Function at 0x140004e64
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1d0
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov r14d, eax
mov qword [rsp + 0x48], rax
mov r15d, eax
mov edi, eax
mov rbx, r9
mov r13, r8
mov r12, rdx
call fcn.14000486c
xor ecx, ecx
test rsi, rsi
je 0x140004ec2
mov eax, ecx
cmp word [rsi], cx
jne 0x140004ec7
mov eax, 1
test eax, eax
je 0x140004ed5
mov ebx, 0x80070057
jmp 0x140005278
lea rdx, [rbp + 0x100]
mov rcx, r13
call fcn.1400061ec
xor edx, edx
test eax, eax
js 0x140004ecb
test rbx, rbx
je 0x140004f3c
mov dword [rbp + 0x100], edx
lea r8, [rbp + 0x100]
mov rdx, r13
mov rcx, rbx
call fcn.140001178
xor ecx, ecx
test eax, eax
js 0x140004f25
cmp dword [rbp + 0x100], ecx
je 0x140004f25
mov r9, rbx
mov rdx, r12
mov rcx, rsi
call fcn.1400011e4
jmp 0x140004f36
mov r9, rbx
mov r8, r13
mov rdx, r12
mov rcx, rsi
call fcn.14000529c
mov ebx, eax
xor edx, edx
jmp 0x140004f41
mov ebx, 0x80004005
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140004f51
mov dword [rsp + 0x30], edx
jmp 0x140004f5d
call qword [0x140009308]
mov dword [rsp + 0x30], eax
xor edx, edx
cmp ebx, 0x800704c7
jne 0x140004f6f
mov ebx, 1
jmp 0x140005278
test ebx, ebx
jns 0x140005196
lea r9, [rsp + 0x48]
mov rdx, r13
lea r8, [rsp + 0x38]
call fcn.14000627c
mov r14, qword [rsp + 0x38]
xor edx, edx
mov r15, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
js 0x140005191
test r14, r14
je 0x140004fac
mov eax, edx
cmp word [r14], dx
jne 0x140004fb1
mov eax, 1
test eax, eax
jne 0x140005191
test r15, r15
je 0x140004fc6
mov eax, edx
cmp word [r15], dx
jne 0x140004fcb
mov eax, 1
test eax, eax
jne 0x140005191
cmp word [r14], 0x2e
jne 0x140005121
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x38]
mov dword [rbp + 0x100], edx
mov r9d, 0x20019
mov rdx, r14
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000510d
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x40], edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
xor edx, edx
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, dword [rbp + 0x100]
test ebx, ebx
cmovns eax, dword [rsp + 0x40]
js 0x14000510d
dec eax
mov ecx, edx
cmp eax, 1
setbe cl
test ecx, ecx
je 0x1400050ef
mov edx, dword [rbp + 0x100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edx, edx
mov rdi, rax
test rax, rax
jne 0x14000509c
mov ebx, 0x8007000e
jmp 0x14000510d
mov word [rax], dx
lea r9, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x48], edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000510d
mov eax, dword [rsp + 0x48]
dec eax
cmp eax, 1
ja 0x14000510d
cmp dword [rbp + 0x100], 2
jae 0x1400050f6
mov ebx, 0x8000ffff
jmp 0x14000510d
mov eax, dword [rbp + 0x100]
mov ecx, ebx
mov ebx, 0x8000ffff
cmp word [rax + rdi - 2], dx
cmovne ecx, ebx
mov ebx, ecx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005127
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
jmp 0x140005127
mov rdi, r14
mov r14, rdx
test ebx, ebx
js 0x140005196
test rdi, rdi
je 0x140005137
mov eax, edx
cmp word [rdi], dx
jne 0x14000513c
mov eax, 1
test eax, eax
jne 0x14000517a
test r15, r15
je 0x14000514d
mov eax, edx
cmp word [r15], dx
jne 0x140005152
mov eax, 1
test eax, eax
jne 0x14000517a
lea rdx, str.FrontPage.Editor.Document
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000517a
mov r9, rdi
mov rdx, r12
mov rcx, rsi
call fcn.1400011e4
jmp 0x14000518b
mov r9, rdi
mov r8, r15
mov rdx, r12
mov rcx, rsi
call fcn.14000529c
mov ebx, eax
xor edx, edx
jmp 0x140005196
mov ebx, 0x80004005
cmp ebx, 0x800704c7
jne 0x1400051a8
mov ebx, 1
jmp 0x14000524e
test ebx, ebx
jns 0x1400051d2
cmp dword [rsp + 0x30], edx
mov r8, r13
mov rdx, r12
mov rcx, rsi
jne 0x1400051c9
lea r9, str.XEV.GenericApp
call fcn.14000529c
jmp 0x1400051ce
call fcn.1400066e0
xor edx, edx
mov ebx, eax
cmp ebx, 0x800704c7
je 0x14000519e
test ebx, ebx
jns 0x140005204
cmp dword [rsp + 0x30], edx
lea r9, str.XEV.FailSafeApp
mov rdx, r12
mov r8, r13
mov rcx, rsi
je 0x1400051fb
lea r9, str.textfile
call fcn.14000529c
xor edx, edx
mov ebx, eax
mov r13d, 0x800704c7
cmp ebx, r13d
je 0x14000519e
test ebx, ebx
jns 0x140005237
xor r8d, r8d
lea r9, str.XEV.FailSafeApp
cmp dword [rsp + 0x30], edx
mov rcx, rsi
mov rdx, r12
je 0x140005230
lea r9, str.textfile
call fcn.14000529c
mov ebx, eax
cmp ebx, r13d
je 0x14000519e
test ebx, ebx
jns 0x14000524e
mov rcx, rsi
call fcn.140005d44
mov ebx, eax
test r14, r14
je 0x14000525c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r15, r15
je 0x14000526a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rdi, rdi
je 0x140005278
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea r11, [rsp + 0x1d0]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret