Function at 0x1401b2990
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1401b2990
push rdi
sub rsp, 0x210
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x208], rax
call fcn.14000682f
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x40]
call fcn.1401878e0
mov rcx, rax
call fcn.140003cb0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [rsp + 0x98]
call qword [rsp + 0xa0]
cmp rax, 0xffffffffffffffff
je 0x1401b2a31
mov eax, 1
jmp 0x1401b2f32
call fcn.140009066
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x41]
call fcn.140187c50
mov rcx, rax
call fcn.140007b5d
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xb0]
test rax, rax
je 0x1401b2a8f
mov eax, 1
jmp 0x1401b2f32
mov qword [rsp + 0x1f8], 0
call fcn.14000359e
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x42]
call fcn.140187dc0
mov rcx, rax
call fcn.14000843b
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, 0xffffffff80000002
call qword [rsp + 0xc0]
test eax, eax
jne 0x1401b2b4c
cmp qword [rsp + 0x1f8], 0
je 0x1401b2b4c
call fcn.140006424
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call qword [rsp + Ordinal_211]
mov eax, 1
jmp 0x1401b2f32
mov qword [rsp + 0x1f8], 0
call fcn.1400073ec
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x43]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x43]
call fcn.140187f70
mov rcx, rax
call fcn.140002c9d
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
mov rcx, 0xffffffff80000002
call qword [rsp + 0xe0]
test eax, eax
jne 0x1401b2f32
mov dword [rsp + 0x200], 0
mov dword [rsp + 0x204], 0x100
call fcn.140007da1
mov qword [rsp + 0xf0], rax
mov eax, dword [rsp + 0x204]
add eax, 0xa
mov eax, eax
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
mov ecx, 0x40
call qword [rsp + 0xf0]
mov qword [rsp + 0x58], rax
call fcn.140008a12
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x44]
call fcn.140188020
mov rcx, rax
call fcn.140003cb0
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x204]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x200]
xor r8d, r8d
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x100]
call qword [rsp + 0x108]
test eax, eax
jne 0x1401b2d0e
mov rcx, qword [rsp + 0x58]
call fcn.140007e64
cmp dword [rsp + 0x200], 1
je 0x1401b2cc7
cmp dword [rsp + 0x200], 7
jne 0x1401b2d0e
lea rax, [rsp + 0x45]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x45]
call fcn.1401880d0
mov rcx, rax
call fcn.140002bd5
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call fcn.14000456b
test rax, rax
je 0x1401b2d0e
mov eax, 1
jmp 0x1401b2f32
call fcn.140005ede
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x110]
mov dword [rsp + 0x200], 0
mov dword [rsp + 0x204], 0x200
call fcn.140004507
mov qword [rsp + 0x120], rax
mov eax, dword [rsp + 0x204]
add eax, 0xa
mov eax, eax
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov ecx, 0x40
call qword [rsp + 0x120]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x46]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x46]
call fcn.140188150
mov rcx, rax
call fcn.1400071ee
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x204]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x200]
xor r8d, r8d
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401b2eeb
cmp dword [rsp + 0x200], 7
jne 0x1401b2eeb
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
test eax, eax
je 0x1401b2eeb
mov rcx, qword [rsp + 0x50]
call fcn.140007e64
lea rax, [rsp + 0x47]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x47]
call fcn.1401881d0
mov rcx, rax
call fcn.140005de9
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14000456b
test rax, rax
jne 0x1401b2ea0
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x48]
call fcn.140188250
mov rcx, rax
call fcn.140004e12
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14000456b
test rax, rax
je 0x1401b2eaa
mov eax, 1
jmp 0x1401b2f32
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], 0xffffffffffffffff
inc qword [rsp + 0x60]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
cmp byte [rax + rcx], 0
jne 0x1401b2ebd
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rax, [rcx + rax + 1]
mov qword [rsp + 0x50], rax
jmp 0x1401b2e0c
call fcn.140008071
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0x80]
call fcn.140007dec
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0x90]
xor eax, eax
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.1400048e5
add rsp, 0x210
pop rdi
ret