Function at 0x7ff79016aec0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbp, rcx
mov ecx, 0x40000044
call qword [sym.imp.SHELL32.dll_SHRestricted]
nop dword [rax + rax]
xor esi, esi
lea rdx, [rsp + 0x48]
mov r14d, eax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rcx, [rsi - 4]
call fcn.7ff79016b81c
test eax, eax
jns 0x7ff79016b0a5
lea rcx, [rsp + 0x48]
call 0x7ff790268fb0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xbe
mov qword [rsp + 0x30], rax
lea r8, str.DisabledHotkeys
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x7ff79016af8c
mov word [rsp + 0x60], si
jle 0x7ff79016af8c
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x7ff79016af93
mov word [rsp + 0x60], si
call fcn.7ff790168a6c
test al, al
je 0x7ff79016b025
mov dword [rsp + 0x40], esi
mov bl, 1
call fcn.7ff7901c08b8
test al, al
je 0x7ff79016afd9
lea r8, [rsp + 0x40]
lea rdx, str.AllowClipboardHistory
lea rcx, str.Experience
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyInt]
nop dword [rax + rax]
test eax, eax
js 0x7ff79016afd9
cmp dword [rsp + 0x40], esi
setne bl
mov dword [rsp + 0x40], esi
mov dil, 1
call fcn.7ff7901c08b8
test al, al
je 0x7ff79016b014
lea r8, [rsp + 0x40]
lea rdx, str.AllowCrossDeviceClipboard
lea rcx, str.Privacy
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyInt]
nop dword [rax + rax]
test eax, eax
js 0x7ff79016b014
cmp dword [rsp + 0x40], esi
setne dil
movzx esi, bl
test bl, bl
jne 0x7ff79016b020
test dil, dil
je 0x7ff79016b025
call fcn.7ff79016b2c8
mov ebx, 0x1f4
lea rdi, [0x7ff790472594]
test byte [rdi], 8
je 0x7ff79016b03f
test r14d, r14d
jne 0x7ff79016b1e9
movzx edx, word [rdi - 4]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrChrIW]
nop dword [rax + rax]
test rax, rax
jne 0x7ff79016b1e9
lea eax, [rbx - 0x1fc]
test eax, 0xffffffbf
je 0x7ff79016b1e9
cmp ebx, 0x242
jne 0x7ff79016b07e
test esi, esi
je 0x7ff79016b1e9
cmp ebx, 0x1f5
je 0x7ff79016b1e9
cmp ebx, 0x24e
jne 0x7ff79016b10a
mov dl, 1
lea rcx, [0x7ff7904da098]
call fcn.7ff7901ad398
jmp 0x7ff79016b1b2
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.7ff7901fa1f0
cmp eax, 2
lea rcx, [rsp + 0x48]
mov ebx, esi
sete bl
call fcn.7ff7901f27da
test ebx, ebx
je 0x7ff79016af2f
lea r8, str.ACDEFJQRS
mov edx, 0x5f
lea rcx, [rsp + 0x60]
call fcn.7ff7901b120c
test eax, eax
jns 0x7ff79016af93
mov rcx, qword [rsp + 0x148]
lea r8, str.pcshell_shellexplorerAssignedAccessUtility.h
mov r9d, eax
mov edx, 0x27
call fcn.7ff790182a30
jmp 0x7ff79016af93
cmp ebx, 0x202
jne 0x7ff79016b131
lea rcx, [0x7ff7904d8e10]
call fcn.7ff7901c8018
test al, al
je 0x7ff79016b1b2
inc ebx
add rdi, 8
jmp 0x7ff79016b031
cmp ebx, 0x1f4
jne 0x7ff79016b154
lea rcx, [0x7ff7904d9670]
call fcn.7ff7901c7f94
test al, al
je 0x7ff79016b1b2
inc ebx
add rdi, 8
jmp 0x7ff79016b031
cmp ebx, 0x24f
jne 0x7ff79016b177
lea rcx, [0x7ff7904d9670]
call fcn.7ff7901c7f94
test al, al
je 0x7ff79016b1b2
inc ebx
add rdi, 8
jmp 0x7ff79016b031
cmp ebx, 0x23b
jne 0x7ff79016b19a
lea rcx, [0x7ff7904d9670]
call fcn.7ff7901c7f94
test al, al
je 0x7ff79016b1b2
inc ebx
add rdi, 8
jmp 0x7ff79016b031
cmp ebx, 0x251
jne 0x7ff79016b1b2
lea rcx, [0x7ff7904d96a0]
call fcn.7ff7901c809c
test al, al
je 0x7ff79016b1fb
mov r8d, dword [rdi]
mov edx, ebx
movzx r9d, word [rdi - 4]
bts r8d, 0xe
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_RegisterHotKey]
nop dword [rax + rax]
cmp ebx, 0x242
jne 0x7ff79016b1e9
call fcn.7ff7901892e0
inc ebx
add rdi, 8
jmp 0x7ff79016b031
inc ebx
add rdi, 8
cmp ebx, 0x252
jl 0x7ff79016b031
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.7ff7901bf100
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret