Function at 0x14000f71c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
mov dword [rbp - 0x44], r15d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenThread]
mov qword [0x140042ae0], rax
call fcn.14000c074
xor r9d, r9d
lea edx, [r15 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x48], r15d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
lea ebx, [r15 + 4]
test eax, eax
je 0x14001ab62
lea rax, [rbp - 0x4c]
mov byte [0x1400323e0], 1
lea rdx, [0x1400323c0]
mov qword [0x1400303b0], rax
call fcn.1400116d8
movzx ecx, byte [0x1400323e0]
cmp eax, 1
cmove ecx, r15d
mov byte [0x1400323e0], cl
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
lea r13, [0x14003a830]
mov dword [0x14003a844], eax
mov rdx, r13
mov ecx, eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
test eax, eax
je 0x14001ab9f
mov bl, byte [0x14003a836]
lea rdi, [0x14004afb0]
xor edx, edx
mov rcx, rdi
mov r8d, 0x100
call sub.msvcrt.dll_memset
mov edx, r15d
mov r14d, 2
test bl, bl
jne 0x14001abfd
xor edx, edx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x50], r15d
call fcn.140006418
cmp dword [rbp - 0x48], 1
je 0x14001ac36
mov esi, 0xff
test eax, eax
je 0x14000f920
lea rcx, [0x1400428e0]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ecx, dword [0x140046d3c]
mov ebx, dword [rbp - 0x50]
test eax, eax
jne 0x14001ac54
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x14000f8db
mov edi, r15d
movsxd rax, edi
mov rdx, qword [rbp + rax*8 - 0x28]
test rdx, rdx
jne 0x14000f8eb
inc edi
cmp edi, 3
jl 0x14000f8a0
call fcn.14000c0f0
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003a844], eax
mov rdx, r13
call qword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
call fcn.14000c074
mov ecx, dword [0x140046d3c]
test ecx, ecx
je 0x14001ac74
mov ecx, ebx
call fcn.140011814
int3
mov r8d, dword [0x140046d58]
mov ecx, 1
call fcn.140008ca0
cmp rax, 1
je 0x14001ac69
xor ecx, ecx
cmp rax, 0xffffffffffffffff
je 0x14000f97e
mov rdx, rax
call fcn.14000c1f0
test eax, eax
cmovne ebx, eax
mov dword [rbp - 0x50], ebx
jmp 0x14000f8ad
lea rcx, [0x1400428e0]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov dword [rbp - 0x50], eax
cmp eax, r14d
je 0x14000f984
cmp dword [rbp - 0x48], r14d
je 0x14001ac80
xor ecx, ecx
call fcn.14000b708
test eax, eax
je 0x14001ac9b
xor ecx, ecx
call fcn.140002850
mov byte [0x140030350], r15b
call fcn.140006068
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call fcn.140008ca0
mov rbx, rax
cmp rax, 1
je 0x14000f957
jmp 0x14001acb2
call fcn.140011814
int3
xor ecx, ecx
call fcn.140011814
int3
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400295e0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
jmp 0x14000f7bd
call qword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetThreadLocale]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x14001abcc
mov bl, 0x81
mov dword [0x14003a836], 0xfce09f81
mov word [0x14003a83a], r15w
jmp 0x14000f81b
cmp ax, bx
je 0x14001abec
cmp ax, 0x12
je 0x14001abec
mov bl, r15b
mov byte [0x14003a837], r15b
mov byte [0x14003a836], bl
jmp 0x14000f81b
mov bl, 0x81
mov dword [0x14003a836], 0xfe81
jmp 0x14000f81b
lea eax, [rdx + 1]
mov r8b, byte [rax + r13 + 6]
test r8b, r8b
je 0x14000f843
mov eax, edx
movzx r9d, r8b
movzx ecx, byte [rax + r13 + 6]
jmp 0x14001ac22
mov byte [rcx + rdi], 1
inc ecx
cmp ecx, r9d
jbe 0x14001ac1c
add edx, r14d
cmp byte [rdx + r13 + 6], r15b
jne 0x14001abfd
jmp 0x14000f843
xor edx, edx
mov ecx, 0x40002729
call fcn.140004ae0
xor ecx, ecx
call fcn.14001f430
mov ecx, 0xff
call fcn.140011814
int3
test ecx, ecx
mov eax, 1
mov dword [rbp - 0x44], eax
cmovne ebx, esi
mov dword [rbp - 0x50], ebx
jmp 0x14000f899
mov ecx, 1
call fcn.140011814
int3
mov dword [0x14004b0b0], r15d
jmp 0x14000f920
xor edx, edx
mov ecx, 0x40002729
call fcn.140004ae0
xor ecx, ecx
call fcn.14001f430
mov ecx, esi
call fcn.140011814
int3
xor ecx, ecx
mov edx, 0x8000
lea r14d, [rcx + 3]
call qword [sym.imp.msvcrt.dll__setmode]
nop
jmp 0x14000f950
cmp rax, 0xffffffffffffffff
je 0x14001ad11
call fcn.140006068
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003a844], eax
mov rdx, r13
call qword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
call fcn.14000c074
mov rdx, rbx
xor ecx, ecx
call fcn.14000c1f0
mov byte [0x140030364], r15b
call fcn.14000c0f0
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003a844], eax
mov rdx, r13
call qword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
call fcn.14000c074
nop
jmp 0x14000f957
xor ecx, ecx
call fcn.140011814
int3