Function at 0x1400a2174
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rdi, qword [rbp + 0x2a0]
mov r13, rdx
xor edx, edx
mov dword [rsp + 0x40], r9d
mov qword [rsp + 0x58], rcx
mov r14d, r9d
mov qword [rbp - 0x60], rdi
mov rbx, r8
mov r12, rcx
test r13, r13
jne 0x1400a21d5
mov dword [0], 1
xor ecx, ecx
int 0x29
test rcx, rcx
jne 0x1400a21e7
mov dword [0], 1
int 0x29
lea rsi, [0x140331750]
test rbx, rbx
je 0x1400a221f
movzx ecx, word [rcx + 0xa]
mov eax, ecx
and eax, 0xf
lea rax, [rax + rax*2]
cmp qword [rsi + rax*8], rdx
jne 0x1400a22c3
and ecx, 0xf
call fcn.1400a3368
xor edx, edx
test eax, eax
jne 0x1400a22c3
mov qword [rbx], rdx
test r14b, 5
mov qword [rsp + 0x50], rdx
mov esi, edx
mov qword [rsp + 0x48], rdx
setne sil
test r14b, 2
je 0x1400a223c
or esi, 2
test r14b, 0x10
je 0x1400a2245
or esi, 8
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, r12
lea rcx, [0x14033eaa0]
call fcn.1400a316c
mov r14, qword [rsp + 0x50]
xor r8d, r8d
test eax, eax
jne 0x1400a28b2
mov qword [rbp - 0x58], r8
mov word [rbp + 0x226], r8w
mov rax, r8
mov qword [rsp + 0x68], rax
mov rbx, r12
lea rdi, [rbp + 0x226]
test r12, r12
je 0x1400a28ae
movzx ecx, word [rbx + 0xa]
mov r14d, r8d
mov dword [rsp + 0x44], r8d
test cl, 0xf
je 0x1400a235a
test sil, 2
je 0x1400a232b
and ecx, 0xf
cmp ecx, 5
jne 0x1400a22fe
mov dword [rsp + 0x44], 4
lea eax, [rcx - 1]
jmp 0x1400a230e
mov qword [r13], rdx
movzx eax, word [r12 + 0xa]
and eax, 0xf
lea rax, [rax + rax*2]
mov rax, qword [rsi + rax*8]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140135130
add rsp, 0x340
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp ecx, 8
jne 0x1400a2324
mov dword [rsp + 0x44], 9
lea eax, [rcx + 1]
mov r14d, dword [rsp + 0x44]
lea rax, [rax + rax*2]
lea rcx, [0x140331750]
mov rax, qword [rcx + rax*8]
jmp 0x1400a234c
mov dword [rsp + 0x44], r8d
jmp 0x1400a2351
mov rax, rcx
lea rdx, [0x140331750]
and eax, 0xf
mov r14d, ecx
and r14d, 0xf
mov dword [rsp + 0x44], r14d
lea rax, [rax + rax*2]
mov rax, qword [rdx + rax*8]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1400a2412
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rbx
lea rcx, [0x14033eaa0]
call fcn.1400a316c
xor r8d, r8d
test eax, eax
jne 0x1400a240d
mov r9, qword [rbx]
movzx edx, word [rbx + 8]
test r14d, r14d
je 0x1400a23c2
movsxd rax, r14d
lea r14d, [r8 + 0x5c]
lea rcx, [rax + rax*2]
lea rax, [0x140331750]
mov rcx, qword [rax + rcx*8 + 0x10]
test rcx, rcx
je 0x1400a23c8
mov edx, r14d
call fcn.1401383bc
or rdx, 0xffffffffffffffff
lea r9, [rax + 2]
xor eax, eax
inc rdx
cmp word [r9 + rdx*2], ax
jne 0x1400a23b6
jmp 0x1400a23c8
mov r14d, 0x5c
lea r8, [rdx + rdx]
mov rax, 0xfffffffffffffffe
sub rax, r8
add rdi, rax
lea rax, [rbp + 0x20]
cmp rdi, rax
jb 0x1400a29a3
lea rcx, [rdi + 2]
mov word [rdi], r14w
mov rdx, r9
call fcn.140137400
mov rbx, qword [rbx + 0xc]
xor r8d, r8d
mov rax, qword [rsp + 0x68]
test rbx, rbx
jne 0x1400a2293
jmp 0x1400a2412
mov rax, qword [rsp + 0x68]
lea rcx, [rbp + 0x20]
cmp rdi, rcx
jb 0x1400a2cb1
cmp r12, rbx
je 0x1400a28a9
test rbx, rbx
je 0x1400a2b67
cmp rbx, qword [rbp - 0x58]
je 0x1400a2a8c
mov ecx, dword [rsp + 0x40]
add rdi, 2
mov qword [rbp - 0x58], rbx
test cl, 8
jne 0x1400a244f
or esi, 1
mov r14, qword [rsp + 0x50]
test cl, 4
mov rcx, rax
je 0x1400a2660
mov dword [rsp + 0x60], r8d
test rax, rax
jne 0x1400a246d
mov rcx, qword [r14]
mov qword [rsp + 0x38], r8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov r12d, esi
shr r12d, 3
mov rdx, rdi
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x2001f
and r12d, 1
je 0x1400a24a6
xor r9d, r9d
xor r8d, r8d
call fcn.1400a61f0
jmp 0x1400a24b1
xor r9d, r9d
xor r8d, r8d
call fcn.1400a6268
mov ebx, eax
cmp eax, 5
jne 0x1400a2641
xor edx, edx
test byte [rsp + 0x40], 1
jne 0x1400a2643
mov rax, qword [rsp + 0x68]
mov rcx, rax
test rax, rax
jne 0x1400a24d9
mov rcx, qword [r14]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov rdx, rdi
mov dword [rsp + 0x20], 0x20019
test r12d, r12d
je 0x1400a250f
call fcn.1400a61f0
jmp 0x1400a2514
call fcn.1400a6268
and esi, 0xfffffffe
xor edx, edx
mov ebx, eax
test eax, eax
je 0x1400a2643
cmp eax, 2
je 0x1400a2643
lea r12d, [rdx + 7]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r12
mov word [rbp - 0x38], dx
cmp word [rdi], dx
jne 0x1400a2546
mov r8d, edx
jmp 0x1400a2554
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], dx
jne 0x1400a254a
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.14000b6f8
lea rax, [0x1402481f8]
mov qword [rbp + 0x10], r12
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x38]
lea rax, str.Path
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 8]
xor eax, eax
mov qword [rbp + 8], rax
mov word [rbp - 8], ax
call fcn.14000ae7c
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov dword [rbp - 0x68], ebx
lea rax, str.Options
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rax
lea r9, str.Failed_to_create_key_with_read_only_access
mov eax, dword [rsp + 0x40]
mov edx, 0x3a7
mov dword [rbp - 0x40], eax
mov r8d, 0x32
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp - 0x78], rcx
mov qword [rsp + 0x70], rax
mov ecx, 0x65d05e
lea rax, [0x14023d5c0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
lea rax, str.Error
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
call fcn.1400a1f30
xor r8d, r8d
lea rcx, [rbp - 8]
mov dl, 1
call fcn.14000b190
xor r8d, r8d
lea rcx, [rbp - 0x38]
mov dl, 1
call fcn.14000b190
xor edx, edx
mov rcx, qword [rbp - 0x60]
mov r12, qword [rsp + 0x58]
test rcx, rcx
je 0x1400a2824
mov eax, dword [rsp + 0x60]
mov dword [rcx], eax
jmp 0x1400a2824
test rax, rax
jne 0x1400a2668
mov rcx, qword [r14]
mov r12d, esi
lea r9, [rsp + 0x48]
shr r12d, 3
mov r8d, 0x2001f
mov rdx, rdi
and r12d, 1
je 0x1400a268a
call fcn.1400a623c
jmp 0x1400a268f
call fcn.1400a623c
mov ebx, eax
cmp eax, 5
jne 0x1400a281d
test byte [rsp + 0x40], 1
jne 0x1400a2a12
mov rax, qword [rsp + 0x68]
mov rcx, rax
test rax, rax
jne 0x1400a26b5
mov rcx, qword [r14]
lea r9, [rsp + 0x48]
mov r8d, 0x20019
mov rdx, rdi
test r12d, r12d
je 0x1400a26cf
call fcn.1400a623c
jmp 0x1400a26d4
call fcn.1400a623c
and esi, 0xfffffffe
mov ebx, eax
cmp eax, 5
jne 0x1400a26ee
call fcn.1400a61e8
xor edx, edx
test eax, eax
je 0x1400a26f8
lea ebx, [rdx + 2]
jmp 0x1400a26f0
xor edx, edx
test ebx, ebx
je 0x1400a281f
cmp ebx, 2
je 0x1400a281f
mov r12d, 7
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r12
mov word [rbp - 0x38], dx
cmp word [rdi], dx
jne 0x1400a271d
mov r8, rdx
jmp 0x1400a272b
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], dx
jne 0x1400a2721
