Function at 0x140015c90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x140033670]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov r12, r8
lea rdx, [0x140024f18]
lea rcx, [rsi + 8]
call fcn.14000e8ec
lea rdx, str.UpgradeRemediation
lea rcx, [rsi + 0x10]
call fcn.14000e8ec
lea rdx, str.RemediationShell
lea rcx, [rsi + 0x18]
call fcn.14000e8ec
lea r13, [rsi + 0x20]
mov rcx, r13
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion_rempl_settings
call fcn.14000e8ec
mov rcx, rsi
mov qword [rsi + 0x70], 0xffffffff80000002
call fcn.140011754
mov edi, eax
test eax, eax
js 0x140015ede
xor ebx, ebx
xor ebp, ebp
lea edi, [rbx + 1]
cmp dword [0x140033edc], edi
je 0x140015dc9
cmp qword [rsi + 8], rbx
je 0x140015ead
cmp qword [rsi + 0x10], rbp
je 0x140015ead
cmp qword [rsi + 0x18], rbp
je 0x140015ead
mov rcx, qword [rsi + 0x70]
lea rax, [rcx + 0x7fffffff]
cmp rax, rdi
ja 0x140015ead
mov rdx, qword [r13]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x58], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x140015da8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140015db8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [0x140033edc]
test ebx, ebx
cmovns eax, edi
mov dword [0x140033edc], eax
mov edi, ebx
test ebx, ebx
js 0x140015ede
mov ebp, 0x208
lea rcx, [rsp + 0x60]
mov r8d, ebp
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rdx, qword [r13]
lea rax, [rsp + 0x50]
mov rcx, qword [rsi + 0x70]
lea r8, str.Endpoint
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], ebp
xor ebp, ebp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9d, [rbp + 2]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x140015e3f
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x140015e2c
lea rdx, [rsp + 0x60]
test rax, rax
jne 0x140015e46
lea rdx, str.settings_win.data.microsoft.com
mov rcx, rsi
call fcn.14000e8ec
test ebx, ebx
js 0x140015ede
mov rcx, rsi
call fcn.14000fb68
mov ebx, eax
cmp eax, 1
ja 0x140015e6e
cmp qword [rsi + 0xb0], rbp
jne 0x140015ecb
lea rdx, str.Onesettings_Query___method_failed
mov ecx, eax
call fcn.14000821c
mov rcx, rsi
call fcn.1400102e8
mov ebx, eax
test eax, eax
jns 0x140015e98
lea rdx, str.Onesettings_ForceResetQueryState___method_failed
mov ecx, eax
call fcn.140008434
mov rcx, r12
call fcn.1400141cc
mov edi, eax
test eax, eax
jns 0x140015eb6
mov edx, 0x10e
jmp 0x140015ee3
mov edi, 0x80070057
mov ebx, edi
jmp 0x140015e4e
mov rcx, rsi
call fcn.140011ba8
mov edi, eax
test eax, eax
jns 0x140015ecb
mov edx, 0x10f
jmp 0x140015ee3
lea rdx, [rsi + 0xa0]
mov rcx, r12
call fcn.1400143f4
mov eax, ebx
jmp 0x140015efc
mov edx, 0xf7
mov rcx, qword [rsp + 0x2b8]
lea r8, str.onecoreenduserupgradeenablers_shellhelpersonesettingsswitches.cpp
mov r9d, edi
call fcn.140004784
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001c1f0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret