Function at 0x70d90a20
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x36c
mov ebx, dword [esp + 0x380]
test ebx, ebx
je 0x70d90d60
lea esi, [ebx + 8]
mov edi, dword [sym.imp.kernel32.dll_lstrcmpW]
mov dword [0x70dae348], 1
mov dword [esp + 4], esi
mov dword [esp], 0x70dae140
call edi
sub esp, 8
test eax, eax
je 0x70d90f68
xor ebp, ebp
mov eax, 0x70dae140
jmp 0x70d90a81
add eax, 2
add esi, 2
mov word [eax - 2], dx
cmp eax, 0x70dae346
je 0x70d90a89
movzx edx, word [esi]
test dx, dx
jne 0x70d90a70
xor esi, esi
mov edx, dword [ebx + 0x218]
mov word [eax], si
mov eax, 0x70dae0c0
jmp 0x70d90ab1
add eax, 2
add edx, 2
mov word [eax - 2], cx
cmp eax, 0x70dae13e
je 0x70d90ab9
movzx ecx, word [edx]
test cx, cx
jne 0x70d90aa0
xor ecx, ecx
mov edx, dword [ebx + 0x21c]
mov word [eax], cx
mov eax, 0x70dae040
jmp 0x70d90ae1
add eax, 2
add edx, 2
mov word [eax - 2], cx
cmp eax, 0x70dae0be
je 0x70d90ae9
movzx ecx, word [edx]
test cx, cx
jne 0x70d90ad0
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x88]
call fcn.70d8fec0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov edi, eax
mov dword [esp], 0x80000001
lea eax, [esp + 0x4c]
mov dword [esp + 0x3c], eax
mov dword [esp + 8], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x70d91160
mov eax, 1
test edi, edi
je 0x70d90b39
test al, al
jne 0x70d90fb0
test byte [0x70d9508c], 8
jne 0x70d90d9a
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov dword [esp], 0x80000001
mov dword [esp + 8], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x70d90dc8
lea esi, [esp + 0x6a]
cmp dword [0x70dae348], 1
mov eax, 0x30
mov dword [esp + 0x14], 4
mov ebp, dword [sym.imp.advapi32.dll_RegSetValueExW]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
sbb ax, 0xffff
xor edx, edx
mov dword [esp + 4], str.ThemeActive
mov word [esp + 0x6a], ax
mov eax, dword [esp + 0x4c]
mov word [esp + 0x6c], dx
mov dword [esp], eax
call ebp
mov ecx, dword [0x70dae348]
sub esp, 0x18
test ecx, ecx
je 0x70d91210
cmp word [0x70dae0c0], 0
je 0x70d913fe
mov eax, 0x70dae0c0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x70d90be8
sub eax, 0x70dae0be
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], 0x70dae0c0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ColorName
mov dword [esp], eax
call ebp
sub esp, 0x18
cmp word [0x70dae040], 0
je 0x70d913ea
mov eax, 0x70dae040
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x70d90c40
sub eax, 0x70dae03e
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], 0x70dae040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SizeName
mov dword [esp], eax
call ebp
sub esp, 0x18
cmp word [0x70dae140], 0
je 0x70d913f4
mov eax, 0x70dae140
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x70d90c98
sub eax, 0x70dae13e
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], 0x70dae140
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.DllName
mov dword [esp], eax
call ebp
sub esp, 0x18
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.LoadedBefore
mov dword [esp], eax
call ebp
sub esp, 0x18
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.70d8d660
mov ebx, eax
mov eax, dword [0x70dae348]
test eax, eax
je 0x70d90e00
lea eax, [esp + 0x88]
call fcn.70d8fec0
test eax, eax
jne 0x70d911f0
add esp, 0x36c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
xor edi, edi
xor ebp, ebp
mov dword [0x70dae348], 0
lea eax, [esp + 0x4c]
mov word [0x70dae140], si
mov word [0x70dae0c0], di
mov word [0x70dae040], bp
mov dword [esp + 0x3c], eax
test byte [0x70d9508c], 8
je 0x70d90b46
mov dword [esp + 0xc], str.Writing_theme_config_to_registry_n
mov dword [esp + 8], str.UXTHEME_SetActiveTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d90b46
test byte [0x70d9508c], 8
je 0x70d90d16
mov dword [esp + 0xc], str.Failed_to_open_theme_registry_key_n
mov dword [esp + 8], str.UXTHEME_SetActiveTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d90d16
lea eax, [esp + 0x50]
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov dword [esp], 0x80000001
call esi
sub esp, 0x14
test eax, eax
jne 0x70d90f38
lea eax, [esp + 0x54]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelColors
mov dword [esp], eax
call esi
sub esp, 0x14
mov esi, eax
test eax, eax
jne 0x70d90f38
lea ebp, [esp + 0x64]
lea edi, [esp + 0x6e]
jmp 0x70d90ef0
lea eax, [esp + 0x60]
mov dword [esp + 4], str._d__d__d
mov dword [esp + 0x10], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x58]
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.70d90450
cmp eax, 3
jne 0x70d90f38
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
shl eax, 8
shl edx, 0x10
movzx eax, ax
and edx, 0xff0000
or eax, edx
movzx edx, byte [esp + 0x58]
or eax, edx
mov dword [esp + esi*4 + 0x88], eax
add esi, 1
cmp esi, 0x1f
je 0x70d91292
mov eax, dword [esi*4 + 0x70dac220]
mov dword [esp + 0x64], 0x1a
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x70d90e90
lea esi, [esi]
nop
mov eax, dword [esp + 0x54]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call esi
mov eax, ebx
sub esp, 4
add esp, 0x36c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x218]
mov dword [esp], 0x70dae0c0
mov dword [esp + 4], eax
call edi
sub esp, 8
test eax, eax
jne 0x70d90a64
mov eax, dword [ebx + 0x21c]
mov dword [esp], 0x70dae040
mov dword [esp + 4], eax
call edi
sub esp, 8
test eax, eax
sete al
movzx eax, al
mov ebp, eax
jmp 0x70d90a66
lea eax, [esp + 0x60]
mov edi, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov dword [esp], 0x80000001
call edi
sub esp, 0x24
test eax, eax
jne 0x70d90b39
mov eax, dword [esp + 0x60]
lea ebp, [esp + 0x64]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelColors
mov dword [esp], eax
call edi
sub esp, 0x24
mov esi, eax
test eax, eax
je 0x70d9143e
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebp, dword [sym.imp.advapi32.dll_RegSetValueExW]
lea eax, [esp + 0x104]
mov dword [esp + 0x14], 0x1f8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.NonClientMetrics
mov dword [esp], eax
call ebp
sub esp, 0x18
lea eax, [esp + 0x2fc]
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.IconTitleFont
mov dword [esp], eax
call ebp
sub esp, 0x18
lea eax, [esp + 0x358]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.GradientCaption
mov dword [esp], eax
call ebp
sub esp, 0x18
lea eax, [esp + 0x35c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.FlatMenu
mov dword [esp], eax
call ebp
sub esp, 0x18
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x70d90b39
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x6a]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LoadedBefore
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x70d91270
mov eax, dword [esp + 0x4c]
movzx esi, word [esp + 0x6a]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
cmp si, 0x30
setne al
test eax, ebp
je 0x70d914db
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.70d8d660
add esp, 0x36c
mov ebx, eax
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x88]
xor edx, edx
call fcn.70d904f0
add esp, 0x36c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], str.ColorName
mov esi, dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov dword [esp], eax
call esi
sub esp, 8
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], str.SizeName
mov dword [esp], eax
call esi
sub esp, 8
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], str.DllName
mov dword [esp], eax
call esi
sub esp, 8
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], str.LoadedBefore
mov dword [esp], eax
call esi
sub esp, 8
jmp 0x70d90d06
test byte [0x70d9508c], 4
jne 0x70d91408
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x70d90b28
lea eax, [esp + 0x104]
mov dword [esp + 0x64], 0x1f8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.NonClientMetrics
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x70d90f38
lea eax, [esp + 0x2fc]
mov dword [esp + 0x64], 0x5c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.IconTitleFont
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x70d90f38
lea eax, [esp + 0x358]
mov dword [esp + 0x64], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.GradientCaption
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x70d90f38
lea eax, [esp + 0x35c]
mov dword [esp + 0x64], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FlatMenu
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
jne 0x70d90f45
call esi
sub esp, 4
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call esi
mov edx, 1
sub esp, 4
lea eax, [esp + 0x88]
call fcn.70d904f0
add esp, 0x36c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x70d90c4e
mov eax, 2
jmp 0x70d90ca6
mov eax, 2
jmp 0x70d90bf6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_get_LoadedBefore:__ld_n
mov dword [esp + 8], str.UXTHEME_SetActiveTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.70d90750
jmp 0x70d9127d
mov ebp, dword [sym.imp.advapi32.dll_RegSetValueExW]
lea edi, [esp + 0x6e]
lea esi, [esi]
nop
mov eax, dword [esp + esi*4 + 0x88]
mov dword [esp + 8], str._d__d__d
mov dword [esp + 4], 0xd
mov dword [esp], edi
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov dword [esp + 0x14], edx
movzx edx, ah
movzx eax, al
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
call fcn.70d904a0
mov dword [esp + 0x10], edi
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esi*4 + 0x70dac220]
add esi, 1
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call ebp
sub esp, 0x18
cmp esi, 0x1f
jne 0x70d91450
mov eax, dword [esp + 0x64]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x70d9106c
cmp si, 0x30
sete al
jmp 0x70d90b2d