Function at 0x14000f1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor ebx, ebx
mov dword [rbp + 0x80], ebx
mov rax, qword [rcx]
lea r8, [0x140052f80]
mov edx, 0xc9
mov rax, qword [rax + 0x30]
call qword [case.0x14004448e.0]
test rax, rax
je 0x14000f2cf
cmp word [rax], 0x3c
je 0x14000f2cf
mov dword [rbp + 0x88], ebx
mov dword [rbp + 0x90], 4
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, str.eula_accepted
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000f296
mov dword [rsp + 0x50], eax
lea rax, [0x140068970]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x50]
jmp 0x14000f29d
lea rcx, [0x140068058]
mov rax, qword [0x140068060]
cmp qword [rcx + 8], rax
jne 0x14000f46a
test ebx, ebx
jne 0x14000f46a
cmp dword [rbp + 0x88], ebx
je 0x14000f46a
mov al, 1
add rsp, 0x160
pop rdi
pop rbx
pop rbp
ret
lea rax, [0x140055f40]
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rbp + 0x80], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x30], rbx
mov dword [rbp - 0x28], 4
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.logger_stream.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x5c], edx
mov ecx, dword [0x14006b410]
mov eax, dword [0x14006b40c]
add ecx, eax
je 0x14000f3e2
mov dword [rsp + 0x48], ebx
call fcn.1400288d0
mov qword [rsp + 0x40], rax
lock inc dword [rsp + 0x48]
mov dword [rbp + 0x80], 0xa
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x14000f3bf
call fcn.1400288d0
mov qword [rsp + 0x40], rax
lock inc dword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x14000f3de
mov rax, qword [rax + 0x58]
test rax, rax
je 0x14000f3de
call qword [case.0x14004448e.0]
movzx edi, al
jmp 0x14000f3e5
xor edi, edi
jmp 0x14000f3e5
xor dil, dil
mov eax, dword [rbp + 0x80]
test al, 8
je 0x14000f42a
and eax, 0xfffffff7
mov dword [rbp + 0x80], eax
mov qword [rsp + 0x40], rbx
mov eax, 0xffffffff
lock xadd dword [rsp + 0x48], eax
cmp eax, 1
js 0x14000f425
nop dword [rax]
call fcn.140028a30
mov eax, 0xffffffff
lock xadd dword [rsp + 0x48], eax
cmp eax, 1
jns 0x14000f410
lock inc dword [rsp + 0x48]
mov byte [rbp - 0x20], dil
mov dword [rbp - 0x1c], 4
lea rax, str.oobe::is_eula_accepted_in_product
mov qword [rbp - 0x18], rax
test dil, dil
je 0x14000f457
lea rdx, str.Failed_to_get_regpath
lea rcx, [rsp + 0x60]
call fcn.140020ff0
nop
lea rcx, [rbp - 8]
call fcn.140028b20
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
xor al, al
add rsp, 0x160
pop rdi
pop rbx
pop rbp
ret