Function at 0x1400137d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov dword [rbp - 0x44], r14d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThread]
nop dword [rax + rax]
mov qword [0x140045990], rax
call fcn.1400104f4
xor r9d, r9d
lea edx, [r14 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x48], r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
lea ebx, [r14 + 4]
test eax, eax
je 0x14001e9f8
lea rax, [rbp - 0x4c]
mov byte [0x14003d8f4], 1
lea rdx, [0x140049be0]
mov qword [0x14003d8e8], rax
call fcn.140015920
movzx ecx, byte [0x14003d8f4]
cmp eax, 1
cmove ecx, r14d
mov byte [0x14003d8f4], cl
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
lea r12, [0x14004be00]
mov dword [0x140041928], eax
mov rdx, r12
mov ecx, eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
test eax, eax
je 0x14001ea41
mov bl, byte [0x14004be06]
lea rdi, [0x140058150]
xor edx, edx
mov rcx, rdi
mov r8d, 0x100
call sub.msvcrt.dll_memset
mov edx, r14d
test bl, bl
jne 0x14001eaa5
xorps xmm0, xmm0
mov dword [rbp - 0x50], r14d
lea rcx, [rbp - 0x28]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call fcn.140014d5c
cmp dword [rbp - 0x48], 1
je 0x14001eae2
mov edi, 0xff
test eax, eax
je 0x14001eb27
lea rcx, [0x14004fe50]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ecx, dword [0x140045b28]
mov ebx, dword [rbp - 0x50]
test eax, eax
jne 0x14001eb00
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x1400139b9
mov esi, r14d
movsxd rax, esi
mov rdx, qword [rbp + rax*8 - 0x28]
test rdx, rdx
jne 0x1400139c9
inc esi
cmp esi, 3
jl 0x140013972
call fcn.140010580
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
mov ecx, eax
mov dword [0x140041928], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
call fcn.1400104f4
mov ecx, dword [0x140045b28]
test ecx, ecx
je 0x14001eb20
mov ecx, ebx
call fcn.140014c1c
int3
mov r8d, dword [0x140045b50]
mov ecx, 1
call fcn.14000df60
cmp rax, 1
je 0x14001eb15
cmp rax, 0xffffffffffffffff
je 0x1400139fe
mov rdx, rax
xor ecx, ecx
call fcn.14000be00
test eax, eax
cmovne ebx, eax
mov dword [rbp - 0x50], ebx
jmp 0x14001397f
xor ecx, ecx
call fcn.140014c1c
int3
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140036438]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14001388d
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetThreadLocale]
nop dword [rax + rax]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x14001ea74
mov bl, 0x81
mov dword [0x14004be06], 0xfce09f81
mov word [0x14004be0a], r14w
jmp 0x1400138f7
cmp ax, bx
je 0x14001ea94
cmp ax, 0x12
je 0x14001ea94
mov bl, r14b
mov byte [0x14004be07], r14b
mov byte [0x14004be06], bl
jmp 0x1400138f7
mov bl, 0x81
mov dword [0x14004be06], 0xfe81
jmp 0x1400138f7
mov r8d, r14d
lea eax, [rdx + 1]
movzx r9d, byte [rax + r12 + 6]
test r9b, r9b
je 0x140013919
mov eax, r8d
movzx ecx, byte [rax + r12 + 6]
jmp 0x14001eacb
mov byte [rcx + rdi], 1
inc ecx
cmp ecx, r9d
jbe 0x14001eac5
add edx, 2
mov r8d, edx
cmp byte [rdx + r12 + 6], r14b
jne 0x14001eaa8
jmp 0x140013919
xor edx, edx
mov ecx, 0x40002729
call fcn.140003240
xor ecx, ecx
call fcn.140028530
mov ecx, 0xff
call fcn.140014c1c
int3
test ecx, ecx
mov eax, 1
mov dword [rbp - 0x44], eax
cmovne ebx, edi
mov dword [rbp - 0x50], ebx
jmp 0x14001396b
mov ecx, 1
call fcn.140014c1c
int3
mov dword [0x1400586f8], r14d
lea rcx, [0x14004fe50]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ebx, 2
mov dword [rbp - 0x50], eax
cmp eax, ebx
je 0x1400139fe
cmp dword [rbp - 0x48], ebx
jne 0x14001eb66
xor edx, edx
mov ecx, 0x40002729
call fcn.140003240
xor ecx, ecx
call fcn.140028530
mov ecx, edi
call fcn.140014c1c
int3
xor ecx, ecx
call fcn.1400101b8
test eax, eax
jne 0x14001eb87
mov edx, 0x8000
lea ebx, [rax + 3]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__setmode]
nop dword [rax + rax]
xor ecx, ecx
call fcn.1400186f0
mov byte [0x140045b08], r14b
call fcn.1400158e4
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call fcn.14000df60
mov rdi, rax
cmp rax, 1
je 0x14001eb8e
cmp rax, 0xffffffffffffffff
je 0x1400139fe
call fcn.1400158e4
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
mov ecx, eax
mov dword [0x140041928], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
call fcn.1400104f4
mov rdx, rdi
xor ecx, ecx
call fcn.14000be00
mov byte [0x140045b2c], r14b
call fcn.140010580
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
mov ecx, eax
mov dword [0x140041928], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
call fcn.1400104f4
jmp 0x14001eb8e