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.14000b6f8
lea rax, [0x1402481f8]
mov qword [rbp + 0x10], r12
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x38]
lea rax, str.Path
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 8]
xor eax, eax
mov qword [rbp + 8], rax
mov word [rbp - 8], ax
call fcn.14000ae7c
mov r12, qword [rsp + 0x58]
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
lea rax, str.Options
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x70], rax
lea r9, str.Failed_to_open_key_with_read_only_access
mov eax, dword [rsp + 0x40]
mov edx, 0x3a7
mov dword [rbp - 0x68], eax
mov r8d, 0x32
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp - 0x50], rcx
mov qword [rsp + 0x70], rax
mov ecx, 0x65d060
lea rax, [0x14023d5c0]
mov dword [rbp - 0x40], ebx
mov qword [rsp + 0x78], rax
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
lea rax, str.Error
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.1400a1f30
xor r8d, r8d
lea rcx, [rbp - 8]
mov dl, 1
call fcn.14000b190
xor r8d, r8d
lea rcx, [rbp - 0x38]
mov dl, 1
call fcn.14000b190
xor edx, edx
jmp 0x1400a2824
xor edx, edx
mov r12, qword [rsp + 0x58]
cmp ebx, 0x3f2
je 0x1400a283d
cmp ebx, 0x3fa
je 0x1400a283d
cmp ebx, 6
jne 0x1400a2a12
cmp qword [rsp + 0x68], rdx
je 0x1400a288a
movsxd rdi, dword [rsp + 0x44]
lea rax, [0x140331750]
lea rbx, [rdi + rdi*2]
cmp qword [rax + rbx*8 + 0x10], rdx
je 0x1400a288a
cmp edi, 4
jl 0x1400a2a7d
mov rcx, qword [rax + rbx*8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140331750]
xor eax, eax
mov qword [rcx + rbx*8], rax
mov ecx, edi
call fcn.1400a3368
xor r8d, r8d
jmp 0x1400a2270
mov rdx, r14
lea rcx, [0x14033eaa0]
call fcn.1400a3008
xor r8d, r8d
mov r14d, r8d
mov qword [rsp + 0x50], r8
jmp 0x1400a2270
mov r14, qword [rsp + 0x50]
mov rdi, qword [rbp - 0x60]
test byte [rsp + 0x40], 8
je 0x1400a2c96
test r14, r14
je 0x1400a2966
mov rcx, qword [r14]
lea r9, [rsp + 0x48]
mov eax, esi
and al, 1
neg al
sbb r8d, r8d
xor edx, edx
and r8d, 6
add r8d, 0x20019
test sil, 8
je 0x1400a28f1
call fcn.1400a623c
jmp 0x1400a28f6
call fcn.1400a623c
mov ebx, eax
test eax, eax
je 0x1400a296b
lea rax, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov dword [rbp - 0x68], ebx
mov qword [rbp - 0x78], rax
lea r9, str.Failure_returned_attempting_to_open_cached_key
lea rax, str.Error
mov edx, 0x3a7
mov qword [rbp - 0x70], rax
mov ecx, 0x65d058
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov r8d, 0x32
mov qword [rsp + 0x70], rax
lea rax, [0x14023d5c0]
mov qword [rsp + 0x78], rax
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.1400215e4
jmp 0x1400a296b
mov ebx, 6
cmp ebx, 0x3f2
je 0x1400a2984
cmp ebx, 0x3fa
je 0x1400a2984
cmp ebx, 6
jne 0x1400a2c6d
mov rdx, r14
lea rcx, [0x14033eaa0]
call fcn.1400a3008
xor r8d, r8d
mov r14d, r8d
mov qword [rsp + 0x50], r8
jmp 0x1400a226c
inc rdx
mov qword [rbp - 0x68], r9
lea r8, str.KeyPath
lea rax, str.NextSegment
mov qword [rsp + 0x78], r8
lea r9, str.Requested_key_path_is_too_long
mov qword [rbp - 0x70], rax
lea rcx, [rdi + rdx*2]
mov r8d, 0xa
mov qword [rbp - 0x80], rcx
lea rdx, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x78], rdx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov ecx, 0x8526de
mov qword [rsp + 0x70], rdx
mov edx, 0x3a7
call fcn.1400a1fe8
mov eax, 8
jmp 0x1400a22dd
mov rcx, r14
call fcn.1400a4154
test ebx, ebx
jne 0x1400a2a76
test byte [rsp + 0x40], 8
jne 0x1400a2a56
mov r9, qword [rsp + 0x48]
lea rcx, [0x14033eaa0]
mov rdx, qword [rsp + 0x58]
mov r8d, esi
mov qword [rsp + 0x20], r13
call fcn.1400a3260
test eax, eax
jne 0x1400a2a76
mov dword [0], 1
xor ecx, ecx
int 0x29
mov rcx, qword [rsp + 0x48]
mov rdx, qword [r13]
mov rax, qword [rsp + 0x58]
mov qword [rdx], rcx
mov rcx, qword [r13]
mov dword [rcx + 0x10], esi
mov rcx, qword [r13]
mov qword [rcx + 8], rax
mov eax, ebx
jmp 0x1400a22dd
mov dword [0], 1
xor ecx, ecx
int 0x29
mov ebx, 7
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x38], r8w
cmp word [rdi], r8w
jne 0x1400a2aa9
mov rdx, r8
jmp 0x1400a2ab7
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r8w
jne 0x1400a2aad
mov r8, rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
call fcn.14000b6f8
lea rax, [0x1402481f8]
mov qword [rbp + 0x10], rbx
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x38]
lea rax, str.Path
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 8]
xor eax, eax
mov qword [rbp + 8], rax
mov word [rbp - 8], ax
call fcn.14000ae7c
lea rax, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov r8d, 0x64
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x70]
lea rax, str.Options
mov qword [rbp - 0x70], rax
lea r9, str.Failed_to_make_progress_in_the_key_chain_
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x68], eax
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x70], rax
lea rax, [0x14023d5c0]
mov qword [rsp + 0x78], rax
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov ecx, 0x8496e1
jmp 0x1400a2c3d
mov ebx, 7
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x38], r8w
cmp word [rdi], r8w
jne 0x1400a2b84
mov rdx, r8
jmp 0x1400a2b92
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r8w
jne 0x1400a2b88
mov r8, rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
call fcn.14000b6f8
lea rax, [0x1402481f8]
mov qword [rbp + 0x10], rbx
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x38]
lea rax, str.Path
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 8]
xor eax, eax
mov qword [rbp + 8], rax
mov word [rbp - 8], ax
call fcn.14000ae7c
lea rax, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov ecx, 0x8496e0
mov qword [rbp - 0x78], rax
lea r9, str.Failed_to_find_a_cached_key_anywhere_in_the_chain_
lea rax, str.Options
mov r8d, 0xc8
mov qword [rbp - 0x70], rax
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x68], eax
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x70], rax
lea rax, [0x14023d5c0]
mov qword [rsp + 0x78], rax
mov rax, qword [r12]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov edx, 0x3a7
call fcn.1400a2088
xor r8d, r8d
lea rcx, [rbp - 8]
mov dl, 1
call fcn.14000b190
xor r8d, r8d
lea rcx, [rbp - 0x38]
mov dl, 1
call fcn.14000b190
mov eax, 2
jmp 0x1400a22dd
mov rcx, r14
call fcn.1400a4154
test ebx, ebx
jne 0x1400a2c9d
mov rax, qword [rsp + 0x48]
mov rcx, qword [r13]
mov qword [rcx], rax
mov rax, qword [r13]
mov dword [rax + 0x10], esi
mov rax, qword [r13]
mov qword [rax + 8], r12
jmp 0x1400a2c9d
mov qword [r13], r14
mov ebx, r8d
test rdi, rdi
je 0x1400a2a76
mov dword [rdi], 2
jmp 0x1400a2a76
mov dword [0], 1
xor ecx, ecx
int 0x29