Function at 0x1400038a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rsi, rdx
lea rax, [r11 - 0x40]
mov qword [r11 + 0x18], rax
call fcn.140014ad4
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400038e5
mov ecx, 0x80004005
call fcn.1400047b0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.Start
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x14000392c
movzx edi, dx
mov ecx, edi
call fcn.140016678
test rax, rax
je 0x140003949
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140004cb0
jmp 0x140003949
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.1400049e0
nop
mov r8, rsi
lea rdx, str.SYSTEMCurrentControlSet_services_
lea rcx, [rsp + 0x50]
call fcn.140004550
mov rbp, rax
mov edi, 0x270f
mov dword [rsp + 0x90], 4
lea r8, [rsp + 0x40]
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140003a91
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove edi, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400039f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140003a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp edi, 2
jne 0x140003a3e
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140003a34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 2
jmp 0x140003af1
cmp edi, 3
jne 0x140003a69
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140003a5f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 3
jmp 0x140003af1
cmp edi, 4
jne 0x140003ad1
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140003a8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 4
jmp 0x140003af1
mov rdx, qword [rbp]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140003ab0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140003ad1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140003aef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret