Function at 0x140010210
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
mov rax, qword [0x14008b020]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov qword [rsp + 0x78], r9
mov r12, r8
mov rdi, rdx
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x50], ebx
call qword [sym.imp.PsfRuntime64.dll_PSFQueryStartScriptInfo]
mov rsi, rax
call qword [sym.imp.PsfRuntime64.dll_PSFQueryEndScriptInfo]
mov r15, rax
test rsi, rsi
jne 0x140010271
test rax, rax
je 0x1400103ba
mov qword [rsp + 0x58], rbx
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x1400102a5
mov byte [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x74], eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftPowerShell1
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, 2
jne 0x140010300
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400102f9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001038d
test eax, eax
jne 0x140010c2a
mov dword [rsp + 0x68], ebx
mov dword [rbp - 0x80], 4
mov dword [rsp + 0x60], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.Install
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, eax
mov rcx, qword [rbp + 0x248]
lea rax, str.Error_with_querying_the_key_to_see_if_PowerShell_is_installed.
mov qword [rsp + 0x20], rax
lea r8, str.C:ReleaseAI_toolsmsix_psfPsfLauncherPsfPowershellScriptRunner.h
mov edx, 0x1dd
call fcn.14000fa70
cmp dword [rsp + 0x68], 1
je 0x14001037b
jmp 0x1400102e9
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001038b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x248]
lea rdx, str.PowerShell_is_not_installed.__Please_install_PowerShell_to_run_scripts_in_PSF
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x20], al
mov r9d, 0x32
lea r8, str.C:ReleaseAI_toolsmsix_psfPsfLauncherPsfPowershellScriptRunner.h
lea edx, [r9 - 0x15]
call fcn.14000fab0
xor r14b, r14b
mov rax, qword [rdi]
lea rdx, str.stopOnScriptError
mov rcx, rdi
call qword [rax + 0x38]
test rax, rax
jne 0x1400103ec
test rsi, rsi
je 0x140010401
mov rax, qword [rsi]
lea rdx, str.stopOnScriptError
mov rcx, rsi
call qword [rax + 0x38]
test rax, rax
je 0x140010401
mov rcx, rax
call fcn.14000d310
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x38]
movzx r14d, al
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
xor r8d, r8d
lea rdx, [0x140072ee0]
lea rcx, [rbp + 8]
call fcn.140004560
nop
mov rax, qword [rdi]
lea rdx, str.scriptExecutionMode
mov rcx, rdi
call qword [rax + 0x38]
test rax, rax
je 0x140010497
mov rcx, rax
call fcn.14000d1e0
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rax
call r8
mov edx, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x20]
cmp rdx, rcx
ja 0x14001048b
lea rdi, [rbp + 8]
cmp rcx, 8
cmovae rdi, qword [rbp + 8]
mov qword [rbp + 0x18], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14003f3a0
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x140010497
mov r9, rax
lea rcx, [rbp + 8]
call fcn.14001cf70
lea rax, [rbp + 0x68]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xor edi, edi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x80], rdi
lea r8d, [rdi + 0x2e]
lea rdx, str.LocalCacheLocalMicrosoftWritablePackageRoot
lea rcx, [rbp + 0x68]
call fcn.140004560
mov ebx, 2
mov dword [rsp + 0x50], ebx
and ebx, 0xfffffffd
mov dword [rsp + 0x50], ebx
or ebx, 1
mov dword [rsp + 0x50], ebx
and ebx, 0xfffffffe
mov dword [rsp + 0x50], ebx
mov rdx, qword [sym.imp.KERNEL32.dll_GetCurrentPackageFamilyName]
lea rcx, [rbp + 0x88]
call fcn.14000d6b0
or ebx, 4
mov dword [rsp + 0x50], ebx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
movups xmm0, xmmword [rbp + 0x88]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rbp + 0x98]
movups xmmword [rbp + 0xb8], xmm1
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], di
lea rax, [rbp + 0x48]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], rdi
lea r8d, [rdi + 8]
lea rdx, str.Packages
lea rcx, [rbp + 0x48]
call fcn.140004560
or ebx, 0x10
mov dword [rsp + 0x50], ebx
and ebx, 0xffffffef
mov dword [rsp + 0x50], ebx
or ebx, 8
mov dword [rsp + 0x50], ebx
and ebx, 0xfffffff7
mov dword [rsp + 0x50], ebx
lea rcx, [rbp + 0x128]
call fcn.140010010
nop
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140003f50
nop
or ebx, 0x20
mov dword [rsp + 0x50], ebx
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xe8]
call fcn.14000bf10
nop
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0xc8]
call fcn.140003f50
nop
or ebx, 0x40
mov dword [rsp + 0x50], ebx
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.14000bf10
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x108]
call fcn.14000c3b0
nop
and ebx, 0xffffffbf
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x14001064e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010649
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c63
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], di
and ebx, 0xffffffdf
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0x100]
cmp rdx, 8
jb 0x1400106b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c69
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0xf8], xmm0
mov word [rbp + 0xe8], di
mov rdx, qword [rbp + 0x140]
cmp rdx, 8
jb 0x14001070f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001070a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c6f
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x138], xmm0
mov word [rbp + 0x128], di
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x140010766
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c75
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], di
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x1400107bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c7b
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], di
and ebx, 0xfffffffb
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x140010821
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001081c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c81
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], di
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x14001087b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010876
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c87
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0x68], di
test rsi, rsi
je 0x140010a1a
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x28]
call fcn.140003f50
nop
mov rax, qword [rsi]
lea rdx, str.scriptExecutionMode
mov rcx, rsi
call qword [rax + 0x38]
test rax, rax
je 0x140010918
mov rcx, rax
call fcn.14000d1e0
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rax
call r8
mov edx, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x40]
cmp rdx, rcx
ja 0x14001090c
lea rdi, [rbp + 0x28]
cmp rcx, 8
cmovae rdi, qword [rbp + 0x28]
mov qword [rbp + 0x38], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14003f3a0
xor eax, eax
mov word [rdi + rbx], ax
xor edi, edi
jmp 0x140010918
mov r9, rax
lea rcx, [rbp + 0x28]
call fcn.14001cf70
lea rax, [rbp - 0x78]
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x78]
call fcn.140003f50
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x58]
call fcn.140003f50
nop
lea rax, [rbp - 0x38]
mov qword [rsp + 0x60], rax
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.140003f50
nop
lea rax, [rbp - 0x18]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x18]
call fcn.140003f50
nop
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
movzx r9d, r14b
mov r8, rsi
lea rdx, [rbp + 0x150]
call fcn.140010ed0
nop
mov rdx, rax
mov rcx, r13
call fcn.140012c70
nop
lea rcx, [rbp + 0x150]
call fcn.140012ae0
mov byte [r13 + 0x90], 1
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140010a0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c8d
call fcn.14003d1f0
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], di
test r15, r15
je 0x140010b58
mov rax, qword [r15]
lea rdx, str.scriptExecutionMode
mov rcx, r15
call qword [rax + 0x38]
test rax, rax
je 0x140010a98
mov rcx, rax
call fcn.14000d1e0
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rax
call r8
mov edx, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x20]
cmp rdx, rcx
ja 0x140010a8c
lea rdi, [rbp + 8]
cmp rcx, 8
cmovae rdi, qword [rbp + 8]
mov qword [rbp + 0x18], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14003f3a0
xor eax, eax
mov word [rdi + rbx], ax
xor edi, edi
jmp 0x140010a98
mov r9, rax
lea rcx, [rbp + 8]
call fcn.14001cf70
lea rax, [rbp - 0x38]
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x38]
call fcn.140003f50
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x58]
call fcn.140003f50
nop
lea rax, [rbp - 0x78]
mov qword [rsp + 0x78], rax
mov rdx, r12
lea rcx, [rbp - 0x78]
call fcn.140003f50
nop
lea rax, [rbp - 0x18]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x18]
call fcn.140003f50
nop
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r15
lea rdx, [rbp + 0x150]
call fcn.140010ed0
nop
lea rcx, [r13 + 0x98]
mov rdx, rax
call fcn.140012c70
nop
lea rcx, [rbp + 0x150]
call fcn.140012ae0
mov byte [r13 + 0x128], 1
mov word [r13 + 0xe4], 1
mov rdx, qword [rbp + 0x120]
cmp rdx, 8
jb 0x140010b9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c93
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x118], xmm0
mov word [rbp + 0x108], di
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x140010bf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010bec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c24
call fcn.14003d1f0
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], 7
mov word [rbp + 8], di
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.14003d1d0
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14004930c
nop
jle 0x140010c34
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.14001bd90
mov r9d, eax
mov rcx, qword [rbp + 0x248]
lea rax, str.Error_with_getting_the_key_to_see_if_PowerShell_is_installed.
mov qword [rsp + 0x20], rax
lea r8, str.C:ReleaseAI_toolsmsix_psfPsfLauncherPsfPowershellScriptRunner.h
mov edx, 0x1d6
call fcn.14000fa40
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
int3
call fcn.14004930c
nop
call fcn.14004930c
int3