Function at 0x1400b0080
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, r8
mov rbx, rdx
mov r13, rcx
lea rsi, [0x1400f3190]
mov rcx, qword [0x1400f3190]
cmp rcx, rsi
je 0x1400b00ee
test byte [rcx + 0x1c], 1
je 0x1400b00ee
cmp byte [rcx + 0x19], 5
jb 0x1400b00ee
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.1400ad3e0
and qword [rbp - 0x71], 0
and dword [rbp - 0x69], 0
and dword [rbp - 0x65], 0
lea rdx, [rbp - 0x71]
mov rcx, r13
call fcn.1400ad704
mov edi, eax
mov r10, qword [0x1400f3190]
cmp r10, rsi
je 0x1400b0142
test byte [r10 + 0x1c], 2
je 0x1400b0142
cmp byte [r10 + 0x19], 4
jb 0x1400b0142
mov edx, SafeArrayPtrOfIndex
mov r9d, eax
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.1400036a8
mov r10, qword [0x1400f3190]
and qword [rbp - 0x51], 0
and dword [rbp - 0x49], 0
and dword [rbp - 0x45], 0
lea rcx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
lea r8, [0x14000a540]
test edi, edi
jne 0x1400b0255
xor ebx, ebx
mov qword [rbp - 9], rbx
and qword [rbp - 1], rbx
and qword [rbp + 7], rbx
and qword [rbp - 0x39], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
cmp qword [rax + 0x58], r8
cmovne rdx, rcx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400b01b7
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 9], rbx
mov r10, qword [0x1400f3190]
cmp r10, rsi
je 0x1400b01f0
test byte [r10 + 0x1c], 2
je 0x1400b01f0
cmp byte [r10 + 0x19], 4
jb 0x1400b01f0
mov edx, SafeArrayPtrOfIndex
mov r9d, edi
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.1400036a8
mov r10, qword [0x1400f3190]
test edi, edi
jne 0x1400b023c
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.1400a9158
mov edi, eax
mov r10, qword [0x1400f3190]
cmp r10, rsi
je 0x1400b023c
test byte [r10 + 0x1c], 2
je 0x1400b023c
cmp byte [r10 + 0x19], 4
jb 0x1400b023c
mov edx, SafeArrayPtrOfIndex
mov r9d, eax
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.1400036a8
mov r10, qword [0x1400f3190]
test rbx, rbx
je 0x1400b0251
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r10, qword [0x1400f3190]
mov rbx, qword [rbp + 0x67]
xor r14d, r14d
cmp dword [rbp - 0x69], r14d
jle 0x1400b084d
xor r12d, r12d
and dword [rbp + 0x77], 0
test r14d, r14d
js 0x1400b08c2
cmp r14d, dword [rbp - 0x69]
jge 0x1400b08c2
mov rax, qword [rbp - 0x71]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400ae888
mov edi, eax
mov r10, qword [0x1400f3190]
cmp r10, rsi
je 0x1400b02cb
test byte [r10 + 0x1c], 2
je 0x1400b02cb
cmp byte [r10 + 0x19], 4
jb 0x1400b02cb
mov edx, reloc.OLEAUT32.dll_SafeArrayPtrOfIndex
mov r9d, eax
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.1400036a8
mov r10, qword [0x1400f3190]
test edi, edi
jne 0x1400b0327
cmp dword [rbp + 0x77], 1
jne 0x1400b0327
cmp r10, rsi
je 0x1400b07a7
test byte [r10 + 0x1c], 2
je 0x1400b07a7
cmp byte [r10 + 0x19], 4
jb 0x1400b07a7
cmp r14d, dword [rbp - 0x69]
jge 0x1400b08cd
mov edx, reloc.OLEAUT32.dll_SysStringByteLen
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r12*8]
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.140003608
mov r10, qword [0x1400f3190]
jmp 0x1400b07a7
and dword [rbp - 0x61], 0
cmp r14d, dword [rbp - 0x69]
jge 0x1400b0951
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400aeb20
test eax, eax
jne 0x1400b0394
cmp dword [rbp - 0x61], 1
jne 0x1400b0394
mov r10, qword [0x1400f3190]
cmp r10, rsi
je 0x1400b07a7
test byte [r10 + 0x1c], 2
je 0x1400b07a7
cmp byte [r10 + 0x19], 4
jb 0x1400b07a7
cmp r14d, dword [rbp - 0x69]
jge 0x1400b08d8
mov edx, 0x95
jmp 0x1400b0303
cmp r14d, dword [rbp - 0x69]
jge 0x1400b0946
mov rsi, qword [rbp - 0x71]
xor ecx, ecx
xor r11d, r11d
cmp dword [rbx + 8], ecx
jle 0x1400b03f5
movsxd rbx, dword [rbx + 8]
mov r10, qword [rbp + 0x67]
mov r10, qword [r10]
cmp qword [rsi + r12*8], 0
je 0x1400b08e3
mov rax, qword [r10]
mov r9, qword [rsi + r12*8]
sub r9, rax
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x1400b03e2
add rax, 2
test edx, edx
jne 0x1400b03cc
test r8d, r8d
je 0x1400b03f8
inc ecx
inc r11
add r10, 8
cmp r11, rbx
jl 0x1400b03b7
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x1400b0448
mov r10, qword [0x1400f3190]
lea rax, [0x1400f3190]
cmp r10, rax
je 0x1400b07a0
test byte [r10 + 0x1c], 2
je 0x1400b07a0
cmp byte [r10 + 0x19], 4
jb 0x1400b07a0
mov edx, 0x96
mov r9, qword [rsi + r12*8]
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.140003608
jmp 0x1400b0799
cmp qword [r15 + 0x10], 0
je 0x1400b057b
mov rax, qword [0x1400f6030]
lea rcx, [0x1400f6030]
mov rax, qword [rax + 0x18]
call qword [str.__f_]
add rax, 0x18
mov qword [rbp - 0x31], rax
cmp r14d, dword [rbp - 0x69]
jge 0x1400b08f9
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x31]
lea r8, str.NetworkInterface
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400aecf4
mov rbx, qword [rbp - 0x31]
test eax, eax
jne 0x1400b055a
cmp dword [rbx - 0x10], eax
je 0x1400b055a
mov rax, qword [r15]
jmp 0x1400b04da
mov rcx, qword [rax + 0x10]
mov r9, rbx
sub r9, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x1400b04d2
add rcx, 2
test edx, edx
jne 0x1400b04bc
test r8d, r8d
je 0x1400b04df
mov rax, qword [rax]
test rax, rax
jne 0x1400b04b2
test rax, rax
jne 0x1400b055a
mov rcx, qword [0x1400f3190]
lea rsi, [0x1400f3190]
cmp rcx, rsi
je 0x1400b0530
test byte [rcx + 0x1c], 2
je 0x1400b0530
cmp byte [rcx + 0x19], 4
jb 0x1400b0530
cmp r14d, dword [rbp - 0x69]
jge 0x1400b08ee
mov rax, qword [rbp - 0x71]
mov edx, 0x97
mov qword [rsp + 0x20], rbx
mov r9, qword [rax + r12*8]
lea r8, [0x1400d8e00]
mov rcx, qword [rcx + 0x10]
call fcn.14000a758
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b031b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
jmp 0x1400b031b
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b057b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
xor esi, esi
xor r15d, r15d
cmp dword [rbp - 0x49], esi
jle 0x1400b075d
xor ebx, ebx
mov qword [rbp - 0x21], rbx
and qword [rbp - 0x19], rbx
and qword [rbp - 0x11], rbx
mov rax, qword [r13]
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0MAC_Access_Control
lea rcx, [0x14000a540]
cmp qword [rax + 0x58], rcx
lea rax, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0Server_Settings
cmovne rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140004be4
nop
lea r8d, [rbx + 1]
lea rdx, [0x1400cc650]
lea rcx, [rbp - 0x59]
call fcn.140004638
test r15, r15
js 0x1400b0925
cmp esi, dword [rbp - 0x49]
jge 0x1400b0925
mov rax, qword [rbp - 0x51]
mov rdx, qword [rax + r15*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.140004638
and qword [rbp - 0x29], rbx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400b0632
mov rbx, qword [rbp - 0x29]
mov qword [rbp - 0x21], rbx
mov rcx, qword [0x1400f3190]
lea rax, [0x1400f3190]
cmp rcx, rax
je 0x1400b0669
test byte [rcx + 0x1c], 2
je 0x1400b0669
cmp byte [rcx + 0x19], 4
jb 0x1400b0669
mov edx, 0x98
mov r9d, edi
lea r8, [0x1400d8e00]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
test edi, edi
jne 0x1400b071a
and dword [rbp - 0x5d], edi
test r12, r12
js 0x1400b091a
cmp r14d, dword [rbp - 0x69]
jge 0x1400b091a
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x41], 4
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400b06cb
mov eax, dword [rbp - 0x3d]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov rcx, qword [0x1400f3190]
lea rax, [0x1400f3190]
cmp rcx, rax
je 0x1400b0710
test byte [rcx + 0x1c], 2
je 0x1400b0710
cmp byte [rcx + 0x19], 4
jb 0x1400b0710
mov edx, 0x99
mov r9d, edi
lea r8, [0x1400d8e00]
mov rcx, qword [rcx + 0x10]
call fcn.1400036a8
mov rcx, qword [0x1400f3190]
lea rax, [0x1400f3190]
cmp dword [rbp - 0x5d], 0
jne 0x1400b07c0
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b0740
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400b074f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
inc r15
cmp esi, dword [rbp - 0x49]
jl 0x1400b0589
cmp r14d, dword [rbp - 0x69]
jge 0x1400b093b
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r12*8]
mov rcx, r13
call fcn.1400adb00
cmp r14d, dword [rbp - 0x69]
jge 0x1400b0930
movsxd rcx, r14d
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.140014a8c
mov r15, qword [rbp + 0x6f]
mov r10, qword [0x1400f3190]
lea rsi, [0x1400f3190]
inc r14d
inc r12
cmp r14d, dword [rbp - 0x69]
jge 0x1400b084d
mov rbx, qword [rbp + 0x67]
jmp 0x1400b0265
cmp rcx, rax
je 0x1400b080f
test byte [rcx + 0x1c], 2
je 0x1400b080f
cmp byte [rcx + 0x19], 4
jb 0x1400b080f
cmp esi, dword [rbp - 0x49]
jge 0x1400b090f
mov rax, qword [rbp - 0x51]
mov r8, qword [rax + r15*8]
cmp r14d, dword [rbp - 0x69]
jge 0x1400b0904
mov rax, qword [rbp - 0x71]
mov edx, 0x9a
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r12*8]
lea r8, [0x1400d8e00]
mov rcx, qword [rcx + 0x10]
call fcn.14000a758
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b0835
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__f_]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400b0795
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b0795
cmp r10, rsi
je 0x1400b0892
test byte [r10 + 0x1c], 1
je 0x1400b0892
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400b0892
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, 0x9b
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, [0x1400d8e00]
mov rcx, qword [r10 + 0x10]
call fcn.1400056d8
nop
lea rcx, [rbp - 0x51]
call fcn.140014a08
nop
lea rcx, [rbp - 0x71]
call fcn.140014a08
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0x80004005
call fcn.1400051a4
nop
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
nop
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
nop
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3
mov ecx, 0xc000008c
call fcn.14000518c
int3