Function at 0x140045e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x14006e080]
xor rax, rsp
mov qword [rbp + 0x108], rax
mov r15, r8
mov rsi, rdx
mov qword [rbp + 0x88], rdx
xor ebx, ebx
mov rcx, rdx
call fcn.1400401f0
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
lea r8d, [rbx + 0x38]
lea rdx, str.GroupPoliciesAppServiceClient____RequestReceived_0x_08X_
lea rcx, [rbp - 0x38]
call fcn.14002aba0
mov edx, edi
lea rcx, [rbp - 0x38]
call fcn.1400384d0
cmp edi, 1
je 0x140045ec2
cmp qword [rsi], rbx
je 0x140045ebb
mov rcx, rsi
call fcn.14002e040
xor al, al
jmp 0x1400464c3
lea rcx, [rbp + 0xf0]
call fcn.14002ec50
nop
mov dword [rbp + 0x100], 1
lea rax, [rbp + 0x100]
mov qword [rbp - 0x80], rax
lea r12, [0x140077bd8]
mov qword [rbp + 0x80], r12
lock inc qword [0x140077bd8]
mov rcx, qword [0x140077bd0]
test rcx, rcx
je 0x140045f45
mov qword [rbp + 0xa0], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0xa0]
mov edx, dword [rbp + 0x100]
mov rax, qword [rax + 0x58]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x1400464f9
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lock dec qword [0x140077bd8]
jmp 0x140045f5c
lock dec qword [0x140077bd8]
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x48]
call fcn.140040ce0
nop
cmp word [0x14005fbae], 0
jne 0x140046504
mov dword [rbp - 0x50], 1
mov dword [rbp - 0x4c], 0xb
lea rax, str.MessageType
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x58], rax
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xf0]
call fcn.14002ffc0
nop
cmp qword [rsp + 0x48], 0
je 0x140045fb4
lea rcx, [rsp + 0x48]
call fcn.14002e040
nop
mov dword [rbp + 0xf8], 4
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xfc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x10
lea r8, str.EnableMSAppInstallerProtocol
lea rdx, str.SoftwarePoliciesMicrosoftWindowsAppInstaller
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
xorps xmm0, xmm0
test eax, eax
jne 0x1400462c9
mov edi, dword [rbp + 0xfc]
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov qword [rbp], rbx
lea r8d, [rax + 0x46]
lea rdx, str.GroupPoliciesAppServiceClient____EnableMSAppInstallerProtocol__0x_08X
lea rcx, [rbp - 0x18]
call fcn.14002aba0
mov edx, edi
lea rcx, [rbp - 0x18]
call fcn.1400384d0
mov byte [rbp + 0xe0], 1
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x78], r12
lock inc qword [0x140077bd8]
mov rcx, qword [0x140077bd0]
test rcx, rcx
je 0x1400460a8
mov qword [rbp + 0xc0], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0xc0]
movzx edx, byte [rbp + 0xe0]
mov rax, qword [rax + 0x88]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x14004650a
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x58], rax
lock dec qword [0x140077bd8]
jmp 0x1400460c0
lock dec qword [0x140077bd8]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
call fcn.140040b40
nop
cmp word [0x140060106], 0
jne 0x140046515
mov dword [rbp + 0x10], 1
mov dword [rbp + 0x14], 0x2b
lea rax, str.IsIsMSAppInstallerProtocolEnabledConfigured
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x10]
mov qword [rbp + 8], rdx
mov byte [rbp + 0xe8], 0
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
jne 0x14004610f
mov rcx, rbx
mov qword [rsp + 0x68], rbx
mov r14, rbx
jmp 0x140046143
mov qword [rbp + 0xb8], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0xb8]
lea rdx, [0x14005ea68]
mov rax, qword [rax]
call qword [case.0x14002d15d.0]
mov rcx, qword [rbp + 0xb8]
mov qword [rsp + 0x68], rcx
mov r14, rcx
mov rdx, qword [rbp + 8]
mov rax, qword [rcx]
lea r9, [rbp + 0xe8]
mov rdi, qword [rsp + 0x58]
mov r8, rdi
mov rax, qword [rax + 0x50]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x14004651b
test r14, r14
je 0x140046177
lea rcx, [rsp + 0x68]
call fcn.14002e040
nop
test rdi, rdi
je 0x140046186
lea rcx, [rsp + 0x58]
call fcn.14002e040
cmp dword [rbp + 0xfc], 0
setne byte [rbp + 0xd8]
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x70], r12
lock inc qword [0x140077bd8]
mov rcx, qword [0x140077bd0]
test rcx, rcx
je 0x1400461fb
mov qword [rbp + 0xb0], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0xb0]
movzx edx, byte [rbp + 0xd8]
mov rax, qword [rax + 0x88]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x140046526
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x40], rax
lock dec qword [0x140077bd8]
jmp 0x140046213
lock dec qword [0x140077bd8]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x40]
call fcn.140040b40
nop
cmp word [0x14006020e], 0
jne 0x140046531
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x34], 0x1f
lea rax, str.IsMSAppInstallerProtocolEnabled
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x28], rdx
mov byte [rbp + 0xc8], 0
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x140046281
mov qword [rbp + 0x90], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0x90]
lea rdx, [0x14005ea68]
mov rax, qword [rax]
call qword [case.0x14002d15d.0]
mov rbx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x28]
mov r14, rbx
mov qword [rbp + 0x98], rbx
mov rax, qword [rbx]
lea r9, [rbp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov r8, rdi
mov rcx, rbx
mov rax, qword [rax + 0x50]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x140046537
test rbx, rbx
je 0x1400462c4
lea rcx, [rbp + 0x98]
call fcn.14002e040
nop
jmp 0x14004642d
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
mov r8d, 0x53
lea rdx, str.GroupPoliciesAppServiceClient____Unable_to_read_Group_Policy_from_registry__0x_08X_
lea rcx, [rbp + 0x48]
call fcn.14002aba0
mov edx, edi
lea rcx, [rbp + 0x48]
call fcn.1400384d0
mov byte [rbp + 0xd0], 0
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x68], r12
lock inc qword [0x140077bd8]
mov rcx, qword [0x140077bd0]
test rcx, rcx
je 0x140046364
mov qword [rbp + 0xa8], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0xa8]
movzx edx, byte [rbp + 0xd0]
mov rax, qword [rax + 0x88]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x140046542
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x40], rax
lock dec qword [0x140077bd8]
jmp 0x14004637c
lock dec qword [0x140077bd8]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
call fcn.140040b40
nop
cmp word [0x140060106], 0
jne 0x14004654d
mov dword [rbp - 0x70], 1
mov dword [rbp - 0x6c], 0x2b
lea rax, str.IsIsMSAppInstallerProtocolEnabledConfigured
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x78], rdx
mov byte [rbp + 0xc8], 0
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x1400463ea
mov qword [rbp + 0x98], rbx
mov rax, qword [rcx]
lea r8, [rbp + 0x98]
lea rdx, [0x14005ea68]
mov rax, qword [rax]
call qword [case.0x14002d15d.0]
mov rbx, qword [rbp + 0x98]
mov rdx, qword [rbp - 0x78]
mov r14, rbx
mov qword [rbp + 0x90], rbx
mov rax, qword [rbx]
lea r9, [rbp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov r8, rdi
mov rcx, rbx
mov rax, qword [rax + 0x50]
call qword [case.0x14002d15d.0]
test eax, eax
js 0x1400464ee
test rbx, rbx
je 0x14004642d
lea rcx, [rbp + 0x90]
call fcn.14002e040
nop
test rdi, rdi
je 0x14004643c
lea rcx, [rsp + 0x40]
call fcn.14002e040
mov rcx, qword [rbp + 0xf0]
mov qword [rsp + 0x70], rcx
mov rdi, rcx
mov rbx, rcx
test rcx, rcx
je 0x140046467
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002d15d.0]
mov rcx, qword [rbp + 0xf0]
lea rax, [rsp + 0x70]
cmp r15, rax
je 0x14004648b
cmp qword [r15], 0
je 0x140046486
mov rcx, r15
call fcn.14002e040
mov rcx, qword [rbp + 0xf0]
mov qword [r15], rbx
jmp 0x1400464a1
test rdi, rdi
je 0x1400464a1
lea rcx, [rsp + 0x70]
call fcn.14002e040
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x1400464b3
lea rcx, [rbp + 0xf0]
call fcn.14002e040
nop
cmp qword [rsi], 0
je 0x1400464c1
mov rcx, rsi
call fcn.14002e040
mov al, 1
mov rcx, qword [rbp + 0x108]
xor rcx, rsp
call fcn.140004fc0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lfence
mov ecx, eax
call fcn.14002dc50
nop
lfence
mov ecx, eax
call fcn.14002dc50
nop
call fcn.14000ba60
nop
lfence
mov ecx, eax
call fcn.14002dc50
nop
call fcn.14000ba60
nop
lfence
mov ecx, eax
call fcn.14002dc50
nop
lfence
mov ecx, eax
call fcn.14002dc50
nop
call fcn.14000ba60
nop
lfence
mov ecx, eax
call fcn.14002dc50
nop
lfence
mov ecx, eax
call fcn.14002dc50
nop
call fcn.14000ba60
int3