Function at 0x14018bb40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor ebx, ebx
lea eax, [rdx - 1]
mov qword [r8], rbx
mov r14, r8
cmp eax, 1
jbe 0x14018bba1
mov ebx, 0x80070057
mov edx, 0x4c9
mov rcx, qword [rbp + 0x188]
lea r8, str.pcshell_shellexplorerclockbutton.cpp
mov r9d, ebx
call fcn.14001eb0c
jmp 0x14018bd8d
mov r9d, edx
lea r8, str.Control_PanelTimeDateAdditionalClocks_u
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.14002e4b8
mov edi, eax
test eax, eax
jns 0x14018bbe2
mov rcx, qword [rbp + 0x188]
lea r8, str.pcshell_shellexplorerclockbutton.cpp
mov r9d, eax
mov edx, 0x4cd
call fcn.14001eb0c
mov eax, edi
jmp 0x14018bd8f
mov r15d, reloc.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_292
lea rdx, [0x14037db18]
mov ecx, r15d
call fcn.1400a294c
mov rsi, rax
test rax, rax
je 0x14018bc0e
mov r8d, r15d
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x14018bc11
mov rsi, rbx
test rsi, rsi
jne 0x14018bc25
mov ebx, 0x8007000e
mov edx, 0x4d1
jmp 0x14018bb86
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movsxd rdi, eax
test eax, eax
jne 0x14018bd5d
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.Enable
lea rax, [rsp + 0x44]
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x28], rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
movsxd rdi, eax
test eax, eax
jne 0x14018bd47
cmp dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, str.DisplayName
setne al
mov dword [rsp + 0x40], 0x20
mov byte [rsi], al
mov r9d, 2
mov rcx, qword [rsp + 0x48]
lea rax, [rsi + 2]
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
movsxd rdi, eax
test eax, eax
je 0x14018bd04
cmp rdi, 0xea
jne 0x14018bd47
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x102
mov qword [rsp + 0x30], rcx
lea rax, [rsi + 0x22]
mov rcx, qword [rsp + 0x48]
lea r8, str.TzRegKeyName
mov qword [rsp + 0x28], rax
mov r9d, 2
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
movsxd rdi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test rdi, rdi
je 0x14018bd8a
cmp rdi, 0xea
je 0x14018bd8a
mov rdx, r15
mov rcx, rsi
call fcn.1400a290c
cmp rdi, 2
je 0x14018bd8d
test edi, edi
jg 0x14018bd7f
mov ebx, edi
jmp 0x14018bd8d
movzx ebx, di
or ebx, 0x80070000
jmp 0x14018bd8d
mov qword [r14], rsi
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400a2260
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret