Function at 0x7ff74af38f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov r9d, dword [rcx + 0xdc]
mov rsi, rcx
lea rcx, [r11 - 0x38]
mov rax, rdx
xor edi, edi
mov qword [r11 - 0x58], rcx
mov ebp, 0x20019
lea rdx, [rsi + 0x60]
xor r8d, r8d
mov rcx, rax
or r9d, ebp
mov dword [r11 + 8], edi
mov qword [r11 - 0x38], rdi
mov ebx, edi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x7ff74b18734
mov r9d, dword [rsi + 0xdc]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, str.Elevation
or r9d, ebp
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
lea r12, [0x7ff74b58350]
cmp eax, edi
je 0x7ff74b18343
movzx ebx, ax
mov ebp, 0x80070002
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, ebp
jne 0x7ff74b184c8
mov ebx, edi
cmp ebx, edi
jl 0x7ff74af39b0
cmp dword [rsi + 0x120], edi
jne 0x7ff74b18518
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x7ff74af39bd
cmp ebx, edi
jl 0x7ff74b1879f
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.Enabled
xor r8d, r8d
mov dword [rsp + 0x90], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebp, 0x80070002
cmp eax, edi
jne 0x7ff74b183e6
cmp dword [rsp + 0x98], 4
jne 0x7ff74b183aa
mov eax, dword [rsp + 0x80]
mov dword [rsi + 0x120], eax
jmp 0x7ff74b18443
mov ebx, 0x80040153
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b184bb
mov rcx, qword [0x7ff74b58350]
cmp rcx, r12
je 0x7ff74b184bb
test byte [rcx + 0x1c], 1
je 0x7ff74b184bb
mov edx, 0xd
lea rax, str.Enabled
jmp 0x7ff74b1849e
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, ebp
je 0x7ff74b1843d
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b1843f
mov rcx, qword [0x7ff74b58350]
cmp rcx, r12
je 0x7ff74b1843f
test byte [rcx + 0x1c], 1
je 0x7ff74b1843f
mov rcx, qword [rcx + 0x10]
lea rax, str.Enabled
lea r9, [rsi + 0x60]
lea r8, [0x7ff74b4f5f0]
mov edx, 0xe
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.7ff74b2ddbc
jmp 0x7ff74b1843f
mov ebx, edi
cmp ebx, edi
jl 0x7ff74b184bb
cmp dword [rsi + 0x120], edi
je 0x7ff74b184bb
mov rcx, qword [rsp + 0x48]
lea rax, [rsi + 0x138]
lea r8, str.IconReference
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.7ff74af3050
cmp eax, ebp
mov ebx, eax
cmove ebx, edi
cmp ebx, edi
jge 0x7ff74b184bb
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b184bb
mov rcx, qword [0x7ff74b58350]
cmp rcx, r12
je 0x7ff74b184bb
test byte [rcx + 0x1c], 1
je 0x7ff74b184bb
mov edx, 0xf
lea rax, str.IconReference
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x60]
lea r8, [0x7ff74b4f5f0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.7ff74b2ddbc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x7ff74b1850b
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b1850b
mov rcx, qword [0x7ff74b58350]
cmp rcx, r12
je 0x7ff74b1850b
test byte [rcx + 0x1c], 1
je 0x7ff74b1850b
mov rcx, qword [rcx + 0x10]
lea rax, str.Elevation
lea r9, [rsi + 0x60]
lea r8, [0x7ff74b4f5f0]
mov edx, 0x10
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.7ff74b2ddbc
cmp ebx, ebp
je 0x7ff74af399e
jmp 0x7ff74af39a0
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
mov r8d, 0x200
call qword [0x7ff74b58358]
mov rdi, rax
xor eax, eax
cmp rdi, rax
je 0x7ff74b185e0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rdx, str.LocalizedString
mov r9d, 0x200
mov r8, rdi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegLoadMUIStringW]
xor ecx, ecx
cmp eax, ecx
jne 0x7ff74b18577
mov qword [rsi + 0x128], rdi
jmp 0x7ff74b185e5
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ecx
cmovle ebx, eax
cmp ebx, ebp
je 0x7ff74b185cc
cmp dword [0x7ff74b582c8], ecx
je 0x7ff74b185cc
mov rcx, qword [0x7ff74b58350]
cmp rcx, r12
je 0x7ff74b185cc
test byte [rcx + 0x1c], 1
je 0x7ff74b185cc
mov rcx, qword [rcx + 0x10]
lea rax, str.LocalizedString
lea r9, [rsi + 0x60]
lea r8, [0x7ff74b4f5f0]
mov edx, 0x11
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.7ff74b2ddbc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
jmp 0x7ff74b185e5
mov ebx, 0x8007000e
xor edi, edi
cmp ebx, edi
jl 0x7ff74af39b0
mov r9d, dword [rsi + 0xdc]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
mov r12d, 0x20019
lea rdx, str.LocalServer32
xor r8d, r8d
or r9d, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x7ff74b1868d
mov rcx, qword [rsp + 0x90]
lea rdi, [rsi + 0x130]
lea r8, str.ServerExecutable
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.7ff74af3050
cmp eax, ebp
mov ebx, eax
mov eax, 0
cmove ebx, eax
cmp ebx, eax
jl 0x7ff74b1867b
cmp qword [rdi], rax
jne 0x7ff74b1867b
mov rcx, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.7ff74af3050
mov ebx, eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor edi, edi
jmp 0x7ff74b1869b
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, ebp
cmove ebx, edi
cmp ebx, edi
jl 0x7ff74af39b0
lea rdi, [rsi + 0x130]
cmp qword [rdi], 0
jne 0x7ff74b1872d
mov r9d, dword [rsi + 0xdc]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, str.InprocServer32
or r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff74b18713
mov rcx, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.7ff74af3050
mov rcx, qword [rsp + 0x90]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor edi, edi
jmp 0x7ff74b18723
movzx ebx, ax
xor edi, edi
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, ebp
cmove ebx, edi
jmp 0x7ff74af39b0
xor edi, edi
jmp 0x7ff74af39b0
movzx ebx, ax
mov ebp, 0x80070002
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, ebp
je 0x7ff74af39bd
cmp dword [0x7ff74b582c8], edi
je 0x7ff74af39bd
mov rcx, qword [0x7ff74b58350]
lea r12, [0x7ff74b58350]
cmp rcx, r12
je 0x7ff74af39bd
test byte [rcx + 0x1c], 1
je 0x7ff74af39bd
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x60]
lea r8, [0x7ff74b4f5f0]
mov edx, 0x12
mov dword [rsp + 0x20], ebx
call fcn.7ff74b298f0
nop
jmp 0x7ff74af39bd
cmp ebx, ebp
cmove ebx, edi
jmp 0x7ff74af39c5