Function at 0x140002ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov edi, ecx
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
mov ebx, 1
test ecx, ecx
je 0x140003314
sub ecx, ebx
je 0x1400032e4
cmp ecx, ebx
jne 0x140003314
lea ecx, [rbx + 7]
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007cb04], eax
lea ecx, [rbx + 4]
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007cb00], eax
lea ecx, [rbx + 4]
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007cafc], eax
lea ecx, [rbx + 7]
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007caf8], eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400030ed
mov dword [rbp - 0x14], 4
mov dword [rbp - 0x10], 4
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea rax, [0x14007cb04]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, str.color9
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003117
lea rax, [0x14007cb04]
mov qword [rsp + 0x20], rax
lea r9, str.color9
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140010080
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003185
mov dword [rbp - 0x10], 4
mov dword [rbp - 0x14], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [0x14007cb00]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, str.color10
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400031af
lea rax, [0x14007cb00]
mov qword [rsp + 0x20], rax
lea r9, str.color10
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140010080
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000321d
mov dword [rbp - 0x10], 4
mov dword [rbp - 0x14], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [0x14007cafc]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x14]
xor r8d, r8d
lea rdx, str.color11
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003247
lea rax, [0x14007cafc]
mov qword [rsp + 0x20], rax
lea r9, str.color11
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140010080
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400032b8
mov dword [rbp - 0x10], 4
mov dword [rbp - 0x50], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [0x14007caf8]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
xor r8d, r8d
lea rdx, str.color12
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003358
lea rax, [0x14007caf8]
mov qword [rsp + 0x20], rax
lea r9, str.color12
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140010080
jmp 0x140003358
mov dword [0x14007cb04], 0xc8c8c8
mov dword [0x14007cb00], 0x1e1e1e
mov dword [0x14007cafc], 0x383838
mov dword [0x14007caf8], 0xffffff
mov byte [0x14007cb0a], bl
jmp 0x14000335f
mov ecx, 8
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007cb04], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007cb00], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007cafc], eax
mov ecx, 8
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [0x14007caf8], eax
mov byte [0x14007cb0a], 0
xor r12d, r12d
cmp byte [0x14007cb09], r12b
je 0x1400033f8
movzx edx, byte [0x14007cb0a]
mov rcx, rsi
call qword [0x14007ccc0]
mov dword [rbp - 0x14], r12d
mov rcx, rsi
call qword [0x14007ccf0]
test al, al
je 0x1400033a8
call qword [0x14007ccc8]
test al, al
je 0x1400033a8
call fcn.14000a000
test al, al
jne 0x1400033a8
mov dword [rbp - 0x14], ebx
jmp 0x1400033ab
mov ebx, dword [rbp - 0x14]
cmp dword [0x14007ccd0], 0x47ba
jae 0x1400033cc
movsxd r8, ebx
lea rdx, str.UseImmersiveDarkModeColors
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetPropW]
jmp 0x1400033f8
mov rax, qword [0x14007cd08]
test rax, rax
je 0x1400033f8
mov dword [rbp - 0x40], 0x1a
lea rcx, [rbp - 0x14]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], 4
lea rdx, [rbp - 0x40]
mov rcx, rsi
call rax
mov rbx, qword [r15]
mov rsi, qword [r15 + 8]
cmp rbx, rsi
je 0x1400034e0
mov ecx, edi
test edi, edi
je 0x14000341c
sub ecx, 1
je 0x140003631
cmp ecx, 1
jne 0x140003456
xor r8d, r8d
lea rdx, str.Explorer
mov rcx, qword [rbx]
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.Explorer
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
cmp byte [0x14007cb09], r12b
je 0x140003477
mov rax, qword [0x14007ccc0]
test rax, rax
je 0x140003477
movzx edx, byte [0x14007cb0a]
mov rcx, qword [rbx]
call rax
mov r9d, dword [0x14007cb00]
xor r8d, r8d
mov edx, 0x1001
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [0x14007cb04]
xor r8d, r8d
mov edx, 0x1024
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [0x14007cb00]
xor r8d, r8d
mov edx, 0x1026
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_RedrawWindow]
add rbx, 8
cmp rbx, rsi
jne 0x140003408
mov rbx, qword [r14]
mov rsi, qword [r14 + 8]
cmp rbx, rsi
je 0x140003551
nop dword [rax]
mov ecx, edi
test edi, edi
je 0x140003500
sub ecx, 1
je 0x140003500
cmp ecx, 1
jne 0x140003534
cmp byte [0x14007cb09], r12b
je 0x140003521
mov rax, qword [0x14007ccc0]
test rax, rax
je 0x140003521
movzx edx, byte [0x14007cb0a]
mov rcx, qword [rbx]
call rax
xor r8d, r8d
lea rdx, str.Explorer
mov rcx, qword [rbx]
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_RedrawWindow]
add rbx, 8
cmp rbx, rsi
jne 0x1400034f0
mov rcx, qword [0x14007caf0]
test rcx, rcx
je 0x14000356a
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x14007caf0], r12
mov ecx, dword [0x14007cafc]
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x14007caf0], rax
mov rcx, qword [r15]
test rcx, rcx
je 0x1400035cd
mov rax, qword [r15 + 0x10]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
jb 0x1400035bd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003664
mov rcx, r8
call fcn.140039910
mov qword [r15], r12
mov qword [r15 + 8], r12
mov qword [r15 + 0x10], r12
mov rcx, qword [r14]
test rcx, rcx
je 0x140003611
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140003601
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000366a
mov rcx, r8
call fcn.140039910
mov qword [r14], r12
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r8d, r8d
lea rdx, str.ItemsView
mov rcx, qword [rbx]
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.Header
jmp 0x14000344a
call fcn.140040a70
nop
call fcn.140040a70
int3