Function at 0x140007cb4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa8
xor esi, esi
mov rax, rcx
mov dword [rbp - 0x29], esi
mov r12d, esi
mov dword [rbp + 0x7f], esi
mov r14d, esi
mov dword [rbp - 0x21], esi
mov dword [rbp - 0x25], esi
mov dword [rdx], esi
mov qword [r8], rsi
test rcx, rcx
jne 0x140007d02
mov ebx, esi
jmp 0x14000808d
mov qword [rsp + 0x58], rsi
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x50], rsi
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rbp + 0x7f]
xor edx, edx
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140007d9e
jle 0x140007d5e
movzx ebx, ax
or ebx, 0xc0070000
lea rsi, [0x14000cd10]
mov r8d, ebx
mov qword [rsp + 0x30], rsi
lea rax, str.RegQueryInfoKey
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1f0
mov ecx, 1
lea r9, str.onecoreds_securityeaspolicyenginecommon.cpp
lea rdx, str._0x_08x___ws:_u_:__ws:_ws_n
call fcn.140006ac0
jmp 0x14000808d
mov eax, dword [rbp - 0x29]
test eax, eax
je 0x140007cfb
mov edx, eax
xor ecx, ecx
shl rdx, 5
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x140007df0
lea rsi, [0x14000cd10]
mov r8d, 0xc0000017
mov qword [rsp + 0x30], rsi
lea rcx, [0x14000c7d0]
mov qword [rsp + 0x28], rcx
mov ebx, r8d
mov dword [rsp + 0x20], 0x1fe
jmp 0x140007d81
mov eax, dword [rbp + 0x7f]
mov edi, 1
add eax, edi
mov edx, eax
add rdx, rdx
mov dword [rbp + 0x7f], eax
lea ebx, [rdi + 0x3f]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x140007e4b
lea rcx, [0x14000c7d0]
mov r8d, 0xc0000017
lea rsi, [0x14000cd10]
mov ebx, r8d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
mov ecx, edi
mov dword [rsp + 0x20], 0x207
jmp 0x140007d86
mov edx, dword [rbp - 0x21]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
jne 0x140007ea7
lea rsi, [0x14000cd10]
mov r8d, 0xc0000017
mov qword [rsp + 0x30], rsi
lea rcx, [0x14000c7d0]
mov qword [rsp + 0x28], rcx
mov ebx, r8d
mov dword [rsp + 0x20], 0x20f
lea r9, str.onecoreds_securityeaspolicyenginecommon.cpp
mov ecx, edi
lea rdx, str._0x_08x___ws:_u_:__ws:_ws_n
call fcn.140006ac0
jmp 0x14000806a
mov ecx, esi
mov dword [rbp - 0x15], ecx
cmp dword [rbp - 0x29], esi
jbe 0x140008057
lea rsi, [0x14000cd10]
xor edx, edx
mov eax, dword [rbp + 0x7f]
lea r9, [rbp - 0x1d]
mov dword [rbp - 0x1d], eax
mov r8, r15
mov eax, dword [rbp - 0x21]
mov dword [rbp - 0x19], eax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov word [rbp - 9], dx
mov edx, ecx
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x1400080e6
mov eax, dword [rbp - 0x1d]
mov word [r15 + rax*2], cx
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
xor edx, edx
mov dword [rbp - 0xd], eax
mov ecx, eax
test eax, eax
jg 0x140007f6c
lea rax, str.Invalid_policy_id
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r9, str.onecoreds_securityeaspolicyenginecommon.cpp
mov r8d, 0xc000000d
mov dword [rsp + 0x20], 0x230
lea rdx, str._0x_08x___ws:_u_:__ws:_ws_n
mov ecx, edi
call fcn.140006ac0
xor edx, edx
jmp 0x140008044
cmp dword [rbp - 0x19], edx
je 0x140007fc7
cmp dword [rbp - 0x11], 4
je 0x140007fb7
mov ecx, 0x80070057
mov qword [rsp + 0x30], rsi
lea rax, str.invalid_type
mov r12d, ecx
mov r8d, ecx
mov qword [rsp + 0x28], rax
mov ecx, edi
mov dword [rsp + 0x20], 0x1b1
lea r9, str.onecoreds_securityeaspolicyenginecommon.cpp
lea rdx, str._0x_08x___ws:_u_:__ws:_ws_n
call fcn.140006ac0
mov ecx, dword [rbp - 0xd]
xor edx, edx
jmp 0x140007fca
mov eax, 0x13
mov word [rbp - 9], ax
mov eax, dword [r13]
mov dword [rbp - 1], eax
mov r12d, edx
mov eax, r12d
mov ebx, edx
bts eax, 0x1e
test r12d, r12d
cmovne ebx, eax
cmp ebx, 0xc0070057
je 0x140008040
test ebx, ebx
jne 0x1400080af
cmp ecx, 5
je 0x140007ff3
cmp ecx, 8
jne 0x14000800e
mov eax, 0xb
mov word [rbp - 9], ax
cmp dword [rbp - 1], edx
je 0x14000800a
or eax, 0xffffffff
mov word [rbp - 1], ax
jmp 0x14000800e
mov word [rbp - 1], dx
mov r12d, dword [rbp - 0x25]
movups xmm0, xmmword [rbp - 9]
mov eax, r12d
mov word [rbp - 9], dx
movsd xmm1, qword [rbp + 7]
shl rax, 5
add r12d, edi
mov dword [rbp - 0x25], r12d
movups xmmword [rax + r14 + 8], xmm0
mov dword [rax + r14], ecx
movsd qword [rax + r14 + 0x18], xmm1
jmp 0x140008044
mov r12d, dword [rbp - 0x25]
mov ecx, dword [rbp - 0x15]
add ecx, edi
mov dword [rbp - 0x15], ecx
cmp ecx, dword [rbp - 0x29]
jb 0x140007ebe
xor esi, esi
mov rax, qword [rbp + 0x6f]
mov ebx, esi
mov dword [rax], r12d
mov rax, qword [rbp + 0x77]
mov qword [rax], r14
mov r14, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test r13, r13
je 0x14000808d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rdx, r14
mov ecx, r12d
call fcn.1400076d8
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, str._RegValueToVariant
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r9, str.onecoreds_securityeaspolicyenginecommon.cpp
mov r8d, ebx
mov dword [rsp + 0x20], 0x23e
lea rdx, str._0x_08x___ws:_u_:__ws:_ws_n
mov ecx, edi
call fcn.140006ac0
mov r12d, dword [rbp - 0x25]
jmp 0x14000806a
jle 0x1400080f1
movzx ebx, ax
or ebx, 0xc0070000
mov qword [rsp + 0x30], rsi
lea rax, str.RegEnumValue
mov qword [rsp + 0x28], rax
mov r8d, ebx
mov dword [rsp + 0x20], 0x228
jmp 0x140007e8d