Function at 0x4093e0
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0xa94]
push ebx
sub esp, 0xabc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelAppearanceSchemes
mov dword [esp], 0x80000001
call ebx
mov dword [ebp - 0xaa0], eax
sub esp, 0x14
test eax, eax
je 0x409448
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea eax, [ebp - 0x840]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x411d60
mov dword [esp], 0x80000001
call ebx
sub esp, 0x14
test eax, eax
je 0x4095d8
lea eax, [ebp - 0x634]
xor esi, esi
mov dword [ebp - 0xa9c], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0xa4a], si
mov dword [ebp - 0xaa4], eax
xor ebx, ebx
mov dword [ebp - 0xa90], 0x105
lea eax, [ebp - 0xa8c]
mov dword [ebp - 0xa8c], 0x2c8
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0xa9c]
mov dword [esp + 4], ebx
add ebx, 1
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xa88]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xa90]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x840]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa94]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
jne 0x4095a8
cmp dword [ebp - 0xa88], 3
jne 0x4094a0
cmp dword [ebp - 0xa8c], 0x2c8
jne 0x4094a0
xor edx, edx
lea eax, [ebp - 0x840]
mov word [ebp - 0x638], dx
mov dword [esp + 4], 0x411630
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x409660
mov dword [esp], str.Windows_Standard
call fcn.00401500
cmp byte [ebp - 0x634], 2
mov dword [ebp - 0xaa8], eax
je 0x4096e0
mov eax, dword [ebp - 0xaa8]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x416008]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xaa0], 1
sub esp, 0xc
jmp 0x4094a0
cmp eax, 0x103
jne 0x4094a0
mov eax, dword [ebp - 0xa94]
mov dword [esp], eax
mov eax, dword [ebp - 0xaa4]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [ebp - 0x634], 0x105
lea eax, [ebp - 0x634]
mov dword [ebp - 0xa9c], eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xa4a]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x36c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Current
mov eax, dword [ebp - 0x840]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x4096c0
xor ecx, ecx
mov word [ebp - 0xa4a], cx
mov eax, dword [ebp - 0x840]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xaa4], eax
call eax
sub esp, 4
jmp 0x40949e
lea esi, [ebp - 0xa84]
lea eax, [ebp - 0x840]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp + 8], 0x1d
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
sub esp, 0x10
test eax, eax
lea eax, [ebp - 0x840]
cmovne esi, eax
cmp byte [ebp - 0x634], 2
mov dword [ebp - 0xaa8], esi
je 0x4096ea
mov eax, dword [ebp - 0xaa0]
test eax, eax
je 0x4094a0
jmp 0x409572
cmp dword [ebp - 0x36c], 1
jne 0x409630
xor ebx, ebx
mov word [ebp - 0x842], bx
jmp 0x409639
mov dword [ebp - 0xaa0], 1
movdqu xmm0, xmmword [ebp - 0x43c]
movdqu xmm1, xmmword [ebp - 0x42c]
lea edx, [ebp - 0x36c]
lea esi, [ebp - 0x630]
movdqu xmm2, xmmword [ebp - 0x41c]
movdqu xmm3, xmmword [ebp - 0x40c]
mov edi, edx
mov ecx, 0x7d
movdqu xmm4, xmmword [ebp - 0x3fc]
mov eax, dword [ebp - 0x370]
rep movsd dword es:[edi], dword [esi]
movdqu xmm5, xmmword [ebp - 0x3f0]
movdqu xmm6, xmmword [ebp - 0x3e0]
movups xmmword [ebp - 0x174], xmm0
movups xmmword [ebp - 0x134], xmm4
movdqu xmm7, xmmword [ebp - 0x3d0]
movdqu xmm0, xmmword [ebp - 0x3c0]
movdqu xmm4, xmmword [ebp - 0x380]
movups xmmword [ebp - 0x164], xmm1
movdqu xmm1, xmmword [ebp - 0x3b0]
movups xmmword [ebp - 0x154], xmm2
movdqu xmm2, xmmword [ebp - 0x3a0]
movups xmmword [ebp - 0x144], xmm3
movdqu xmm3, xmmword [ebp - 0x390]
mov dword [ebp - 0xa8], eax
mov eax, 1
mov dword [ebp - 0x36c], 0x1f8
mov dword [ebp - 0x178], 0
movups xmmword [ebp - 0x128], xmm5
movups xmmword [ebp - 0x118], xmm6
movups xmmword [ebp - 0x108], xmm7
movups xmmword [ebp - 0xf8], xmm0
movups xmmword [ebp - 0xe8], xmm1
movups xmmword [ebp - 0xd8], xmm2
movups xmmword [ebp - 0xc8], xmm3
movups xmmword [ebp - 0xb8], xmm4
mov ecx, dword [ebp - 0xac]
cmp dword [ebp - 0x110], ecx
jne 0x409807
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x10c], eax
setne al
movzx eax, al
mov edi, dword [ebp - 0xaa8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov dword [esp + 4], edi
mov dword [esp], edx
call fcn.004081c0
test eax, eax
je 0x4096a6
lea edx, [ebp - 0x36c]
mov dword [esp + 8], 0x411676
mov dword [esp + 4], edi
mov dword [esp], edx
call fcn.004083a0
test eax, eax
je 0x4096a6
lea eax, [ebp - 0xa4a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x840]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x4096a6
mov eax, dword [ebp - 0xaa8]
call fcn.00406750
jmp 0x4096a6