Function at 0x7ff79016bf88
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rcx
mov eax, 0x64
xchg dword [rcx + 0x1a8], eax
mov qword [rbp - 1], rcx
mov byte [rbp + 7], 1
xor edi, edi
mov ebx, edi
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x31], rdi
lea rcx, [rbp - 0x31]
call fcn.7ff790166710
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff7904626c0]
xor edx, edx
mov r8d, 0x404
lea rcx, [0x7ff790462700]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
test eax, eax
jns 0x7ff79016c019
lea rcx, [rbp - 0x31]
call fcn.7ff7901c9914
jmp 0x7ff79016c074
lea r8, [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
call fcn.7ff79016c868
test eax, eax
jns 0x7ff79016c052
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.internalShellprivateincShellInfrastructureHelpers.h
mov edx, 0xe
call fcn.7ff7901f01e6
nop
lea rcx, [rbp - 0x31]
call fcn.7ff7901c9914
mov rbx, qword [rbp - 0x29]
jmp 0x7ff79016c074
lea rcx, [rbp - 0x31]
call fcn.7ff790166710
mov rbx, qword [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
nop dword [rax + rax]
mov dword [rsi + 0x1b8], eax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x7ff79016c08d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r15d, 8
lea r12, str.SoftwareMicrosoftWindowsCurrentVersionExplorerLogonStats
test dword [rsi + 0xc8], 0x800
je 0x7ff79016c14d
lea ecx, [r15 + 0x5e]
call 0x7ff7903d6f74
mov byte [rbp - 0x39], 1
mov dword [rbp - 0x21], edi
lea r9, [rbp - 0x21]
lea r8, str.ExplorerStartCount
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUserOOBE
mov rbx, 0xffffffff80000001
mov rcx, rbx
call fcn.7ff7901baa6c
mov eax, dword [rbp - 0x21]
mov dword [rbp - 0x19], eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 0x31], eax
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x19]
call 0x7ff7903d0148
lea rax, [rbp - 0x39]
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.7ff7901d7f1c
lea rcx, [rbp - 0x19]
call 0x7ff7903f4754
nop
lea rcx, [rbp - 9]
cmp byte [rbp - 0x39], dil
jne 0x7ff79016c13a
call fcn.7ff790166710
lea rcx, [rbp - 0x11]
call fcn.7ff790166710
mov edi, 0x80004004
jmp 0x7ff79016c411
call fcn.7ff790166710
lea rcx, [rbp - 0x11]
call fcn.7ff790166710
jmp 0x7ff79016c26c
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.FirstLogonTime
mov rdx, r12
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov r14d, 3
cmp eax, 2
jne 0x7ff79016c1e3
lea rcx, [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTime]
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x10
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, str.FirstLogonTime
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x7ff79016c1e3
mov r9d, eax
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x1b5c
call 0x7ff790330d98
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.FirstLogonTimeOnCurrentInstallation
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp eax, 2
jne 0x7ff79016c26c
lea rcx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTime]
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x10
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, str.FirstLogonTimeOnCurrentInstallation
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x7ff79016c26c
mov r9d, eax
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x1b63
call 0x7ff790330d98
mov dword [rbp - 0x31], r15d
lea r14, [rsi + 0xf0]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
mov r9d, 0x40
lea r8, str.LogonCount
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jle 0x7ff79016c2bb
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x7ff79016c2c0
mov qword [r14], rdi
inc qword [r14]
mov rax, qword [r14]
mov qword [rbp - 0x29], rax
mov dword [rsp + 0x28], r15d
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
lea r8, str.LogonCount
lea r14, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rdx, r14
mov rcx, rbx
call fcn.7ff7901b727c
test eax, eax
jle 0x7ff79016c303
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0x5f]
test eax, eax
jns 0x7ff79016c31f
mov r9d, eax
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x1b6c
call fcn.7ff790182a30
test byte [rsi + 0xc8], 2
je 0x7ff79016c340
mov r9d, 1
lea r8, str.UserSignedIn
mov rdx, r14
mov rcx, rbx
call fcn.7ff79016574c
mov eax, dword [rsi + 0xc8]
test al, 2
je 0x7ff79016c382
test al, 4
jne 0x7ff79016c382
mov r9d, 1
lea r8, str.FirstLogonOnAadcCompliantInstallation
mov rdx, r12
mov rcx, rbx
call fcn.7ff79016574c
mov rcx, qword [rbp + 0x5f]
test eax, eax
jns 0x7ff79016c382
mov r9d, eax
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x1b77
call fcn.7ff790182a30
mov dword [rbp - 0x31], 4
lea rbx, [rsi + 0xe4]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, str.AppReadinessGlobalTimeoutMs
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jle 0x7ff79016c3d4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x7ff79016c3dc
mov dword [rbx], 0x668a0
lea rdx, [0x7ff790463018]
mov rcx, r15
call fcn.7ff7901bf79c
mov qword [rbp - 0x29], rax
test rax, rax
je 0x7ff79016c3fe
mov rcx, rax
call fcn.7ff79016c44c
jmp 0x7ff79016c401
mov rax, rdi
mov qword [rsi + 0xd0], rax
mov rcx, rsi
call fcn.7ff7901b7ba0
nop
lea rcx, [rbp - 1]
call fcn.7ff7903d3f78
mov eax, edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.7ff7901bf100
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret