SizeName
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x70d9169c
xor edx, edx
mov word [0x70dae040], dx
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x40], 0x208
test byte [0x70d9508c], 8
jne 0x70d919a0
mov dword [esp + 0x10], 0x70dae140
lea eax, [ebp - 0x40]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.DllName
mov dword [esp], edi
call ebx
sub esp, 0x18
test eax, eax
je 0x70d91760
cmp eax, 0xea
je 0x70d91760
xor eax, eax
mov word [0x70dae140], ax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, dword [0x70dae348]
test eax, eax
jne 0x70d917c0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.70d8d660
test byte [0x70d9508c], 8
jne 0x70d91a90
movdqa xmm5, xmmword [ebp - 0x68]
movaps xmmword [ebp - 0x38], xmm5
mov dword [esp], esi
mov dword [esp + 4], 0x70dae020
call dword [sym.imp.user32.dll_RegisterUserApiHook]
sub esp, 8
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, dword [ebp - 0x44]
cmp edx, 2
je 0x70d919e8
test eax, eax
je 0x70d916f4
jmp 0x70d916ec
lea esi, [ebp - 0x38]
test byte [0x70d9508c], 8
je 0x70d91703
mov dword [esp + 0xc], str.Failed_to_open_theme_registry_key_n
mov dword [esp + 8], str.UXTHEME_LoadTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
mov eax, dword [0x70dae348]
test eax, eax
je 0x70d91710
lea esi, [esi]
xor ecx, ecx
mov edx, 0x70dae040
mov eax, 0x70dae0c0
cmp word [0x70dae040], 0
cmove edx, ecx
cmp word [0x70dae0c0], 0
mov dword [esp], 0x70dae140
mov dword [esp + 8], edx
cmove eax, ecx
lea ecx, [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
call fcn.70d8d110
test eax, eax
jns 0x70d91880
mov dword [0x70dae348], 0
xor eax, eax
xor edi, edi
mov word [0x70dae0c0], ax
xor eax, eax
mov word [0x70dae140], di
mov word [0x70dae040], ax
jmp 0x70d91710
mov dword [0x70dae348], 0
test byte [0x70d9508c], 8
je 0x70d91616
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_get_ThemeActive:__ld_n
mov dword [esp + 8], str.UXTHEME_LoadTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.70d90750
jmp 0x70d91616
mov ecx, dword [ebp - 0x3c]
mov eax, 0x70dae0c0
mov edx, dword [ecx + 0x218]
jmp 0x70d918a1
add eax, 2
add edx, 2
mov word [eax - 2], bx
cmp eax, 0x70dae13e
je 0x70d918a9
movzx ebx, word [edx]
test bx, bx
jne 0x70d91890
xor ebx, ebx
mov edx, dword [ecx + 0x21c]
mov word [eax], bx
mov eax, 0x70dae040
jmp 0x70d918d1
add eax, 2
add edx, 2
mov word [eax - 2], bx
cmp eax, 0x70dae0be
je 0x70d918d9
movzx ebx, word [edx]
test bx, bx
jne 0x70d918c0
xor edx, edx
mov word [eax], dx
mov dword [esp], ecx
call fcn.70d90a20
test byte [0x70d9508c], 8
jne 0x70d91940
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.70d8d640
mov eax, dword [0x70dae348]
test eax, eax
jne 0x70d91731
jmp 0x70d91710
mov dword [esp + 0xc], str.Loading_theme_config_n
mov dword [esp + 8], str.UXTHEME_LoadTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d915c1
mov eax, 0x70dae040
call fcn.70d90210
mov edi, eax
mov eax, 0x70dae0c0
call fcn.70d90210
mov ebx, eax
mov eax, 0x70dae140
call fcn.70d90210
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Theme_active:__s__s__s_n
mov dword [esp + 8], str.UXTHEME_LoadTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d918ef
mov eax, str.DllName
call fcn.70d90210
mov dword [esp + 0x18], 0x70dae140
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str._hkey_p__s__p__n
mov dword [esp + 8], 0x70dabe9c
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d916b3
cmp eax, 0xea
je 0x70d91ad0
cmp word [0x70dae140], 0
mov eax, 0x70dae140
je 0x70d91a18
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x70d91a08
sub eax, 0x70dae13e
mov edx, eax
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], edx
mov dword [esp], 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov ebx, eax
sub esp, 8
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [eax + 0x70dae140]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x70d91a38
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0x70dae140
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x3c]
sub esp, 0xc
cmp edx, eax
cmovb edx, eax
mov dword [ebp - 0x40], edx
mov dword [esp], ebx
cmp eax, 0x104
jbe 0x70d91ac0
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
jmp 0x70d916ec
mov dword [esp + 0xc], str.Theming_not_active_n
mov dword [esp + 8], str.UXTHEME_LoadTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d91731
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
jmp 0x70d916f4
xor eax, eax
mov word [ebp - 0x4e], ax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
sub esp, 8
mov ecx, eax
lea eax, [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov dword [ebp - 0x6c], ecx
mov dword [esp + 0x10], ecx
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DllName
call ebx
lea eax, [ebp - 0x4e]
sub esp, 0x18
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov edi, dword [ebp - 0x6c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x3c]
sub esp, 0xc
cmp edx, eax
cmovae eax, edx
mov dword [ebp - 0x40], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
jmp 0x70d916ec