Function at 0x1400119f8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x88
mov qword [rbp - 9], 0xfffffffffffffffe
mov rax, qword [0x140044ee0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r9
mov r14, r8
mov rsi, rcx
xor r15d, r15d
mov qword [rbp - 0x19], r15
test rdx, rdx
je 0x140011a74
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140011c93
mov rsi, qword [rbp - 0x19]
mov dword [rbp - 0x25], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x25]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140011c93
mov eax, dword [rbp - 0x25]
sub eax, 1
je 0x140011c52
sub eax, 2
je 0x140011bf3
sub eax, 1
je 0x140011b9c
cmp eax, 7
je 0x140011af6
mov rcx, qword [rbp + 0x5f]
mov ebx, 0x81333006
mov r9d, ebx
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibplugregistryhelper.cpp
mov edx, 0x47
call fcn.140003b78
jmp 0x140011c93
mov dword [rbp - 0x21], r15d
mov dword [rbp - 0x29], 8
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140011c93
cmp dword [rbp - 0x21], 0xb
je 0x140011b52
mov ebx, 0x8007139f
jmp 0x140011c93
mov ebx, r15d
test ebx, ebx
js 0x140011c93
mov rbx, qword [rbp - 0x11]
movsx rax, byte [rdi + 0x20]
cmp rax, 2
je 0x140011c1b
add rax, 1
je 0x140011b96
sub rax, 1
je 0x140011b96
sub rax, 1
je 0x140011b96
sub rax, 1
je 0x140011b96
cmp rax, 1
je 0x140011b96
mov rcx, rdi
call fcn.140006594
mov byte [rdi + 0x20], 2
jmp 0x140011c1b
lea r9, [rbp - 0x29]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.14000ff3c
mov ebx, eax
test eax, eax
js 0x140011c93
mov ebx, dword [rbp - 0x29]
movsx rax, byte [rdi + 0x20]
cmp rax, 1
je 0x140011bef
add rax, 1
je 0x140011beb
sub rax, 1
je 0x140011beb
sub rax, 1
je 0x140011beb
sub rax, 1
je 0x140011beb
cmp rax, 1
je 0x140011beb
mov rcx, rdi
call fcn.140006594
mov byte [rdi + 0x20], 1
mov dword [rdi], ebx
jmp 0x140011c4d
lea r9, [rbp - 0x11]
mov r8, r14
mov rcx, rsi
call fcn.1400101b8
mov ebx, eax
test eax, eax
js 0x140011c93
mov rbx, qword [rbp - 0x11]
movsx rax, byte [rdi + 0x20]
cmp rax, 3
jne 0x140011c20
mov qword [rdi], rbx
jmp 0x140011c4d
add rax, 1
je 0x140011c46
sub rax, 1
je 0x140011c46
sub rax, 1
je 0x140011c46
sub rax, 1
je 0x140011c46
cmp rax, 1
je 0x140011c46
mov rcx, rdi
call fcn.140006594
mov qword [rdi], rbx
mov byte [rdi + 0x20], 3
mov ebx, r15d
jmp 0x140011c93
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea r9, [rbp - 1]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.140010014
mov ebx, eax
test eax, eax
js 0x140011c89
lea rdx, [rbp - 1]
mov rcx, rdi
call fcn.1400118f0
mov ebx, r15d
lea rcx, [rbp - 1]
call fcn.140006594
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140011ca8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14002f8a0
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret