Function at 0x1400016f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor r9d, r9d
mov ebx, ecx
xor r8d, r8d
lea r14d, [r9 + 1]
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rdx, [0x140001128]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_setlocale]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
lea r8, [0x140001130]
lea edx, [r14 + 0x40]
lea rcx, [rbp + 0x70]
mov r9d, eax
call qword [sym.imp.msvcrt.dll_swprintf_s]
lea rdx, [rbp + 0x70]
lea ecx, [r14 + 1]
call qword [sym.imp.msvcrt.dll__wsetlocale]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
mov ecx, ebx
call fcn.1400024ec
xor esi, esi
test rax, rax
jne 0x140001798
mov ecx, 0x64
call fcn.140001ff0
mov eax, r14d
jmp 0x140001a16
lea rdx, [rax + 8]
lea ecx, [rbx - 1]
call fcn.140002854
cmp word [0x140005690], si
movzx ebx, ax
jne 0x140001a0d
test ebx, ebx
jne 0x1400019fb
mov edi, 0x11c
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, edi
call sub.msvcrt.dll_memset
lea eax, [rdi - 0xc]
lea edx, [rbx + 0x40]
mov r8b, 7
xor ecx, ecx
mov word [rbp + 0x68], ax
mov dword [rsp + 0x50], edi
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x50]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140001803
lea ecx, [rbx + 0x6e]
jmp 0x14000178b
cmp word [0x1400056a4], si
jne 0x140001815
cmp word [0x14000569c], si
je 0x140001845
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400019f1
test byte [rbp + 0x68], 0x10
je 0x1400019f1
mov eax, 0x100
test word [rbp + 0x68], ax
jne 0x1400019f1
mov edx, 0x1674
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140001786
mov rcx, rax
call qword [sym.imp.REGAPI.dll_RegGetMachinePolicyNew]
test dword [rdi], 0x2000
je 0x140001898
test dword [rdi + 4], 0x100000
mov ecx, 0x6f
jne 0x140001885
mov ecx, 0x70
call fcn.140001ff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001790
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp word [0x1400056a4], si
je 0x1400018c6
mov ecx, 2
call fcn.140001aa8
test eax, eax
je 0x140001914
lea r8, [0x140001138]
call fcn.140001b44
jmp 0x14000190d
cmp word [0x14000569c], si
je 0x1400018d4
mov ecx, r14d
jmp 0x1400018af
cmp word [0x1400056a0], si
je 0x1400018ed
lea r8, [0x140001184]
call fcn.140001b44
mov ebx, eax
jmp 0x140001916
cmp word [0x140005698], si
je 0x140001916
lea r8, [0x140001138]
call fcn.140001b44
test eax, eax
je 0x140001914
xor ecx, ecx
call fcn.140001aa8
mov ebx, r14d
test eax, eax
jne 0x140001916
mov ebx, esi
cmp word [0x140005694], si
jne 0x14000192e
cmp ebx, r14d
je 0x14000192e
mov ecx, 0x6d
jmp 0x1400019ea
call fcn.140001ce0
test eax, eax
jne 0x1400019e5
lea rax, [rsp + 0x38]
lea rdx, [0x140001190]
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400019b4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x1400011f8]
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400019b0
cmp dword [rsp + 0x34], 4
je 0x1400019b4
mov dword [rsp + 0x30], esi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400019c4
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400019de
dec eax
je 0x1400019d7
mov ecx, 0x83
jmp 0x1400019ea
mov ecx, 0x85
jmp 0x1400019ea
mov ecx, 0x6c
jmp 0x1400019ea
mov ecx, 0x6b
call fcn.140001ff0
jmp 0x140001a14
mov ecx, 0x86
jmp 0x14000178b
test bl, 8
jne 0x140001a0d
mov cl, r14b
call fcn.140001a44
jmp 0x140001790
xor ecx, ecx
call fcn.140001a44
xor eax, eax
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140003d00
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret