Function at 0x140012dc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400390f8]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov dword [rbp - 0x44], r14d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThread]
mov qword [0x140047e50], rax
call fcn.14000fe70
xor r9d, r9d
lea edx, [r14 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x48], r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
lea ebx, [r14 + 4]
test eax, eax
je 0x14001d0c4
lea rax, [rbp - 0x4c]
mov byte [0x140039968], 1
lea rdx, [0x140039940]
mov qword [0x140039960], rax
call fcn.140013eb0
movzx ecx, byte [0x140039968]
cmp eax, 1
cmove ecx, r14d
mov byte [0x140039968], cl
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
lea r12, [0x14003fbb0]
mov dword [0x14003fbc4], eax
mov rdx, r12
mov ecx, eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
test eax, eax
je 0x14001d101
mov bl, byte [0x14003fbb6]
lea rdi, [0x140054540]
xor edx, edx
mov rcx, rdi
mov r8d, 0x100
call sub.msvcrt.dll_memset
mov edx, r14d
test bl, bl
jne 0x14001d15f
xor edx, edx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x50], r14d
call fcn.14000b110
cmp dword [rbp - 0x48], 1
je 0x14001d19f
mov edi, 0xff
test eax, eax
je 0x14001d1e4
lea rcx, [0x140047c50]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ecx, dword [0x1400502bc]
mov ebx, dword [rbp - 0x50]
test eax, eax
jne 0x14001d1bd
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x140012f79
mov esi, r14d
movsxd rax, esi
mov rdx, qword [rbp + rax*8 - 0x28]
test rdx, rdx
jne 0x140012f89
inc esi
cmp esi, 3
jl 0x140012f3e
call fcn.14000fef0
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003fbc4], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.14000fe70
mov ecx, dword [0x1400502bc]
test ecx, ecx
je 0x14001d1dd
mov ecx, ebx
call fcn.140013fe4
int3
mov r8d, dword [0x1400502d0]
mov ecx, 1
call fcn.14000dcb0
cmp rax, 1
je 0x14001d1d2
xor ecx, ecx
cmp rax, 0xffffffffffffffff
je 0x140012fbe
mov rdx, rax
call fcn.1400106c0
test eax, eax
cmovne ebx, eax
mov dword [rbp - 0x50], ebx
jmp 0x140012f4b
call fcn.140013fe4
int3
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400320a8]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
jmp 0x140012e61
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetThreadLocale]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x14001d12e
mov bl, 0x81
mov dword [0x14003fbb6], 0xfce09f81
mov word [0x14003fbba], r14w
jmp 0x140012ebf
cmp ax, bx
je 0x14001d14e
cmp ax, 0x12
je 0x14001d14e
mov bl, r14b
mov byte [0x14003fbb7], r14b
mov byte [0x14003fbb6], bl
jmp 0x140012ebf
mov bl, 0x81
mov dword [0x14003fbb6], 0xfe81
jmp 0x140012ebf
mov r8d, r14d
lea eax, [rdx + 1]
mov r9b, byte [rax + r12 + 6]
test r9b, r9b
je 0x140012ee1
mov eax, r8d
movzx r8d, r9b
movzx ecx, byte [rax + r12 + 6]
jmp 0x14001d188
mov byte [rcx + rdi], 1
inc ecx
cmp ecx, r8d
jbe 0x14001d182
add edx, 2
mov r8d, edx
cmp byte [rdx + r12 + 6], r14b
jne 0x14001d162
jmp 0x140012ee1
xor edx, edx
mov ecx, 0x40002729
call fcn.140015a74
xor ecx, ecx
call fcn.140024a80
mov ecx, 0xff
call fcn.140013fe4
int3
test ecx, ecx
mov eax, 1
mov dword [rbp - 0x44], eax
cmovne ebx, edi
mov dword [rbp - 0x50], ebx
jmp 0x140012f37
mov ecx, 1
call fcn.140013fe4
int3
mov dword [0x140054690], r14d
lea rcx, [0x140047c50]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
mov ebx, 2
mov dword [rbp - 0x50], eax
cmp eax, ebx
jne 0x14001d207
xor ecx, ecx
call fcn.140013fe4
int3
cmp dword [rbp - 0x48], ebx
jne 0x14001d227
xor edx, edx
mov ecx, 0x40002729
call fcn.140015a74
xor ecx, ecx
call fcn.140024a80
mov ecx, edi
call fcn.140013fe4
int3
xor ecx, ecx
call fcn.14000f518
test eax, eax
jne 0x14001d242
mov edx, 0x8000
lea ebx, [rax + 3]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__setmode]
xor ecx, ecx
call fcn.140009300
mov byte [0x140039890], r14b
call fcn.14000aa60
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call fcn.14000dcb0
mov rdi, rax
cmp rax, 1
je 0x14001d249
cmp rax, 0xffffffffffffffff
je 0x14001d2c5
call fcn.14000aa60
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003fbc4], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.14000fe70
mov rdx, rdi
xor ecx, ecx
call fcn.1400106c0
mov byte [0x1400398a4], r14b
call fcn.14000fef0
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
mov ecx, eax
mov dword [0x14003fbc4], eax
mov rdx, r12
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.14000fe70
jmp 0x14001d249
xor ecx, ecx
call fcn.140013fe4
int3