Function at 0x140020d44
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rcx + 0x420]
mov rbx, rcx
mov rdi, rdx
lea rcx, [rbp + 0x10]
lea rdx, str.SPPPromptForClose
mov esi, 4
mov qword [r11 - 0x10], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x424]
mov qword [rsp + 0x28], rcx
lea rdx, str.DUNPromptForClose
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x428]
lea rdx, str.LAPPromptForClose
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x42c]
lea rdx, str.FAXPromptForClose
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x430]
mov qword [rsp + 0x28], rcx
lea rdx, str.HSPPromptForClose
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x43c]
lea rdx, str.AVPromptForClose
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x434]
lea rdx, str.HAGPromptForClose
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x438]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HIDPromptForClose
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x440]
mov qword [rsp + 0x28], rcx
lea rdx, str.SPPPromptForConnected
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x444]
lea rdx, str.DUNPromptForConnected
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x448]
lea rdx, str.LAPPromptForConnected
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x44c]
mov qword [rsp + 0x28], rcx
lea rdx, str.FAXPromptForConnected
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x450]
lea rdx, str.HSPPromptForConnected
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x45c]
lea rdx, str.AVPromptForConnected
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x454]
mov qword [rsp + 0x28], rcx
lea rdx, str.HAGPromptForConnected
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x458]
xor r9d, r9d
mov rcx, rdi
mov dword [rbp + 0x10], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HIDPromptForConnected
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret