Function at 0x1400df0e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov word [rsp + 0x10], dx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
movzx esi, dx
mov r15, rcx
lea rcx, [rbp - 0x71]
call fcn.140120d54
nop
lea rcx, [rbp - 0x59]
call fcn.1400dee14
nop
xor ebx, ebx
mov edi, ebx
mov r14d, ebx
mov r12d, esi
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, 0x147
mov edx, esi
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov r13, rax
test rax, rax
js 0x1400df30e
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0x149
mov edx, esi
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rbx, rax
lea rcx, [rax + 0x80]
lea edx, [r14 + 2]
call fcn.14012005c
mov rsi, rax
test rbx, rbx
jle 0x1400df2fb
test rax, rax
je 0x1400df30a
lea r8, str.Directory_shell_
lea rdx, [rbx + 0x80]
mov rcx, rax
call fcn.14000ab94
or rax, 0xffffffffffffffff
xor ebx, ebx
inc rax
cmp word [rsi + rax*2], bx
jne 0x1400df1a9
lea rax, [rsi + rax*2]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8d, 0x148
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov qword [rbp + 0x7f], rbx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r13d, 0x20019
mov r9d, r13d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400df302
mov dword [rbp + 0x67], 0x410
lea r12d, [rax + 1]
mov edx, r12d
mov ecx, 0x412
call fcn.14012005c
mov rdi, rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.Icon
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400df24d
cmp dword [rbp + 0x77], r12d
je 0x1400df25d
test rdi, rdi
je 0x1400df25d
mov rcx, rdi
call fcn.14012008c
mov rdi, rbx
mov qword [rbp - 0x79], rbx
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x1401a8fa0]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400df2ef
mov dword [rbp + 0x67], 0x1040
mov rdx, r12
mov ecx, 0x1042
call fcn.14012005c
mov r14, rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x77]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400df2d5
cmp dword [rbp + 0x77], r12d
jne 0x1400df2d5
mov rdx, r14
lea rcx, [rbp - 0x59]
call fcn.1400df614
jmp 0x1400df2e5
test rdi, rdi
je 0x1400df2e5
mov rcx, rdi
call fcn.14012008c
mov rdi, rbx
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400df302
xor ebx, ebx
test rsi, rsi
je 0x1400df30a
mov rcx, rsi
call fcn.14012008c
movzx esi, word [rbp + 0x6f]
lea rbx, [0x14015a140]
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140121ccc
mov r8, rax
mov edx, 0x956
lea eax, [rdx - 5]
lea r12d, [rdx + 0x10]
cmp si, r12w
cmove edx, eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x59]
call fcn.1400def2c
mov r8, rax
lea edx, [r12 - 0xf]
lea eax, [rdx - 5]
cmp si, r12w
cmove edx, eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov r8, rbx
xor r13d, r13d
test rdi, rdi
cmovne r8, rdi
lea edx, [r12 - 0x11]
lea eax, [rdx - 5]
cmp si, r12w
cmove edx, eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp si, r12w
jne 0x1400df3ec
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.140121ccc
movzx edx, word [rax]
sub edx, 0x2a
jne 0x1400df3b4
movzx edx, word [rax + 2]
movzx ecx, r13w
sub edx, ecx
test edx, edx
cmovne rbx, rax
mov r8, rbx
mov edx, 0x9af
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rcx, [rbp - 0x19]
call fcn.140120ef0
mov r8d, r13d
test al, al
setne r8b
mov edx, 0x95d
mov rcx, qword [r15 + 8]
call fcn.140047230
test r14, r14
je 0x1400df3f9
mov rcx, r14
call fcn.14012008c
test rdi, rdi
je 0x1400df407
mov rcx, rdi
call fcn.14012008c
nop
lea rcx, [rbp - 0x59]
call fcn.1400dee84
nop
lea rcx, [rbp - 0x71]
call fcn.140120ddc
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret