Function at 0x140008f28
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov r15, rcx
lea rax, vtable.CWizardBase.0
mov qword [rcx], rax
add rcx, 8
call fcn.14002dac4
nop
lea rdi, [r15 + 0xe0]
mov qword [rbp + 0x48], rdi
mov rax, qword [0x140053218]
lea r12, [0x140053218]
mov rcx, r12
mov rax, qword [rax + 0x18]
call qword [0x14003d100]
add rax, 0x18
mov qword [rdi + 8], rax
mov rax, qword [0x140053218]
mov rcx, r12
mov rax, qword [rax + 0x18]
call qword [0x14003d100]
add rax, 0x18
mov qword [rdi + 0x10], rax
lea rbx, [rdi + 0x20]
mov qword [rbp + 0x50], rbx
xor r14d, r14d
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.14000cc48
mov qword [rbx], rax
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x38], r14
mov qword [rdi + 0x40], r14
lea rbx, [rdi + 0x48]
mov qword [rbp + 0x50], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.14000cc48
mov qword [rbx], rax
mov rcx, rdi
call fcn.14001b120
nop
mov qword [r15 + 0x138], r14
mov dword [r15 + 0x140], r14d
mov dword [r15 + 0x144], 1
mov qword [r15 + 0x148], 1
mov qword [r15 + 0x150], r14
mov dword [r15 + 0x158], r14d
mov qword [r15 + 0x160], r14
mov rax, qword [0x140053218]
mov rcx, r12
mov rax, qword [rax + 0x18]
call qword [0x14003d100]
add rax, 0x18
mov qword [r15 + 0x168], rax
mov rax, qword [0x140053218]
mov rcx, r12
mov rax, qword [rax + 0x18]
call qword [0x14003d100]
add rax, 0x18
mov qword [r15 + 0x170], rax
lea rbx, [r15 + 0x178]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.14000cc48
mov qword [rbx], rax
mov qword [r15 + 0x188], r14
mov qword [r15 + 0x190], r14
mov qword [r15 + 0x198], r14
lea rcx, [r15 + 8]
call fcn.14002db50
mov ecx, r14d
test eax, eax
setns cl
mov dword [r15 + 0x140], ecx
lea rax, vtable.CWizard.0
mov qword [r15], rax
lea rdi, [r15 + 0x1a0]
mov qword [rbp + 0x48], rdi
mov qword [rdi], r15
lea rcx, [rdi + 8]
call fcn.14001d5a0
nop
lea rbx, [rdi + 0x18]
mov qword [rbp + 0x50], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.1400161f0
mov qword [rbx], rax
lea rcx, [rdi + 0x28]
call fcn.14002aa6c
nop
mov rcx, rdi
call fcn.140014b68
nop
lea rbx, [r15 + 0x1f0]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.14000cc48
mov qword [rbx], rax
mov qword [r15 + 0x200], r14
mov qword [r15 + 0x208], 1
mov qword [r15 + 0x210], r14
mov rax, qword [0x140053218]
mov rcx, r12
mov rax, qword [rax + 0x18]
call qword [0x14003d100]
add rax, 0x18
mov qword [r15 + 0x218], rax
mov rax, qword [0x140053218]
mov rcx, r12
mov rax, qword [rax + 0x18]
call qword [0x14003d100]
add rax, 0x18
mov qword [r15 + 0x220], rax
mov dword [r15 + 0x228], r14d
mov byte [r15 + 0x22c], r14b
lea rbx, [r15 + 0x230]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.14000cc00
mov qword [rbx], rax
mov qword [r15 + 0x240], r14
mov qword [r15 + 0x248], r14
mov qword [r15 + 0x250], r14
mov qword [0x140054f08], r15
mov rcx, r15
call fcn.1400094f0
lea ebx, [r14 + 2]
mov dword [rbp + 0x40], ebx
lea edi, [rbx + 2]
mov dword [rbp + 0x48], edi
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea esi, [rbx + 0xe]
mov r9d, esi
lea r8, str.PreventHandwritingDataSharing
lea rdx, str.SoftwarePoliciesMicrosoftWindowsTabletPC
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov r12, 0xffffffff80000001
test eax, eax
jne 0x14000920b
mov ecx, dword [rbp + 0x40]
cmp ecx, ebx
jb 0x14000924e
mov dword [rbp + 0x48], edi
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, esi
lea r8, str.PreventHandwritingDataSharing
lea rdx, str.SoftwarePoliciesMicrosoftWindowsTabletPC
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x14000924a
mov ecx, dword [rbp + 0x40]
cmp ecx, ebx
jbe 0x14000924e
mov ecx, ebx
cmp ebx, ebx
setl al
mov byte [r15 + 0x22c], al
jge 0x14000926a
cmp ecx, 1
setne r14b
mov dword [r15 + 0x228], r14d
jmp 0x1400092b4
mov dword [rbp + 0x40], r14d
mov dword [rbp + 0x48], edi
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, esi
lea r8, str.ShareExplicitInk
lea rdx, str.SoftwareMicrosoftInputPersonalization
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x1400092ad
cmp dword [rbp + 0x40], ebx
cmovbe ebx, dword [rbp + 0x40]
mov dword [r15 + 0x228], ebx
mov rax, r15
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret