Function at 0x14011cc80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov byte [rbp - 0x29], bl
lea rcx, [rbp - 0x29]
call fcn.14012fa70
test al, al
je 0x14011ce7c
cmp byte [rbp - 0x29], bl
jne 0x14011ce7c
mov qword [rbp - 0x11], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x11]
lea edx, [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14011ce7c
mov qword [rbp - 1], rbx
mov esi, ebx
cmp qword [rbp - 0x11], 0xffffffffffffffff
cmovne rsi, qword [rbp - 0x11]
mov qword [rbp - 1], rsi
mov qword [rbp - 0x21], rbx
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwarePoliciesWeType_ProjectWeTypePreferences
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14011cd9b
mov dword [rbp - 0x25], ebx
mov dword [rbp - 0x15], 4
mov dword [rbp - 0x19], ebx
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x25]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.elevated_process_disabled
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14011cd9b
cmp dword [rbp - 0x19], 4
jne 0x14011cd9b
cmp dword [rbp - 0x15], 4
jne 0x14011cd9b
cmp dword [rbp - 0x25], edi
seta al
test al, al
je 0x14011cd9b
mov rcx, rsi
call fcn.14011cbd0
test al, al
jne 0x14011cdcc
mov qword [rbp - 9], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rbp - 9]
mov edx, 8
lea r8d, [rdx - 7]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14011cdd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x14011cdd7
mov r14d, 2
jmp 0x14011ce65
mov qword [rbp - 0x21], rbx
mov rdi, rbx
cmp qword [rbp - 9], 0xffffffffffffffff
cmovne rdi, qword [rbp - 9]
mov qword [rbp - 0x21], rdi
test rdi, rdi
je 0x14011ce50
mov dword [rbp - 0x25], ebx
lea rax, [rbp - 0x25]
mov qword [rsp + 0x20], rax
mov r9d, 0x38
lea r8, [rbp + 0xf]
lea edx, [r9 - 0x2e]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14011ce42
mov eax, dword [rbp + 0x1b]
mov ecx, dword [rbp + 0x17]
cmp ecx, 0x3e7
jne 0x14011ce2a
test eax, eax
je 0x14011ce42
cmp ecx, 0x3e5
jne 0x14011ce36
test eax, eax
je 0x14011ce42
cmp ecx, 0x3e4
jne 0x14011ce50
test eax, eax
jne 0x14011ce50
mov r14d, 2
jmp 0x14011ce53
mov r14d, ebx
test rdi, rdi
je 0x14011ce65
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x21], rbx
test rsi, rsi
je 0x14011ce77
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 1], rbx
mov eax, r14d
jmp 0x14011ce81
mov eax, 2
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140398000
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret