Function at 0x140091e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
add rcx, 0x40
mov r8b, 1
movzx edx, r8b
call fcn.140091620
mov edx, 0x65
mov rcx, qword [rdi + 8]
call fcn.140024b50
mov edx, 0x414
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call fcn.14007e990
mov edx, 0x414
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call fcn.1400806f0
mov rsi, rax
mov rbx, qword [0x14013c8d0]
mov rcx, rax
call fcn.140080ba0
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call fcn.1400811d0
mov edx, 0x403
mov r9d, gethostbyaddr
lea r8d, [r9 - 0x2f]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call fcn.1400811d0
mov edx, 0x403
mov r9d, 0xf4240
mov r8d, 2
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, gethostbyaddr
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, gethostbyaddr
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8d, 0xff
mov edx, ebx
mov ecx, eax
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rbx, rax
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov edx, 0x77
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_LoadIconW]
mov r8, rax
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov r8d, 1
mov edx, eax
mov rcx, rbx
call qword [sym.imp.COMCTL32.dll_ImageList_SetOverlayImage]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140084740
lea r8, str.ProcessTreeDialog
mov rdx, qword [0x1401430d8]
mov rcx, qword [rdi + 8]
call fcn.14009c830
xor ebx, ebx
mov qword [rsp + 0x48], rbx
lea rcx, [0x140143550]
call fcn.1400b0850
test eax, eax
je 0x140092013
lea rcx, str.Process_Tree__
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Process_Tree__
call fcn.1400b0780
mov qword [rsp + 0x38], rax
lea r8, [0x140143550]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400b0290
nop
mov rcx, rax
call fcn.1400b0200
mov rdx, rax
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140092011
call fcn.1400b0810
nop
jmp 0x14009204b
lea rcx, [0x140109ef8]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x140109ef8]
call fcn.1400b0780
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.1400b0200
mov rdx, rax
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009205b
call fcn.1400b0810
nop
mov r8d, 9
lea rdx, str.Process
mov rcx, rsi
call fcn.140081c70
lea r8, str.ProcessTreeColumns
mov rdx, qword [0x1401430d8]
mov rcx, rsi
call fcn.140084250
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProcessTree.ShowRunningOnly
mov rcx, qword [0x1401430d8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProcessTree.ShowAllHistory
mov rcx, qword [0x1401430d8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, ebx
cmp byte [rsp + 0x60], r8b
setne r8b
mov edx, 0x44b
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_CheckDlgButton]
cmp byte [rsp + 0x30], 0
sete bl
mov r8d, ebx
mov edx, 0x44c
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_CheckDlgButton]
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x44b
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret