Function at 0x140013cf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov qword [rbp - 0x20], 0xfffffffffffffffe
xor r15d, r15d
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xb0], r15
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0xb8]
call fcn.140011580
xor r14b, r14b
lea rcx, [rsp + 0x30]
call fcn.14000af20
nop
or rsi, 0xffffffffffffffff
mov rdi, qword [rbp + 0xb0]
test rdi, rdi
je 0x140013dfd
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x60]
call fcn.14003dad0
mov dword [rbp + 0xa8], 0x80
mov dword [rbp + 0xa0], r15d
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, str.LoggingType
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013dfd
lea edx, [rsi + 0x41]
lea rcx, [rsp + 0x60]
call fcn.140048ab0
cmp word [rsp + 0x60], r15w
jne 0x140013dcf
mov r8d, r15d
jmp 0x140013deb
lea rax, [rsp + 0x60]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013de0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140005270
mov r14b, 1
mov rbx, qword [rbp + 0xb8]
test rbx, rbx
je 0x140013eaf
test r14b, r14b
jne 0x140013eaf
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x60]
call fcn.14003dad0
mov dword [rbp + 0xa8], 0x80
mov dword [rbp + 0xa0], r15d
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, str.LoggingType
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140013eaf
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140048ab0
cmp word [rsp + 0x60], 0
jne 0x140013e87
mov rsi, r15
jmp 0x140013e9a
lea rax, [rsp + 0x60]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140013e90
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140005270
mov r14b, 1
mov esi, 4
test r14b, r14b
je 0x140013f75
lea rcx, [rsp + 0x30]
call fcn.1400051c0
cmp qword [rax], 0
je 0x140013f75
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, str.EVENT
lea rcx, [rsp + 0x30]
call fcn.1400154e0
mov esi, r15d
cmp rax, 0xffffffffffffffff
setne sil
mov r9d, 4
xor r8d, r8d
lea rdx, str.FILE
lea rcx, [rsp + 0x30]
call fcn.1400154e0
mov r14d, esi
or r14d, 8
cmp rax, 0xffffffffffffffff
cmove r14d, esi
mov r9d, 7
xor r8d, r8d
lea rdx, str.CONSOLE
lea rcx, [rsp + 0x30]
call fcn.1400154e0
mov esi, r14d
or esi, 0x10
cmp rax, 0xffffffffffffffff
cmove esi, r14d
mov r9d, 5
xor r8d, r8d
lea rdx, str.DEBUG
lea rcx, [rsp + 0x30]
call fcn.1400154e0
mov ecx, esi
or ecx, 2
cmp rax, 0xffffffffffffffff
cmove ecx, esi
mov esi, 4
test ecx, ecx
cmovne esi, ecx
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x60]
call fcn.14003dad0
test esi, esi
je 0x1400140ec
lea r12, vtable.HP::Shared::ChpLogListenerDebug.0
lea r13, vtable.HP::Shared::ChpLogListenerConsole.0
lea rdi, vtable.HP::Shared::ChpLogListenerEvent.0
test sil, 1
je 0x140014020
and esi, 0xfffffffe
mov ecx, 0x20
call fcn.14001ce60
mov r14, rax
mov qword [rbp - 0x18], rax
mov rcx, rax
call fcn.140011c30
nop
mov qword [r14], rdi
lea rcx, [rbp + 0x28]
call fcn.14000af20
nop
lea rcx, [rbp + 8]
call fcn.14000af20
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x28]
call fcn.1400112e0
lea rcx, [rbp + 8]
call fcn.140007530
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [r14 + 0x18], rax
lea rcx, [rbp + 8]
call fcn.140005110
nop
lea rcx, [rbp + 0x28]
call fcn.140005110
nop
movsxd rax, r15d
mov qword [rsp + rax*8 + 0x60], r14
inc r15d
test sil, 8
je 0x14001404d
and esi, 0xfffffff7
mov ecx, 0x250
call fcn.14001ce60
mov qword [rbp - 0x10], rax
xor edx, edx
mov rcx, rax
call fcn.140012510
nop
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], rax
inc r15d
test sil, 4
je 0x14001407a
and esi, 0xfffffffb
mov ecx, 0x250
call fcn.14001ce60
mov qword [rbp - 8], rax
mov dl, 1
mov rcx, rax
call fcn.140012510
nop
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], rax
inc r15d
test sil, 2
je 0x1400140ab
and esi, 0xfffffffd
mov ecx, SafeArrayPutElement
call fcn.14001ce60
mov r14, rax
mov qword [rbp], rax
mov rcx, rax
call fcn.140011c30
nop
mov qword [r14], r12
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], r14
inc r15d
test sil, 0x10
je 0x1400140dd
and esi, 0xffffffef
mov ecx, SafeArrayPutElement
call fcn.14001ce60
mov r14, rax
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.140011c30
nop
mov qword [r14], r13
movsxd rcx, r15d
mov qword [rsp + rcx*8 + 0x60], r14
inc r15d
test esi, esi
jne 0x140013fa2
mov rdi, qword [rbp + 0xb0]
mov ecx, 0xb0
call fcn.14001ce60
mov qword [rsp + 0x50], rax
mov r8d, r15d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140014150
mov rsi, rax
lea rcx, [rsp + 0x30]
call fcn.140005110
nop
test rdi, rdi
je 0x140014128
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rbx, rbx
je 0x140014136
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret