Function at 0x7ff7901afbc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rbp + 0x170], rax
and qword [rsp + 0x58], 0
mov rdi, rcx
mov byte [rcx], 0
mov rsi, rdx
lea rcx, [rsp + 0x48]
mov byte [rdx], 0
call fcn.7ff7901afdcc
lea r12, str.Colors
mov ebx, eax
test eax, eax
js 0x7ff7901afcd2
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
je 0x7ff79022bb74
mov rax, qword [str.AnyoneRead]
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionSystemProtectedUserData
mov qword [rsp + 0x30], r12
lea r8, str._s_s_s_s
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.7ff790181180
mov ebx, eax
test eax, eax
js 0x7ff7901afcb0
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x7ff79022bb88
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test ebx, ebx
js 0x7ff7901afd9a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.HighContrastEnabled
mov r12d, 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], r12d
lea r9d, [r12 + 0xc]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x7ff79022bb96
test ebx, ebx
js 0x7ff7901afd89
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r8, str.HighContrastEnabledNew
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x28], rax
mov r9d, 0x10
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x7ff79022bba4
test ebx, ebx
js 0x7ff7901afd89
cmp dword [rsp + 0x40], 0xffffffff
jne 0x7ff79022bbb2
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.7ff7901bf100
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
call fcn.7ff79018056c
mov ebx, eax
test eax, eax
js 0x7ff7901afcc1
jmp 0x7ff7901afc3d
movzx ebx, ax
or ebx, 0x80070000
jmp 0x7ff7901afcb0
movzx ebx, ax
or ebx, 0x80070000
jmp 0x7ff7901afd28
movzx ebx, ax
or ebx, 0x80070000
jmp 0x7ff7901afd75
lea r8, [rsp + 0x48]
xor ebx, ebx
call fcn.7ff790406360
test eax, eax
js 0x7ff79022bc14
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
movabs r10, 0xeb751f1e78565970
mov rax, qword [rax + 0x30]
lea r8, str.HighContrastEnabledNew
or r9d, 0xffffffff
mov dword [rsp + 0x20], 1
lea rdx, str.Colors
call qword [0x7ff79045bf28]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x7ff79045bf28]
cmp dword [rsp + 0x50], ebx
setne al
cmp dword [rsp + 0x40], ebx
mov byte [rdi], al
setne al
mov byte [rsi], al
jmp 0x7ff7901afd89