Function at 0x18005b0a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x47]
sub rsp, 0x90
mov r13, r8
mov rsi, rdx
mov rdi, rcx
lea rdx, str.Microsoft.Windows.Cortana_cw5n1h2txyewy_CortanaUI
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
xor r12d, r12d
test eax, eax
je 0x18005b518
cmp byte [0x180084144], r12b
jne 0x18005b181
mov byte [0x180084144], 1
mov dword [rbp + 0x67], r12d
mov dword [rbp - 0x31], 4
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 0x10]
lea r8, str.SearchAppIdentityOverride
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x18005b181
mov edx, dword [rbp + 0x67]
lea eax, [rdx - 1]
mov ecx, 0xfffffffd
test ecx, eax
je 0x18005b167
mov eax, edx
and eax, ecx
neg eax
sbb ecx, ecx
and ecx, 2
jmp 0x18005b16c
mov ecx, 1
mov dword [0x180084140], ecx
lea eax, [rdx - 2]
cmp eax, 2
seta byte [0x180084144]
jmp 0x18005b187
mov ecx, dword [0x180084140]
test ecx, ecx
je 0x18005b1a2
cmp ecx, 1
je 0x18005b199
lea rax, str.Microsoft.Cortana_8wekyb3d8bbwe_CortanaUI
jmp 0x18005b1a9
lea rax, str.Microsoft.Search_8wekyb3d8bbwe_CortanaUI
jmp 0x18005b1a9
lea rax, str.Microsoft.Windows.Search_cw5n1h2txyewy_CortanaUI
mov rcx, rdi
sub rax, rdi
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x18005b1c5
add rcx, 2
test r8d, r8d
jne 0x18005b1af
test edx, edx
je 0x18005b518
mov qword [rbp - 0x11], r12
mov dword [rbp - 9], r12d
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov eax, dword [rbp + 0x7f]
mov dword [rbp - 5], eax
mov r14, qword [rbp + 0x6f]
mov qword [rbp + 0x17], r14
mov qword [rbp - 0x19], r12
mov rax, r14
mov qword [rbp - 0x31], rax
mov rbx, r12
lea rdx, [rbp - 0x19]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_IUnknown_GetWindow]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
jns 0x18005b25a
lea r8, [rbp - 0x31]
lea rdx, [0x18006e9b0]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.SHCORE.dll_IUnknown_GetSite]
nop dword [rax + rax]
test eax, eax
js 0x18005b25a
mov rax, qword [rbp - 0x31]
mov r12, rax
test rbx, rbx
je 0x18005b252
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
mov rax, qword [rbp - 0x31]
mov rbx, r12
xor r12d, r12d
jmp 0x18005b25e
mov rax, qword [rbp - 0x31]
test rax, rax
je 0x18005b268
test r15d, r15d
js 0x18005b1f9
test rbx, rbx
je 0x18005b27d
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x67], r12
lea r9, [rbp + 0x67]
lea r8, [0x180070900]
lea rdx, [0x180070ba0]
mov rcx, r14
call qword [sym.imp.SHCORE.dll_IUnknown_QueryService]
nop dword [rax + rax]
test eax, eax
js 0x18005b306
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
lea rdx, [rbp - 9]
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
lea rdx, [rbp - 1]
mov rax, qword [rax + 0x20]
call qword [case.0x18004bf34.0]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
lea r8, [rbp + 0xf]
lea rdx, [rbp + 3]
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
lea rdx, [rbp + 7]
mov rax, qword [rax + 0x30]
call qword [case.0x18004bf34.0]
mov qword [rbp - 0x21], r12
lea rcx, [rbp - 0x21]
call fcn.180009204
mov qword [rsp + 0x20], rax
lea r9, [0x18006ee68]
xor edx, edx
mov r8d, 0x404
lea rcx, [0x180070998]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18005b4c4
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x19], r12
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
lea r9, [rbp - 0x19]
lea r8, [0x1800738f0]
lea rdx, str.:N_tG
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
mov ebx, eax
test eax, eax
js 0x18005b470
mov edx, 1
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.USER32.dll_MonitorFromPoint]
nop dword [rax + rax]
mov r14, rax
mov rbx, qword [rbp - 0x19]
mov rcx, qword [rbx]
mov r15, qword [rcx + 0x30]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18005b3b6
mov qword [rbp - 0x31], r12
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x18004bf34.0]
lea r8, [rbp - 0x31]
mov rdx, r14
mov rcx, rbx
mov rax, r15
call qword [case.0x18004bf34.0]
mov qword [rbp - 0x29], r12
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
lea r9, [rbp - 0x29]
lea r8, [0x1800738e0]
lea rdx, [0x1800738d0]
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
mov ebx, eax
test eax, eax
js 0x18005b437
mov rax, qword [rbp - 0x31]
mov qword [rbp - 0x11], rax
xor edx, edx
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x20], rdx
mov r9, r13
mov r8, rsi
mov rdx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
mov ebx, eax
jmp 0x18005b454
test byte [0x180083cc0], 0x40
je 0x18005b454
mov dword [rsp + 0x20], eax
lea r9, str.QueryService_SID_SwitchController
mov r8, rdi
call fcn.18005acbc
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x18005b48d
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
jmp 0x18005b48d
test byte [0x180083cc0], 0x40
je 0x18005b48d
mov dword [rsp + 0x20], eax
lea r9, str.QueryService_SID_IImmersiveMonitorService
mov r8, rdi
call fcn.18005acbc
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x18005b4a8
mov qword [rbp - 0x19], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18005b4e1
mov qword [rbp - 0x31], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
jmp 0x18005b4e1
test byte [0x180083cc0], 0x40
je 0x18005b4e1
mov dword [rsp + 0x20], eax
lea r9, str.CoCreateInstance_ImmersiveShell
mov r8, rdi
call fcn.18005acbc
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x18005b4fc
mov qword [rbp - 0x21], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x18005b534
mov qword [rbp + 0x67], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
jmp 0x18005b534
test rsi, rsi
je 0x18005b523
cmp word [rsi], r12w
jne 0x18005b52a
lea rsi, str.StartModeProactiveQuerySourceTile
mov rcx, rsi
call fcn.18005fbc0
mov ebx, eax
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret