Function at 0x14012d468
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ebx, ecx
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
jne 0x14012d759
test ebx, 0x330a
jne 0x14012d759
call fcn.140070b74
test al, al
jne 0x14012d759
mov ecx, SafeArrayDestroy
call qword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
nop dword [rax + rax]
test eax, eax
jne 0x14012d759
call fcn.14006ec30
test al, al
jne 0x14012d759
mov dword [rbp - 0x31], 4
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 0x20010010
lea r8, [0x14030efa0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [rbp - 0x29], 0
jne 0x14012d759
call fcn.14006ebe0
test al, al
jne 0x14012d759
call fcn.140070b30
test al, al
jne 0x14012d759
call fcn.1401fc980
test eax, eax
jne 0x14012d759
call fcn.1401fc920
test eax, eax
jne 0x14012d759
call fcn.1400ed020
test eax, eax
jne 0x14012d759
and qword [rbp - 0x29], 0
xor edx, edx
lea r8d, [rax + 0x4c]
lea rcx, [rbp - 9]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.14019dcac
lea rcx, [rbp - 0x29]
call fcn.1400207e0
test eax, eax
js 0x14012d745
mov r8, qword [rbp - 0x29]
lea rdx, [rbp - 1]
mov ecx, 0x44
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x14012d745
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov dword [rbp - 5], eax
mov dword [rbp - 9], 3
and qword [rbp - 0x21], 0
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 9]
call qword [0x1403ad398]
nop dword [rax + rax]
test eax, eax
js 0x14012d74a
mov edi, dword [rbp - 0x1d]
shl rdi, 0x20
mov eax, dword [rbp - 0x21]
add rdi, rax
je 0x14012d74a
and qword [rbp - 0x19], 0
lea r9, [rbp - 0x19]
lea r8, str.BioConsentNoticeShownTime
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAuthenticationWindowsHello
mov r14, 0xffffffff80000001
mov rcx, r14
call fcn.140075a50
test eax, eax
js 0x14012d69f
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x31]
shr rcx, 0x20
shl rcx, 0x20
mov eax, dword [rbp - 0x31]
add rcx, rax
mov rax, rcx
sub rax, rdi
movabs rdx, 0x11ed178c6c000
cmp rax, rdx
jbe 0x14012d698
mov eax, dword [rbp - 0x15]
shl rax, 0x20
sub rcx, rax
mov eax, dword [rbp - 0x19]
sub rcx, rax
cmp rcx, rdx
jbe 0x14012d698
mov bl, 1
jmp 0x14012d737
xor bl, bl
jmp 0x14012d737
mov bl, 1
mov byte [rbp - 0x39], bl
and dword [rbp - 0x31], 0
lea r9, [rbp - 0x31]
lea r8, str.LearnMoreAvailable
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHostIntentWindowsHello
mov rcx, r14
call fcn.14002c200
test eax, eax
jns 0x14012d702
lea r9, [rbp - 0x31]
lea r8, str.LearnMoreAvailableInSCOOBE
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHostIntentWindowsHello
mov rcx, r14
call fcn.14002c200
test eax, eax
jns 0x14012d702
lea r9, [rbp - 0x31]
lea r8, str.LearnMoreAvailableInSettings
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAuthenticationWindowsHello
mov rcx, r14
call fcn.14002c200
test eax, eax
js 0x14012d73a
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x11]
shr rcx, 0x20
shl rcx, 0x20
mov eax, dword [rbp - 0x11]
add rcx, rax
sub rcx, rdi
movabs rdx, 0x11ed178c6c000
cmp rcx, rdx
seta bl
mov byte [rbp - 0x39], bl
lea rcx, [rbp - 0x39]
call fcn.140111040
jmp 0x14012d74c
call fcn.1402adf98
xor bl, bl
lea rcx, [rbp - 0x29]
call fcn.14019d090
mov al, bl
jmp 0x14012d75b
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret