Function at 0x140021974
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rcx + 0x42c]
mov rbx, rcx
mov rdi, rdx
lea rcx, [rbp + 0x10]
lea rdx, str.Notes
mov esi, 4
mov qword [r11 - 0x10], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x430]
mov qword [rsp + 0x28], rcx
lea rdx, str.EmailMessages
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x428]
lea rdx, str.CalendarItems
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x424]
lea rdx, str.BusinessCards
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x8434]
mov qword [rsp + 0x28], rcx
lea rdx, [0x1400981a8]
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x434]
lea rdx, str.ContactFolderName
mov esi, 0x800
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x10], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0xc34]
mov qword [rsp + 0x28], rcx
lea rdx, str.EmailFolderName
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x1434]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x10], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CalendarFolderName
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x1c34]
mov qword [rsp + 0x28], rcx
lea rdx, str.NotesFolderName
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x2434]
lea rdx, str.OldContactFolderName
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x2c34]
lea rdx, str.OldEmailFolderName
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x3434]
mov qword [rsp + 0x28], rcx
lea rdx, str.OldCalendarFolderName
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x3c34]
lea rdx, str.OldNotesFolderName
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x4434]
lea rdx, str.ContactFolderPath
mov qword [rsp + 0x28], rcx
mov esi, 0x1000
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x5434]
lea rdx, str.EmailFolderPath
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x6434]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov dword [rbp + 0x10], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CalendarFolderPath
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x7434]
mov qword [rsp + 0x28], rcx
lea rdx, str.NotesFolderPath
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret