Function at 0x1400122f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov dword [rbp - 0x44], r14d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThread]
mov qword [0x140043910], rax
call fcn.14000f908
xor r9d, r9d
lea edx, [r14 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x48], r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
lea ebx, [r14 + 4]
test eax, eax
je 0x14001dc44
lea rax, [rbp - 0x4c]
mov byte [0x14003b874], 1
lea rdx, [0x140047b80]
mov qword [0x14003b868], rax
call fcn.1400147c4
movzx ecx, byte [0x14003b874]
cmp eax, 1
cmove ecx, r14d
mov byte [0x14003b874], cl
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
lea r12, [0x140049da0]
mov dword [0x14003f8a8], eax
mov rdx, r12
mov ecx, eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
test eax, eax
je 0x14001dc81
mov bl, byte [0x140049da6]
lea rdi, [0x1400560f0]
xor edx, edx
mov rcx, rdi
mov r8d, 0x100
call sub.msvcrt.dll_memset
mov edx, r14d
test bl, bl
jne 0x14001dcdf
xor edx, edx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x50], r14d
call fcn.140013d30
cmp dword [rbp - 0x48], 1
je 0x14001dd1f
mov edi, 0xff
test eax, eax
je 0x14001dd64
lea rcx, [0x14004ddf0]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ecx, dword [0x140043aa8]
mov ebx, dword [rbp - 0x50]
test eax, eax
jne 0x14001dd3d
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x1400124a9
mov esi, r14d
movsxd rax, esi
mov rdx, qword [rbp + rax*8 - 0x28]
test rdx, rdx
jne 0x1400124b9
inc esi
cmp esi, 3
jl 0x14001246e
call fcn.14000f980
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003f8a8], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.14000f908
mov ecx, dword [0x140043aa8]
test ecx, ecx
je 0x14001dd5d
mov ecx, ebx
call fcn.140013c0c
int3
mov r8d, dword [0x140043ad0]
mov ecx, 1
call fcn.14000da10
cmp rax, 1
je 0x14001dd52
cmp rax, 0xffffffffffffffff
je 0x1400124ee
mov rdx, rax
xor ecx, ecx
call fcn.14000b540
test eax, eax
cmovne ebx, eax
mov dword [rbp - 0x50], ebx
jmp 0x14001247b
xor ecx, ecx
call fcn.140013c0c
int3
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140034320]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
jmp 0x140012391
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetThreadLocale]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x14001dcae
mov bl, 0x81
mov dword [0x140049da6], 0xfce09f81
mov word [0x140049daa], r14w
jmp 0x1400123ef
cmp ax, bx
je 0x14001dcce
cmp ax, 0x12
je 0x14001dcce
mov bl, r14b
mov byte [0x140049da7], r14b
mov byte [0x140049da6], bl
jmp 0x1400123ef
mov bl, 0x81
mov dword [0x140049da6], 0xfe81
jmp 0x1400123ef
mov r8d, r14d
lea eax, [rdx + 1]
mov r9b, byte [rax + r12 + 6]
test r9b, r9b
je 0x140012411
mov eax, r8d
movzx r8d, r9b
movzx ecx, byte [rax + r12 + 6]
jmp 0x14001dd08
mov byte [rcx + rdi], 1
inc ecx
cmp ecx, r8d
jbe 0x14001dd02
add edx, 2
mov r8d, edx
cmp byte [rdx + r12 + 6], r14b
jne 0x14001dce2
jmp 0x140012411
xor edx, edx
mov ecx, 0x40002729
call fcn.140003aa8
xor ecx, ecx
call fcn.140026df0
mov ecx, 0xff
call fcn.140013c0c
int3
test ecx, ecx
mov eax, 1
mov dword [rbp - 0x44], eax
cmovne ebx, edi
mov dword [rbp - 0x50], ebx
jmp 0x140012467
mov ecx, 1
call fcn.140013c0c
int3
mov dword [0x140056aa0], r14d
lea rcx, [0x14004ddf0]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ebx, 2
mov dword [rbp - 0x50], eax
cmp eax, ebx
je 0x1400124ee
cmp dword [rbp - 0x48], ebx
jne 0x14001dda3
xor edx, edx
mov ecx, 0x40002729
call fcn.140003aa8
xor ecx, ecx
call fcn.140026df0
mov ecx, edi
call fcn.140013c0c
int3
xor ecx, ecx
call fcn.14000f7c8
test eax, eax
jne 0x14001ddbe
mov edx, 0x8000
lea ebx, [rax + 3]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__setmode]
xor ecx, ecx
call fcn.140017690
mov byte [0x140043a88], r14b
call fcn.140014794
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call fcn.14000da10
mov rdi, rax
cmp rax, 1
je 0x14001ddc5
cmp rax, 0xffffffffffffffff
je 0x1400124ee
call fcn.140014794
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003f8a8], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.14000f908
mov rdx, rdi
xor ecx, ecx
call fcn.14000b540
mov byte [0x140043aac], r14b
call fcn.14000f980
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003f8a8], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.14000f908
jmp 0x14001ddc5