Function at 0x14001c1b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x320
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov edi, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Keyboard_LayoutPreload
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c6cd
mov word [rbp], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 2]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400f53ec]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c2aa
xor edx, edx
lea r8d, [r14 + 0x10]
lea rcx, [rbp]
call fcn.1400be988
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14001c6cd
movzx esi, di
lea rcx, [rbp]
call fcn.1400685a0
cmp dword [rbp + 4], 6
jb 0x14001c5f1
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r14
mov word [rbp - 0x48], r14w
mov r8d, esi
lea rdx, str.SoftwareMicrosoftCTFAssemblies0x_08x34745C63_B2F0_4784_8B67_5E12C8701A31
lea rcx, [rbp - 0x48]
call fcn.140061ab0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c5ce
mov word [rbp], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 2]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Default
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r14
mov word [rbp - 0x68], r14w
or r15, 0xffffffffffffffff
cmp word [rbp], 0
jne 0x14001c3a7
mov r8, r14
jmp 0x14001c3bb
lea rax, [rbp]
mov r8, r15
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001c3b0
lea rdx, [rbp]
lea rcx, [rbp - 0x68]
call fcn.140006900
nop
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Profile
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
cmp word [rbp], 0
jne 0x14001c421
mov r8, r14
jmp 0x14001c43b
lea rax, [rbp]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001c430
lea rdx, [rbp]
lea rcx, [rbp - 0x28]
call fcn.140006900
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov r8d, 0x26
mov r9, qword [rbp - 0x58]
cmp r9, r8
cmovb r8, r9
test r8, r8
je 0x14001c4a6
lea rdx, str.00000000_0000_0000_0000_000000000000
nop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001c497
add rcx, 2
add rdx, 2
dec r8
jne 0x14001c480
jmp 0x14001c4a6
mov r8d, 1
cmp word [rcx], ax
cmovb r8d, r15d
jmp 0x14001c4a9
mov r8d, r14d
movsxd rax, r8d
test r8d, r8d
jne 0x14001c4c6
cmp r9, 0x26
jae 0x14001c4bc
mov eax, r15d
jmp 0x14001c4c6
mov eax, r14d
cmp r9, 0x26
setne al
lea rcx, [rsp + 0x78]
test eax, eax
je 0x14001c521
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x68]
mov edx, esi
call fcn.14001ce30
mov rdi, rax
lea rax, [rsp + 0x58]
cmp rax, rdi
je 0x14001c51f
cmp qword [rsp + 0x70], 8
jb 0x14001c4fd
mov rcx, qword [rsp + 0x58]
call fcn.1400bd20c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14000b0c0
nop
jmp 0x14001c569
mov edx, edi
call fcn.14001cbc0
mov rdi, rax
lea rax, [rsp + 0x58]
cmp rax, rdi
je 0x14001c569
cmp qword [rsp + 0x70], 8
jb 0x14001c547
mov rcx, qword [rsp + 0x58]
call fcn.1400bd20c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14000b0c0
nop
cmp qword [rbp - 0x70], 8
jb 0x14001c57a
mov rcx, qword [rsp + 0x78]
call fcn.1400bd20c
mov word [rsp + 0x78], r14w
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 7
cmp qword [rbp - 0x10], 8
jb 0x14001c59c
mov rcx, qword [rbp - 0x28]
call fcn.1400bd20c
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
cmp qword [rbp - 0x50], 8
jb 0x14001c5bd
mov rcx, qword [rbp - 0x68]
call fcn.1400bd20c
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r14
mov word [rbp - 0x68], r14w
cmp qword [rbp - 0x30], 8
jb 0x14001c5de
mov rcx, qword [rbp - 0x48]
call fcn.1400bd20c
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r14
mov word [rbp - 0x48], r14w
jmp 0x14001c661
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.14001cbc0
mov rdi, rax
lea rax, [rsp + 0x58]
cmp rax, rdi
je 0x14001c63e
cmp qword [rsp + 0x70], 8
jb 0x14001c61c
mov rcx, qword [rsp + 0x58]
call fcn.1400bd20c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14000b0c0
nop
cmp qword [rbp - 0x70], 8
jb 0x14001c64f
mov rcx, qword [rsp + 0x78]
call fcn.1400bd20c
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
cmp rcx, 8
jae 0x14001c69d
mov r8, qword [rsp + 0x68]
inc r8
je 0x14001c6aa
add r8, r8
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400bcb10
mov rcx, qword [rsp + 0x70]
jmp 0x14001c6aa
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
mov qword [rsp + 0x58], r14
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
jmp 0x14001c737
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
cmp rcx, 8
jae 0x14001c709
mov r8, qword [rsp + 0x68]
inc r8
je 0x14001c716
add r8, r8
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400bcb10
mov rcx, qword [rsp + 0x70]
jmp 0x14001c716
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
mov qword [rsp + 0x58], r14
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov dword [rsp + 0x40], 1
cmp qword [rsp + 0x70], 8
jb 0x14001c751
mov rcx, qword [rsp + 0x58]
call fcn.1400bd20c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rax, rbx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret