Function at 0x14001ae10
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
sub rsp, 0x30
and dword [rax + 8], 0
mov rdi, r9
cmp qword [r8 + 0x18], 8
mov r10, r8
jb 0x14001ae40
mov r10, qword [r8]
mov rax, qword [rdx]
lea r9, [rsp + 0x50]
and qword [rsp + 0x28], 0
xor r8d, r8d
and qword [rsp + 0x20], 0
mov rdx, r10
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov r12d, MsiPreviewDialogW
lea rbp, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
movabs rax, 0x8000000000
lea r13, [0x14017bb60]
test esi, esi
je 0x14001aed1
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001aeaa
inc rax
jmp 0x14001aead
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
mov rbx, rax
movabs rax, 0x82100000000
shl rbx, 0x34
or rbx, rsi
or rbx, rax
jmp 0x14001aed4
mov rbx, rax
mov rax, rbx
shr rax, 0x27
not eax
test al, 1
jne 0x14001aef3
mov byte [rdi], 1
movabs rax, 0x8000000000
jmp 0x14001b0a2
mov edx, r12d
mov byte [rdi], 0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001af12
inc rax
jmp 0x14001af15
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
movabs rax, 0x8000000000
mov rdi, rbx
and rdi, rax
jne 0x14001afd1
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001af52
inc rax
jmp 0x14001af55
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
bt rbx, 0x25
jae 0x14001afd1
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001af83
inc rax
jmp 0x14001af86
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
mov rax, rbx
shr rax, 0x20
and al, 0x1f
cmp al, 1
jne 0x14001afd1
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001afba
inc rax
jmp 0x14001afbd
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
cmp ebx, 3
je 0x14001aee4
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001afed
inc rax
jmp 0x14001aff0
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
test rdi, rdi
jne 0x14001b09f
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b020
inc rax
jmp 0x14001b023
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
bt rbx, 0x25
jae 0x14001b09f
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b051
inc rax
jmp 0x14001b054
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
mov rax, rbx
shr rax, 0x20
and al, 0x1f
cmp al, 1
jne 0x14001b09f
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b088
inc rax
jmp 0x14001b08b
mov rax, rbp
mov rdx, rax
mov rcx, r13
call fcn.140007964
cmp ebx, 2
je 0x14001aee4
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret