Function at 0x14006e8dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov r15, rcx
xor ebx, ebx
mov qword [rbp - 0x38], rbx
mov rdi, qword [rbp - 0x38]
test rdi, rdi
jne 0x14018332e
mov qword [rbp - 0x38], rbx
lea rdx, [rbp - 0x38]
call fcn.1400209a4
mov rcx, qword [rbp + 0x40]
test eax, eax
js 0x140183361
call fcn.14006f0d8
neg al
sbb eax, eax
and eax, 0x100000
mov dword [rbp - 0x14], eax
mov dword [rbp + 0x48], ebx
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_isolatedcontainer_l1_1_1.dll_IsProcessInWDAGContainer]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x48]
test eax, eax
cmovs ecx, ebx
neg ecx
sbb eax, eax
and eax, 0x80000
mov dword [rbp - 0x18], eax
call fcn.14001f6a4
test al, al
jne 0x14018337b
mov rcx, qword [rbp - 0x38]
call fcn.140020770
test al, al
mov dword [rbp + 0x50], ebx
jne 0x14018337b
call fcn.14006efb8
neg al
sbb eax, eax
and eax, 0x4000
mov dword [rbp - 0x1c], eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.TempProfile
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerPostBootRemindersProfileError
mov rdi, 0xffffffff80000001
mov rcx, rdi
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
nop dword [rax + rax]
neg eax
sbb esi, esi
not esi
and esi, 0x8000
mov dword [rbp + 0x48], ebx
lea rcx, [rbp + 0x48]
call qword [sym.imp.USERENV.dll_GetProfileType]
nop dword [rax + rax]
test eax, eax
je 0x140183387
mov eax, ebx
mov rcx, qword [rbp + 0x40]
mov r14d, 1
test eax, eax
js 0x140183392
test byte [rbp + 0x48], r14b
mov dword [rbp + 0x48], 0x2000
jne 0x14006ea07
mov dword [rbp + 0x48], ebx
call fcn.14006ee8c
neg al
sbb r12d, r12d
and r12d, 0x1000
call fcn.14001f660
neg al
sbb r13d, r13d
and r13d, 0x800
call fcn.14006ec30
test al, al
jne 0x1401833ac
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str.LogonWork
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rcx, rdi
call fcn.14007b130
test eax, eax
js 0x14006ea63
cmp dword [rbp + 0x58], ebx
mov edi, 0x400
jne 0x14006ea65
mov edi, ebx
call fcn.14006ee44
neg al
sbb eax, eax
and eax, 0x200
mov dword [rbp - 0x20], eax
mov ecx, reloc.SHELL32.dll_Shell_MergeMenus
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
neg eax
sbb eax, eax
and eax, 0x100
mov dword [rbp - 0x24], eax
call fcn.14006ed38
neg al
sbb eax, eax
and eax, 0x40
mov dword [rbp - 0x28], eax
call fcn.140096b1c
neg eax
sbb eax, eax
and eax, 0x10
mov dword [rbp - 0x2c], eax
mov ecx, 0x1d
call qword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
nop dword [rax + rax]
neg eax
sbb eax, eax
and eax, 8
mov dword [rbp - 0x30], eax
call fcn.14006c094
neg al
sbb eax, eax
and eax, 4
mov dword [rbp + 0x60], eax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str.UserSignedIn
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rcx, 0xffffffff80000001
call fcn.14007b130
test eax, eax
js 0x1401833b6
cmp dword [rbp + 0x58], ebx
je 0x1401833b6
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str.OOBEUserSignedIn
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionOOBEStats
mov rcx, 0xffffffff80000002
call fcn.14007b130
test eax, eax
js 0x14006eb3f
cmp dword [rbp + 0x58], 0
je 0x14006eb3f
xor r14d, r14d
or ebx, r14d
or ebx, dword [rbp + 0x60]
or ebx, dword [rbp - 0x30]
or ebx, dword [rbp - 0x2c]
or ebx, dword [rbp - 0x28]
or ebx, dword [rbp - 0x24]
or ebx, dword [rbp - 0x20]
or ebx, edi
or ebx, r13d
or ebx, r12d
or ebx, dword [rbp + 0x48]
or ebx, esi
or ebx, dword [rbp - 0x1c]
or ebx, dword [rbp + 0x50]
or ebx, dword [rbp - 0x18]
or ebx, dword [rbp - 0x14]
or dword [r15 + 0xc8], ebx
test byte [0x14038bd84], 2
je 0x14006eba4
call fcn.14006ecdc
neg al
sbb ebx, ebx
and ebx, 0x20000
call fcn.14006ec84
neg al
sbb ecx, ecx
and ecx, 0x10000
or ebx, ecx
or dword [r15 + 0xc8], ebx
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14006ebb9
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor ebx, ebx
jmp 0x14006e906
mov r9d, eax
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x3d9
call fcn.14009cb2c
nop
jmp 0x14006e91f
mov dword [rbp + 0x50], 0x40000
jmp 0x14006e97a
call fcn.140020b4c
nop
jmp 0x14006e9e5
mov r9d, eax
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, Ordinal_753
call fcn.14009cb2c
nop
jmp 0x14006ea04
mov edi, 0x400
jmp 0x14006ea65
mov ebx, 2
jmp 0x14006eb0f