Function at 0x1400062d0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
push r14
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [rcx]
cmp dword [rax], 2
jne 0x140006504
mov rax, qword [rcx + 8]
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
cmp word [rax], 0x31
jne 0x140006504
xor edi, edi
cmp word [rax + 2], di
jne 0x140006504
test rcx, rcx
jne 0x140006331
mov ebx, 0x8007000e
lea edx, [rdi + 0x15]
lea r8, str.shell_appletsoobe_maintenanceoobe_maintenance.cpp
mov r9d, ebx
mov rcx, qword [rbp + 0x20]
call fcn.140004f54
mov eax, ebx
jmp 0x140006506
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x14000634e
mov edx, 0x16
jmp 0x140006317
mov byte [rbp + 0x31], 1
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, str.DeviceMigitationStatus
lea rdx, str..DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionOOBEBroker
mov r14, 0xffffffff80000003
mov rcx, r14
call qword [sym.imp.SHCORE.dll_SHRegGetValueW]
nop dword [rax + rax]
test eax, eax
sete bl
mov byte [rbp + 0x28], bl
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, str.LocalSystemAuthBuffer
lea rdx, str..DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionOOBEBroker
mov rcx, r14
call qword [sym.imp.SHCORE.dll_SHRegGetValueW]
nop dword [rax + rax]
mov ecx, edi
test eax, eax
sete cl
mov dword [rbp - 0x18], ecx
or dword [rbp + 0x40], 0xffffffff
mov dword [rbp + 0x38], 0x80070490
test bl, bl
jne 0x1400064e2
cmp ecx, 1
jne 0x14000646b
mov qword [rbp + 0x40], rdi
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 1]
xor r8d, r8d
lea rdx, str..DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionOOBEBroker
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jns 0x140006420
mov edx, 0x34
jmp 0x140006440
lea rdx, str.LocalSystemAuthBuffer
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jns 0x140006455
mov edx, 0x35
lea r8, str.shell_appletsoobe_maintenanceOOBE_MaintenanceHelpers.h
mov r9d, eax
mov rcx, qword [rbp + 0x20]
call fcn.140004f54
jmp 0x140006497
call fcn.1400065c4
mov ebx, eax
mov rcx, qword [rbp + 0x20]
test eax, eax
jns 0x14000648b
mov edx, 0x26
jmp 0x140006483
test ecx, ecx
jne 0x140006490
call fcn.1400065c4
mov ebx, eax
mov rcx, qword [rbp + 0x20]
test eax, eax
jns 0x14000648b
mov edx, 0x2b
mov r9d, ebx
call fcn.140006d94
mov dword [rbp + 0x38], ebx
jmp 0x140006497
mov dword [rbp + 0x38], 0x80004005
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, str.LocalSystemAuthBuffer
lea rdx, str..DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionOOBEBroker
mov rcx, r14
call qword [sym.imp.SHCORE.dll_SHRegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1400064d8
mov dword [rbp + 0x40], 1
xor ecx, ecx
jmp 0x1400064dd
mov dword [rbp + 0x40], edi
mov cl, 1
call fcn.140006bd8
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x28]
call fcn.140005f8c
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x58
pop r14
pop rdi
pop rbx
pop rbp
ret