Function at 0x140014c90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
movups xmm0, xmmword [str.SYSTEMCurrentControlSetEnum_]
mov eax, dword [0x140049930]
xor edx, edx
movups xmm1, xmmword [0x140049908]
lea rcx, [rbp - 0x32]
mov dword [rbp - 0x38], eax
movaps xmmword [rbp - 0x70], xmm0
mov r8d, 0x1ca
movups xmm0, xmmword [0x140049918]
movzx eax, word [0x140049934]
movaps xmmword [rbp - 0x60], xmm1
movsd xmm1, qword [0x140049928]
movaps xmmword [rbp - 0x50], xmm0
movsd qword [rbp - 0x40], xmm1
mov word [rbp - 0x34], ax
call fcn.14001d250
xor edi, edi
lea rcx, [rbp + 0x1a0]
xor edx, edx
mov qword [rsp + 0x60], rdi
mov r8d, 0x208
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov dword [rsp + 0x68], edi
call fcn.14001d250
lea rcx, str.Enter_IsMsftRecovery___n
mov dword [rsp + 0x70], edi
mov dword [rbp - 0x78], 4
mov ebx, edi
mov dword [rsp + 0x6c], 8
call fcn.14000e220
mov ecx, 0x208
lea rax, [rbp - 0x70]
cmp word [rax], bx
je 0x140014d6f
add rax, 2
sub rcx, 1
jne 0x140014d60
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x140014d86
mov eax, 0x208
sub rax, rcx
jmp 0x140014d89
mov rax, rdi
test edx, edx
js 0x140014de1
mov edx, 0x208
lea rcx, [rbp - 0x70]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140014dd3
add rax, 0x7ffffdf6
lea r9, [0x1400557b0]
add rax, rdx
sub r9, rcx
test rax, rax
je 0x140014dd3
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140014dd3
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140014db2
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
lea rdx, [rbp - 0x70]
lea rcx, str.IsMsftRecovery__strParentKey_is__s___n
call fcn.14000e220
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140014e25
lea rcx, str.IsMsftRecovery__can_not_open_the_parent_key_n
jmp 0x140014faf
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140014e75
lea rcx, str.IsMsftRecovery__can_not_query_the_info_of_the_parent_key_n
jmp 0x140014faf
mov eax, dword [rsp + 0x68]
cmp eax, 1
jae 0x140014e8a
lea rcx, str.IsMsftRecovery__subkey_can_not_be_found_n
jmp 0x140014faf
test eax, eax
je 0x140014fb4
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0x208
call fcn.14001d250
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x6c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140014fb4
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140014f18
lea rcx, str.IsMsftRecovery__can_not_open_first_level_subkey_n
jmp 0x140014faf
mov rcx, qword [rsp + 0x78]
lea rax, [rbp - 0x80]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400457c8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140014f49
lea rcx, str.IsMsftRecovery___can_not_open_second_level_subkey_DeviceParameters_n
jmp 0x140014faf
lea rcx, str.IsMsftRecovery__found_DeviceParameters_n
call fcn.14000e220
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rdx, str.EnableDeviceErrorRecovery
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140014f8d
lea rcx, str.IsMsftRecovery__EnableDeviceErrorRecovery_can_not_be_found_n
jmp 0x140014faf
test eax, eax
jne 0x140014fa8
mov edx, dword [rsp + 0x70]
lea rcx, str.IsMsftRecovery__EnableDeviceErrorRecovery_value_is__d_n
call fcn.14000e220
mov ebx, 1
jmp 0x140014fb4
lea rcx, str.IsMsftRecovery__EnableDeviceErrorRecovery_unknown_error_n
call fcn.14000e220
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140014fc9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rdi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140014fde
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140014ff1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x80], rdi
lea rcx, str.Leave_IsMsftRecovery___n
call fcn.14000e220
mov eax, ebx
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140019ce0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret