Function at 0x1400d6f30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, qword [0x14013f500]
mov r15, rcx
mov r13, r9
mov rcx, rbx
mov rsi, r8
mov rdi, rdx
call fcn.14002f9e0
test rdi, rdi
jne 0x1400d6fab
mov esi, 0x57
mov edx, esi
mov rax, qword [0x14013b0f8]
test esi, esi
mov rcx, r15
mov dword [rax + 0x40], edx
setne dl
call fcn.14005e3f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [0x14013b0f8]
xor r8d, r8d
mov rdx, rsi
mov r9d, dword [rax + 0x110]
lea rax, [rbp - 0x38]
mov rcx, rdi
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1400d708e
mov rcx, qword [rbp - 0x38]
xor r12d, r12d
lea r9, [rbp - 0x40]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400d7084
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400d7030
cmp eax, 2
jbe 0x1400d7218
cmp eax, 3
je 0x1400d70a4
cmp eax, 4
je 0x1400d7044
cmp eax, 7
je 0x1400d7218
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x65e
jmp 0x1400d6f74
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3c]
xor r8d, r8d
mov rdx, r13
mov dword [rbp + 0x38], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400d7084
mov edx, dword [rbp - 0x3c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001090
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0xffffffff
jne 0x1400d6f74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x1400d6f76
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], r12
mov dword [rbp + 0x38], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400d7084
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x1400d7084
lea r8d, [rax + rax]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
cmp eax, 1
jne 0x1400d726f
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140001830
xor r9d, r9d
xor r8d, r8d
mov word [rax], r12w
mov edx, dword [rbp + 0x38]
mov rcx, qword [rbp - 0x38]
lea r12d, [rdx + rdx]
mov r14, rax
add r12, r12
sub r12, rdx
mov rdx, r13
add r12, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400d708e
mov rax, qword [str.0123456789ABCDEF]
xor r9d, r9d
mov qword [rbp - 0x30], rax
mov rax, qword [0x140125d30]
mov r8d, r9d
mov qword [rbp - 0x28], rax
mov rax, qword [0x140125d38]
mov edi, r9d
mov qword [rbp - 0x20], rax
mov rax, qword [0x140125d40]
mov qword [rbp - 0x18], rax
movzx eax, word [0x140125d48]
mov word [rbp - 0x10], ax
cmp dword [rbp + 0x38], r9d
jbe 0x1400d71d5
mov rdx, r14
nop word [rax + rax]
movzx eax, byte [r12]
inc edi
add rdx, 4
mov ecx, eax
and eax, 0xf
add r8d, 2
movzx eax, word [rbp + rax*2 - 0x30]
shr rcx, 4
inc r12
mov word [rdx - 2], ax
and ecx, 0xf
movzx eax, word [rbp + rcx*2 - 0x30]
mov word [rdx - 4], ax
cmp edi, dword [rbp + 0x38]
jb 0x1400d71a0
movsxd rax, r8d
mov word [r14 + rax*2], r9w
cmp byte [rbx + 0x23], r9b
jne 0x1400d71e7
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400d720f
cmp qword [0x140143de8], r9
je 0x1400d720f
lea rcx, [0x140143dd0]
call fcn.140006d40
test eax, eax
jne 0x1400d6f74
jmp 0x1400d6f8d
and byte [rbx + 0x21], 0x86
jmp 0x1400d6f74
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], r12
mov dword [rbp + 0x38], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400d7084
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x1400d7084
shr eax, 1
xor r9d, r9d
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rbx
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
cmp eax, 1
je 0x1400d7280
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400d6f8d
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140001830
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
mov rdi, rax
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400d72fb
mov edx, dword [rbp + 0x38]
test edx, edx
je 0x1400d72fb
shr edx, 1
lea eax, [rdx + 1]
mov word [rdi + rdx*2], r12w
mov word [rdi + rax*2], r12w
cmp dword [rbp - 0x40], 7
jne 0x1400d72ff
mov rax, rdi
lea ecx, [rsi + 0xa]
cmp word [rax], r12w
jne 0x1400d72f5
mov word [rax], cx
cmp word [rax + 2], r12w
je 0x1400d72ff
add rax, 2
jmp 0x1400d72e5
mov word [rdi], r12w
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.14002fd90
cmp byte [rbx + 0x23], r12b
jne 0x1400d7321
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400d7349
cmp qword [0x140143de8], r12
je 0x1400d7349
lea rcx, [0x140143dd0]
call fcn.140006d40
test eax, eax
jne 0x1400d708e
jmp 0x1400d6f8d
and byte [rbx + 0x21], 0x86
jmp 0x1400d708e