Function at 0x14007a9b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
movsxd rbx, edx
mov r14, rcx
mov esi, 0xffff00ff
test r8b, r8b
jne 0x14007aa38
mov eax, dword [0x140389e60]
test eax, eax
je 0x14007a9e1
cmp r9d, 1
jne 0x14007aa29
mov edi, 2
mov dword [rbp - reloc.OLEAUT32.dll_SafeArrayGetDim], 0x10
xor eax, eax
mov dword [0x140389e60], edi
xor r9d, r9d
mov qword [rbp - 0xc], rax
lea r8, [rbp - 0x10]
mov dword [rbp - 4], eax
lea edx, [rdi + 0xe]
lea ecx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14007aa29
test byte [rbp - 0xc], 1
jne 0x1401885dc
xchg dword [0x140389e60], edi
mov eax, dword [0x140389e60]
cmp eax, 1
je 0x1401885e6
xor edi, edi
lea rdx, [0x140000000]
cmp ebx, 0xd1
jbe 0x14007aada
mov qword [rsp + 0xc8], r15
cmp ebx, 2
je 0x14007ab08
cmp ebx, 1
je 0x14007abca
lea eax, [rbx - 3]
cmp eax, 4
jbe 0x14007abca
cmp ebx, 0xd7
je 0x140188679
cmp ebx, 8
je 0x140188679
cmp ebx, 0xd2
je 0x140188689
test ebx, ebx
je 0x140188679
cmp ebx, 0xd1
jbe 0x140188664
lea eax, [rbx - 0xd2]
cmp eax, 0x3f8
ja 0x14007abc3
movsxd rax, ebx
mov eax, dword [rdx + rax*4 + 0x322be8]
mov r15, qword [rsp + 0xc8]
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rbx + rbx*2]
mov r8b, 1
lea r9, [rdx + 0x387d60]
mov r10d, edi
lea r9, [r9 + rcx*4]
test r8b, r8b
je 0x14007aa4d
mov eax, dword [r9]
test al, 0x40
je 0x14007aa4d
jmp 0x140188624
lea r14, [0x14038a3a4]
lea r15, [0x14038a3a0]
cmp dword [0x14038b2e8], edi
mov qword [rbp - 0x40], rdi
jne 0x1401886fa
mov rax, qword [0x140389750]
mov qword [rbp - 0x40], rax
movzx eax, byte [0x140389e65]
test al, al
je 0x140188729
mov rbx, qword [0x140389e58]
mov rbx, qword [rbx]
mov rsi, rbx
shr rsi, 0x20
cmp qword [0x14038c658], rdi
jne 0x140188913
shr rbx, 0x20
cmp ebx, dword [0x140387a98]
jne 0x14007ac09
mov al, 1
lea rdx, [rbp - 0x20]
mov byte [0x140389e66], al
mov ecx, 1
mov dword [0x140387a98], ebx
mov qword [rbp - 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
cmp byte [0x140389e66], dil
mov dword [rbp - 0x18], 1
je 0x14007ac10
mov rcx, qword [rbp - 0x20]
mov esi, dword [r14]
test rcx, rcx
je 0x14007abbd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
or esi, 0xff000000
mov eax, esi
jmp 0x14007aac3
cmp ebx, 2
je 0x14007ab08
dec ebx
cmp ebx, 6
ja case.0x14007abeb.2
movsxd rax, ebx
mov ecx, dword [rdx + rax*4 + 0x7ac80]
add rcx, rdx
jmp rcx
lea r14, [0x14038a3ac]
jmp 0x14007ab0f
lea r14, [0x14038a3a8]
jmp 0x14007ab0f
xor al, al
jmp 0x14007ab70
mov rax, qword [0x14038c658]
lea r8, str.AccentPalette
mov rcx, qword [rbp - 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
test rax, rax
mov dword [rbp + 0x40], 0x20
mov r9d, 8
cmovne rcx, rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jg 0x140188958
js 0x140188967
cmp dword [rbp + 0x40], 0x20
jne 0x140188967
mov byte [0x140389e66], 1
jmp 0x14007aba5
mov edi, 1
jmp 0x14007aa23
cmp ebx, 0x4ca
ja 0x14007aa38
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbx*4 + 0x34dac0]
cmp ecx, 0x1f
jne 0x14018860e
xor edi, edi
mov eax, edi
jmp 0x14007aacb
call qword [sym.imp.USER32.dll_GetSysColor]
nop dword [rax + rax]
or eax, 0xff000000
jmp 0x14007aacb
mov ebx, eax
shr ebx, 0x10
cmp ebx, 0x4ca
jae 0x14018864a
cmp ebx, 0xd2
jae 0x14018864f
lea rcx, [rbx + rbx*2]
lea r9, [rdx + 0x387d60]
lea r9, [r9 + rcx*4]
jmp 0x140188652
mov ebx, 0x4ca
xor r8b, r8b
inc r10d
cmp r10d, 0xa
jb 0x14007aaef
jmp 0x14007aa4d
mov edx, dword [r14 + 4]
mov r8d, ebx
mov ecx, dword [r14]
call fcn.140261b60
nop
jmp 0x14007aac3
cmp ebx, 0xd2
je 0x140188689
test ebx, ebx
je 0x140188689
xor cl, cl
jmp 0x14018868b
mov cl, 1
test ebx, 0xfffffff7
sete dl
call fcn.140261b00
mov ecx, eax
call fcn.1400551f0
nop
jmp 0x14007aac3
lea r15, [0x14038a3a0]
mov r14, r15
jmp 0x14007ab16
lea r14, [0x14038a3b0]
jmp 0x14007ab0f
lea r14, [0x14038a3b4]
jmp 0x14007ab0f
lea r14, [0x14038a3b8]
jmp 0x14007ab0f
mov rcx, qword [rbp + 0x28]
lea r8, [0x14031c128]
mov r9d, 0x80070057
mov edx, Ordinal_548
call fcn.14001e09c
nop
jmp 0x14007abbd
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x40]
call fcn.14026181c
cmp dword [0x14038b2e8], edi
je 0x14007ab31
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x40]
call fcn.14026181c
mov rbx, qword [rbp - 0x40]
jmp 0x14007ab5e
call fcn.140097bd4
mov ebx, eax
test eax, eax
js 0x14018890a
movzx ecx, byte [0x140389e65]
test cl, cl
jne 0x1401888e3
mov qword [rsp + 0xb0], r12
mov edx, 1
mov qword [rsp + 0xb8], r13
mov ecx, 0xf001f
lea r13, str.LocalSessionImmersiveColorPreference
mov sil, 1
mov r8, r13
xor r12b, r12b
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
mov ebx, 4
test rax, rax
jne 0x1401887d8
mov r8, r13
lea edx, [rbx - 3]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
xor sil, sil
test rax, rax
jne 0x1401887d8
mov qword [rsp + 0x28], r13
lea rcx, [rax - 1]
xor r9d, r9d
mov dword [rsp + 0x20], 8
mov r8d, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
nop dword [rax + rax]
mov sil, 1
movzx r12d, sil
test rax, rax
je 0x1401888ce
mov qword [0x140389e50], rax
mov byte [0x140389e64], sil
movzx eax, byte [0x140389e64]
mov rcx, qword [0x140389e50]
test al, al
mov eax, 0xf001f
mov qword [rsp + 0x20], 8
cmovne ebx, eax
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [0x140389e58], rax
mov rax, qword [0x140389e58]
test rax, rax
je 0x1401888ce
mov ebx, edi
test r12b, r12b
je 0x14018889e
mov rcx, qword [0x140389e58]
call fcn.14007ad30
call fcn.140261a8c
test al, al
jne 0x14018889e
lea rcx, [rbp - 0x28]
call fcn.1400207e0
test eax, eax
js 0x14018889e
mov rsi, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [0x1403ad2d0]
nop dword [rax + rax]
test eax, eax
je 0x14018888f
mov rcx, qword [rbp - 0x30]
call fcn.140261e78
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
call fcn.140099528
mov rcx, qword [0x140389750]
test eax, eax
cmovne rcx, qword [0x140389748]
mov qword [0x140389750], rcx
call fcn.14007aca4
call fcn.140088038
mov byte [0x140389e65], 1
jmp 0x1401888d3
mov ebx, 0x80004005
mov r13, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xb0]
mov rax, qword [0x14038b2e0]
test rax, rax
je 0x140188902
mov rcx, qword [0x14038b2e0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
nop dword [rax + rax]
test ebx, ebx
jns 0x14007ab40
mov rbx, qword [rbp - 0x40]
jmp 0x14007ab5e
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rdi
call fcn.14007ad30
cmp qword [0x14038c658], rdi
jne 0x14018894f
mov byte [0x140389e66], dil
cmp dword [rbp - 0x38], ebx
jne 0x14018893a
cmp dword [rbp - 0x34], esi
je 0x14018894f
call fcn.140261a8c
test al, al
jne 0x14018894f
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.140261f94
mov rbx, qword [rbp - 0x38]
jmp 0x14007ab5e
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x14007ac64
mov rax, qword [0x14038c658]
mov ecx, 0xd77800
mov rdx, qword [rbp - 0x20]
test rax, rax
cmovne rdx, rax
xor r8d, r8d
call fcn.140263a18
test eax, eax
jns 0x14007ac74
mov rcx, qword [rbp + 0x28]
lea r8, [0x14031c128]
mov r9d, eax
mov edx, 0x23c
call fcn.14009cb2c
nop
jmp 0x14007ac74