Function at 0x1400f1060
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, r9
mov rdi, r8
mov qword [rsp + 0x58], rdx
mov rsi, rcx
mov ecx, 0x97
call fcn.1400fb220
test al, al
jne 0x1400f15dc
cmp qword [rdi + 0x10], 0
je 0x1400f15dc
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rbp - 0x70]
call fcn.1400739a0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.14035c350
call fcn.1401d3600
mov ecx, 0x100
mov r9d, 0x200
cmp eax, 0xc
cmove r9d, ecx
or r9d, 0x20019
lea rdx, [0x140676680]
cmp qword [0x140676698], 8
cmovae rdx, qword [0x140676680]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400f1562
mov dword [rbp - 0x78], 0x204
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x74]
xor r8d, r8d
lea rdx, str.Installation_Path
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f1557
cmp dword [rbp - 0x74], 1
jne 0x1400f1557
lea rcx, [rbp - 0x10]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400f11a0
cmp word [rbp + rax*2 - 0x12], 0x5c
je 0x1400f11c8
lea r8, [0x1405e45bc]
mov edx, 0x104
lea rcx, [rbp - 0x10]
call fcn.140374040
lea rax, [rbp - 0x10]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f11d0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.1400739a0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [0x140676650]
movabs r8, 0x7ffffffffffffffe
mov rax, r8
mov rcx, qword [rbp - 0x60]
sub rax, rcx
cmp rax, r13
jb 0x1400f164d
lea rax, [rbp - 0x70]
mov rsi, qword [rbp - 0x70]
mov r14, qword [rbp - 0x58]
cmp r14, 8
cmovae rax, rsi
mov qword [rsp + 0x48], rax
lea rdx, [0x140676640]
cmp qword [0x140676658], 8
cmovae rdx, qword [0x140676640]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
lea r12, [rcx + r13]
mov edi, 7
lea r15, [rsp + 0x68]
cmp r12, rdi
jbe 0x1400f12d3
mov rdi, r12
or rdi, 7
cmp rdi, r8
jbe 0x1400f127e
mov rdi, r8
jmp 0x1400f128a
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400f1653
lfence
add rcx, rcx
call fcn.140073800
mov r15, rax
mov qword [rsp + 0x68], rax
mov r14, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x70]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], rdi
lea rdi, [rcx + rcx]
mov r8, rdi
mov rdx, rax
mov rcx, r15
call fcn.14035bc80
lea rcx, [rdi + r15]
lea r8, [r13*2]
mov rdx, qword [rsp + 0x50]
call fcn.14035bc80
xor edi, edi
mov word [r15 + r12*2], di
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], dil
xor r8d, r8d
lea rdx, [0x1405e4ea8]
lea rcx, [rbp - 0x30]
call fcn.140073120
nop
test rbx, rbx
je 0x1400f166b
lea r9, [rbp - 0x30]
mov r8, qword [rsp + 0x58]
lea rdx, [0x140676660]
lea rcx, [rsp + 0x68]
mov rax, rbx
call qword [case.0x1401cd220.0]
test al, al
jne 0x1400f1384
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rdx, str.Create_report_process_failed__telemetry_path__ls
lea ecx, [rdi + 3]
call fcn.140109e80
xor bl, bl
jmp 0x1400f14b7
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
lea r9, [rbp - 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x30]
call fcn.1400f1680
test al, al
jne 0x1400f1475
cmp byte [0x140686d58], al
je 0x1400f1431
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
lea rcx, [0x1405f7620]
cmp qword [rbp - 0x40], 0
lea rax, [0x1405e4f00]
cmove rcx, rax
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x44]
lea r8, str.FAILED
lea rdx, str._Telemetry___ls_Error__i__Status__i___ls_ls_ls
mov ecx, 3
call fcn.140109e80
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400f1471
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f146c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f1659
call fcn.140359090
xor bl, bl
jmp 0x1400f14b7
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400f14b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f14b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f1659
call fcn.140359090
mov bl, 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400f14f2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f14ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f165f
call fcn.140359090
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400f1543
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f153e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f1665
call fcn.140359090
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], di
jmp 0x1400f15a0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1400f1596
test byte [rcx + 0x1c], 1
je 0x1400f1596
cmp byte [rcx + 0x19], 2
jb 0x1400f1596
mov edx, 0xb
lea r8, [0x1405f7610]
mov rcx, qword [rcx + 0x10]
call fcn.14007d150
xor bl, bl
mov r14, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x70]
cmp r14, 8
jb 0x1400f15d7
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400f15cf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f1647
mov rcx, rsi
call fcn.140359090
movzx eax, bl
jmp 0x1400f161d
cmp qword [rdi + 0x18], 0x10
jb 0x1400f15e6
mov rdi, qword [rdi]
mov ecx, 0x97
call fcn.1400fb220
lea rcx, [0x1405f79f8]
lea r8, str.disabled
test al, al
cmovne r8, rcx
mov r9, rdi
lea rdx, str._Telemetry__Report_not_sent._TelemetryOptOut_is__S._Telemtry_url_is__S
mov ecx, 1
call fcn.140109e80
mov byte [rsi], 1
mov al, 1
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x368]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140368068
nop
call fcn.1400737a0
nop
call fcn.140073980
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140081ae0
int3