Function at 0x14000d394
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r14d, r14d
mov dword [rbp + 0x30], 4
mov rsi, r8
lea rcx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMain
xor edx, edx
mov edi, r14d
lea r15d, [r14 + 1]
lea r8d, [r14 + 2]
mov ebx, r15d
call qword [sym.imp.iertutil.dll_Ordinal_172]
nop dword [rax + rax]
test eax, eax
je 0x14000d42b
lea rax, [rbp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
lea r9d, [r14 + 0x18]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea r8, str.Security_HKLM_Only
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMain
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
cmove edi, dword [rbp + 0x50]
xor edx, edx
mov dword [rbp + 0x48], r14d
lea rcx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainAllowAxisCharacter
lea r8d, [rdx + 2]
call qword [sym.imp.iertutil.dll_Ordinal_172]
nop dword [rax + rax]
test eax, eax
je 0x14000d4bf
lea rax, [rbp - 0x10]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainAllowAxisCharacter
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000d4bf
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0x48]
mov dword [rbp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x14000d55e
test ebx, ebx
je 0x14000d5d8
lea r8d, [rdi + 2]
mov edx, r15d
lea rcx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainAllowAxisCharacter
call qword [sym.imp.iertutil.dll_Ordinal_172]
nop dword [rax + rax]
test eax, eax
je 0x14000d562
lea rax, [rbp - 0x10]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainAllowAxisCharacter
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d562
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0x48]
mov dword [rbp + 0x38], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
je 0x14000d5d8
mov dword [rbp + 0x38], 4
lea rax, [rbp + 0x38]
test edi, edi
je 0x14000d5a9
mov qword [rsp + 0x30], rax
lea rdx, [0x1400143f0]
lea rax, [rbp + 0x48]
mov r9d, 0x18
mov qword [rsp + 0x28], rax
mov r8, rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
jmp 0x14000d5bf
mov qword [rsp + 0x28], rax
mov rdx, rsi
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.14000d604
mov ecx, eax
mov eax, dword [rbp + 0x48]
test ecx, ecx
mov rcx, qword [rbp + 0x58]
cmovne eax, r14d
test rcx, rcx
je 0x14000d5e7
mov dword [rcx], r14d
jmp 0x14000d5e7
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x14000d5e4
mov dword [rax], r15d
mov eax, dword [rbp + 0x48]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret