Function at 0x1400d47b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov word [rsp + 0x10], dx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
movzx ebx, dx
mov r15, rcx
lea rcx, [rbp - 0x69]
call fcn.140114c40
nop
lea rcx, [rbp - 0x59]
call fcn.1400d44d8
nop
xor esi, esi
mov edi, esi
mov r14d, esi
mov r12d, ebx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0x147
mov edx, ebx
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov r13, rax
test rax, rax
js 0x1400d49ea
lfence
mov qword [rsp + 0x20], rsi
mov r9, rax
mov r8d, 0x149
mov edx, ebx
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rbx, rax
lea rcx, [rax + 0x80]
lea edx, [rsi + 2]
call fcn.140113de8
mov rsi, rax
test rbx, rbx
jle 0x1400d49d4
test rax, rax
je 0x1400d49e6
lfence
lea r8, str.Directory_shell_
lea rdx, [rbx + 0x80]
mov rcx, rax
call fcn.14000a8a0
or rax, 0xffffffffffffffff
xor ebx, ebx
inc rax
cmp word [rsi + rax*2], bx
jne 0x1400d4882
lea rax, [rsi + rax*2]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8d, 0x148
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov qword [rbp - 0x79], rbx
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r13d, 0x20019
mov r9d, r13d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d49db
mov dword [rbp + 0x77], 0x410
lea r12d, [rax + 1]
mov edx, r12d
mov ecx, 0x412
call fcn.140113de8
mov rdi, rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x67]
xor r8d, r8d
lea rdx, str.Icon
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d4926
cmp dword [rbp + 0x67], r12d
je 0x1400d4936
test rdi, rdi
je 0x1400d4936
mov rcx, rdi
call fcn.140113e18
mov rdi, rbx
mov qword [rbp - 0x71], rbx
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [0x1401b6870]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d49c8
mov dword [rbp + 0x7f], 0x1040
mov rdx, r12
mov ecx, 0x1042
call fcn.140113de8
mov r14, rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x67]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d49ae
cmp dword [rbp + 0x67], r12d
jne 0x1400d49ae
mov rdx, r14
lea rcx, [rbp - 0x59]
call fcn.1400d4cd8
jmp 0x1400d49be
test rdi, rdi
je 0x1400d49be
mov rcx, rdi
call fcn.140113e18
mov rdi, rbx
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400d49db
xor ebx, ebx
test rsi, rsi
je 0x1400d49e6
lfence
mov rcx, rsi
call fcn.140113e18
movzx ebx, word [rbp + 0x6f]
lea r13, [0x1401759d0]
mov rdx, r13
lea rcx, [rbp - 9]
call fcn.140115398
mov r8, rax
mov esi, 0x966
lea edx, [rsi - 0x10]
lea eax, [rsi - 0x15]
cmp bx, si
cmove edx, eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x59]
call fcn.1400d45f0
mov r8, rax
lea edx, [rsi - 0xf]
lea eax, [rsi - 0x14]
cmp bx, si
cmove edx, eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov r8, r13
xor r12d, r12d
test rdi, rdi
cmovne r8, rdi
lea edx, [rsi - 0x11]
lea eax, [rsi - 0x16]
cmp bx, si
cmove edx, eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp bx, si
jne 0x1400d4aa3
mov rdx, r13
lea rcx, [rbp - 0x19]
call fcn.140115398
mov r8, rax
lea edx, [rsi + 0x49]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rcx, [rbp - 0x19]
call fcn.140114d88
mov r8d, r12d
test al, al
setne r8b
lea edx, [rsi - 9]
mov rcx, qword [r15 + 8]
call fcn.1400442b8
test r14, r14
je 0x1400d4ab0
mov rcx, r14
call fcn.140113e18
test rdi, rdi
je 0x1400d4abe
mov rcx, rdi
call fcn.140113e18
nop
lea rcx, [rbp - 0x59]
call fcn.1400d4548
nop
lea rcx, [rbp - 0x69]
call fcn.140114ca4
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret