Function at 0x14000bd98
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1400363c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
jne 0x14000bdf0
lea edx, [rcx + 0xe]
mov rcx, qword [rsp + 0x2b8]
lea r8, str.onecoreenduserupgradeenablersqualityupdateassistantqualauncherqualauncher.cpp
mov ebx, 0x80070057
mov r9d, ebx
call fcn.140006f80
jmp 0x14000bff3
test rbp, rbp
jne 0x14000bdfa
lea edx, [rbp + 0xf]
jmp 0x14000bdcf
lea rdx, [0x140026878]
add rcx, 8
call fcn.1400105a0
lea rdx, str.QualityRemediation
lea rcx, [rsi + 0x10]
call fcn.1400105a0
lea rdx, str.QualityRemediationShell
lea rcx, [rsi + 0x18]
call fcn.1400105a0
lea r13, [rsi + 0x20]
mov rcx, r13
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionqua_settings
call fcn.1400105a0
mov rcx, rsi
mov qword [rsi + 0x70], 0xffffffff80000002
call fcn.1400132c4
mov ebx, eax
test eax, eax
js 0x14000bfcb
xor edi, edi
lea ebx, [rdi + 1]
cmp dword [0x140036bd8], ebx
je 0x14000bf06
cmp qword [rsi + 8], rdi
je 0x14000bfaf
xor r14d, r14d
cmp qword [rsi + 0x10], r14
je 0x14000bfaf
cmp qword [rsi + 0x18], r14
je 0x14000bfaf
mov rcx, qword [rsi + 0x70]
lea rax, [rcx + 0x7fffffff]
cmp rax, rbx
ja 0x14000bfaf
mov rdx, qword [r13]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x58], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x14000bee5
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000bef5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [0x140036bd8]
test edi, edi
cmovns eax, ebx
mov dword [0x140036bd8], eax
mov ebx, edi
test edi, edi
js 0x14000bfcb
mov r14d, 0x208
lea rcx, [rsp + 0x60]
mov r8d, r14d
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rdx, qword [r13]
lea rax, [rsp + 0x50]
mov rcx, qword [rsi + 0x70]
lea r8, str.Endpoint
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], r14d
xor r14d, r14d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 2]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x14000bf80
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000bf6c
lea rdx, [rsp + 0x60]
test rax, rax
jne 0x14000bf87
lea rdx, str.settings_win.data.microsoft.com
mov rcx, rsi
call fcn.1400105a0
test edi, edi
js 0x14000bfcb
mov rcx, rsi
call fcn.140011728
mov ebx, eax
test eax, eax
jns 0x14000bfb8
lea rax, str.OneSettings_Query___failed
mov edx, 0x13
jmp 0x14000bfd7
mov ebx, 0x80070057
mov edi, ebx
jmp 0x14000bf8f
lea rdx, [rsi + 0xa0]
mov rcx, rbp
call fcn.1400180a4
xor eax, eax
jmp 0x14000bff5
lea rax, str.Onesettings_Initialize___failed
mov edx, 0x11
mov rcx, qword [rsp + 0x2b8]
lea r8, str.onecoreenduserupgradeenablersqualityupdateassistantqualauncherqualauncher.cpp
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000b498
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001f510
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret