Function at 0x14000d4f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov dword [rbp - 0x44], r14d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThread]
nop dword [rax + rax]
mov qword [0x14004ca28], rax
call fcn.1400146b0
xor r9d, r9d
lea edx, [r14 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x48], r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
lea ebx, [r14 + 4]
test eax, eax
je 0x140025a7e
lea rax, [rbp - 0x4c]
mov byte [0x140040984], 1
lea rdx, [0x140050db0]
mov qword [0x140040978], rax
call fcn.14000d864
movzx ecx, byte [0x140040984]
cmp eax, 1
cmove ecx, r14d
mov byte [0x140040984], cl
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
lea r12, [0x140052fd0]
mov dword [0x1400449b8], eax
mov rdx, r12
mov ecx, eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
test eax, eax
je 0x140025ac7
mov bl, byte [0x140052fd6]
lea rdi, [0x14005b320]
xor edx, edx
mov rcx, rdi
mov r8d, 0x100
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, r14d
test bl, bl
jne 0x140025b2b
xorps xmm0, xmm0
mov dword [rbp - 0x50], r14d
lea rcx, [rbp - 0x28]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call fcn.14001a594
cmp dword [rbp - 0x48], 1
je 0x140025b77
mov edi, 0xff
test eax, eax
je 0x140025bbc
lea rcx, [0x140053020]
mov rdx, rsp
call sub.api_ms_win_crt_private_l1_1_0.dll___intrinsic_setjmp
mov ecx, dword [0x14004cbc8]
mov ebx, dword [rbp - 0x50]
test eax, eax
jne 0x140025b95
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x14000d6dd
mov esi, r14d
mov eax, r14d
cdqe
mov rdx, qword [rbp + rax*8 - 0x28]
test rdx, rdx
jne 0x14000d6ed
inc esi
mov eax, esi
cmp esi, 3
jl 0x14000d695
call fcn.140014740
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
mov ecx, eax
mov dword [0x1400449b8], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
call fcn.1400146b0
mov ecx, dword [0x14004cbc8]
test ecx, ecx
je 0x140025bb5
mov ecx, ebx
call fcn.14000d734
int3
mov r8d, dword [0x14004cbf8]
mov ecx, 1
call fcn.140012990
cmp rax, 1
je 0x140025baa
cmp rax, 0xffffffffffffffff
je 0x14000d725
mov rdx, rax
xor ecx, ecx
call fcn.14000fd70
test eax, eax
cmovne ebx, eax
mov dword [rbp - 0x50], ebx
jmp 0x14000d6a1
xor ecx, ecx
call fcn.14000d734
int3
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400398a0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000d5ad
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetThreadLocale]
nop dword [rax + rax]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x140025afa
mov bl, 0x81
mov dword [0x140052fd6], 0xfce09f81
mov word [0x140052fda], r14w
jmp 0x14000d617
cmp ax, bx
je 0x140025b1a
cmp ax, 0x12
je 0x140025b1a
mov bl, r14b
mov byte [0x140052fd7], r14b
mov byte [0x140052fd6], bl
jmp 0x14000d617
mov bl, 0x81
mov dword [0x140052fd6], 0xfe81
jmp 0x14000d617
mov r8d, r14d
mov eax, r14d
inc eax
movzx r9d, byte [rax + r12 + 6]
test r9b, r9b
je 0x14000d639
mov eax, r8d
movzx ecx, byte [rax + r12 + 6]
cmp ecx, r9d
ja 0x140025b63
mov r8d, ecx
mov byte [rcx + rdi], 1
lea ecx, [r8 + 1]
mov r8d, ecx
cmp ecx, r9d
jbe 0x140025b53
add edx, 2
mov r8d, edx
mov eax, edx
cmp byte [rdx + r12 + 6], r14b
jne 0x140025b31
jmp 0x14000d639
xor edx, edx
mov ecx, 0x40002729
call fcn.140002bc4
xor ecx, ecx
call fcn.14002c5a0
mov ecx, 0xff
call fcn.14000d734
int3
test ecx, ecx
mov eax, 1
mov dword [rbp - 0x44], eax
cmovne ebx, edi
mov dword [rbp - 0x50], ebx
jmp 0x14000d68b
mov ecx, 1
call fcn.14000d734
int3
mov dword [0x14005bc98], r14d
lea rcx, [0x140053020]
mov rdx, rsp
call sub.api_ms_win_crt_private_l1_1_0.dll___intrinsic_setjmp
mov dword [rbp - 0x50], eax
cmp eax, 2
je 0x14000d725
cmp dword [rbp - 0x48], 2
jne 0x140025bf8
xor edx, edx
mov ecx, 0x40002729
call fcn.140002bc4
xor ecx, ecx
call fcn.14002c5a0
mov ecx, edi
call fcn.14000d734
int3
xor ecx, ecx
call fcn.14001447c
neg eax
sbb ebx, ebx
add ebx, 3
cmp ebx, 3
jne 0x140025c1e
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__setmode]
nop dword [rax + rax]
xor ecx, ecx
call fcn.14001e320
mov byte [0x14004cba8], r14b
call fcn.140013ed4
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call fcn.140012990
mov rdi, rax
cmp rax, 1
je 0x140025c25
cmp rax, 0xffffffffffffffff
je 0x14000d725
call fcn.140013ed4
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
mov ecx, eax
mov dword [0x1400449b8], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
call fcn.1400146b0
mov rdx, rdi
xor ecx, ecx
call fcn.14000fd70
mov byte [0x14004cbcc], r14b
call fcn.140014740
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
nop dword [rax + rax]
mov ecx, eax
mov dword [0x1400449b8], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
nop dword [rax + rax]
call fcn.1400146b0
jmp 0x140025c25