Function at 0x7ff74b030a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor r13d, r13d
lea rax, [r11 + 0x18]
mov r12, r8
mov qword [r8], r13
mov qword [r11 - 0x30], rax
lea r9, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x38], r13
mov rbp, rdx
mov rdi, rcx
mov dword [r11 + 0x18], r13d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r13d
jne 0x7ff74b1c817
cmp dword [rsp + 0x78], 3
jne 0x7ff74b1c9c2
cmp dword [rsp + 0x70], 0x28
jb 0x7ff74b1c9c2
mov r8d, dword [rsp + 0x70]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [0x7ff74b58358]
mov rsi, rax
cmp rax, r13
je 0x7ff74b1c852
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r13d
jne 0x7ff74b1c85c
cmp dword [rsp + 0x78], 3
jne 0x7ff74b1c898
cmp dword [rsi + 8], r13d
je 0x7ff74b1c953
cmp dword [rsi + 4], r13d
je 0x7ff74b1c953
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_IsValidSecurityDescriptor]
cmp eax, r13d
je 0x7ff74b1c8f4
xor edx, edx
mov rcx, rsi
call fcn.7ff74af4aa4
cmp eax, r13d
je 0x7ff74b1c922
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [0x7ff74b58358]
cmp rax, r13
je 0x7ff74b1c9b0
mov rdx, rsi
mov rcx, rax
call fcn.7ff74b02910
jmp 0x7ff74b031ba
cmp rax, r13
je 0x7ff74b1c9b8
mov qword [r12], rax
xor eax, eax
jmp 0x7ff74b031cb
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1ca03
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1ca03
test byte [rcx + 0x1c], 8
je 0x7ff74b1ca03
lea edx, [r13 + 0xf]
mov dword [rsp + 0x20], eax
jmp 0x7ff74b1c9f0
mov eax, 0xe
jmp 0x7ff74b031cb
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1c9a2
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1c9a2
test byte [rcx + 0x1c], 1
je 0x7ff74b1c9a2
mov edx, 0x11
mov dword [rsp + 0x20], eax
jmp 0x7ff74b1c98f
mov ebx, 0xb
mov edi, ebx
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1c8db
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1c8db
test byte [rcx + 0x1c], 1
je 0x7ff74b1c8db
lea edx, [rbx + 7]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517f0]
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.7ff74b298f0
mov rcx, qword [0x7ff74b584e0]
mov r8, rsi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov eax, edi
jmp 0x7ff74b031cb
mov ebx, 0xb
mov edi, ebx
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1c8db
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1c8db
test byte [rcx + 0x1c], 1
je 0x7ff74b1c8db
lea edx, [rbx + 9]
jmp 0x7ff74b1c8c4
mov ebx, 0xb
mov edi, ebx
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1c8db
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1c8db
test byte [rcx + 0x1c], 1
je 0x7ff74b1c8db
lea edx, [rbx + 0xa]
jmp 0x7ff74b1c8c4
mov ebx, 0xb
mov edi, ebx
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1c8db
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1c8db
test byte [rcx + 0x1c], 1
je 0x7ff74b1c8db
lea edx, [rbx + 8]
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517f0]
mov r9, rbp
call fcn.7ff74b298f0
cmp edi, r13d
je 0x7ff74b03191
jmp 0x7ff74b1c8db
mov rax, r13
jmp 0x7ff74b031ba
mov edi, 0xe
jmp 0x7ff74b1c8db
mov ebx, 0xb
cmp dword [0x7ff74b582c8], r13d
je 0x7ff74b1ca03
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1ca03
test byte [rcx + 0x1c], 1
je 0x7ff74b1ca03
lea edx, [rbx + 5]
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517f0]
mov r9, rbp
call fcn.7ff74b298f0
mov eax, ebx
jmp 0x7ff74b031cb