Function at 0x140067428
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov r12, rdx
mov r13, rcx
and dword [rax + 0x20], r14d
mov rcx, qword [str.___t_]
lea rdi, str.___t_
lea rsi, [0x140004c30]
cmp rcx, rdi
je 0x140067485
test byte [rcx + 0x1c], 4
je 0x140067485
cmp byte [rcx + 0x19], 5
jb 0x140067485
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0xa]
mov r8, rsi
call fcn.14000e618
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x30]
lea rdx, [0x140004b58]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400674e6
mov rcx, qword [str.___t_]
cmp rcx, rdi
je 0x140067687
test byte [rcx + 0x1c], 4
je 0x140067687
cmp byte [rcx + 0x19], 2
jb 0x140067687
mov edx, 0xb
mov r8, rsi
jmp 0x140067709
cmp dword [rsp + 0x30], 3
je 0x140067520
mov rcx, qword [str.___t_]
cmp rcx, rdi
je 0x140067516
test byte [rcx + 0x1c], 4
je 0x140067516
cmp byte [rcx + 0x19], 2
jb 0x140067516
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r8, rsi
call fcn.14000e618
mov ebx, 0x3f1
jmp 0x140067687
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x140067687
mov ecx, eax
call fcn.140072274
mov r14, rax
test rax, rax
jne 0x140067579
lea ebx, [rax + 8]
mov rcx, qword [str.___t_]
cmp rcx, rdi
je 0x140067687
test byte [rcx + 0x1c], 4
je 0x140067687
cmp byte [rcx + 0x19], 2
jb 0x140067687
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xd]
mov r8, rsi
call fcn.14000e618
jmp 0x140067687
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x30]
lea rdx, [0x140004b58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400675d7
mov rcx, qword [str.___t_]
cmp rcx, rdi
je 0x140067687
test byte [rcx + 0x1c], 4
je 0x140067687
cmp byte [rcx + 0x19], 2
jb 0x140067687
mov edx, 0xe
jmp 0x1400674de
mov edi, dword [rsp + 0x98]
xor ebp, ebp
shr edi, 2
lea r15d, [rbp + 1]
test edi, edi
je 0x140067687
mov rsi, r14
lea r8, [0x14009a3f0]
mov rax, qword [0x14009a3f0]
mov edx, dword [rsi]
test rax, rax
jne 0x1400676b4
xor r15d, r15d
inc ebp
add rsi, 4
cmp ebp, edi
jb 0x1400675f9
test r15d, r15d
jne 0x140067687
mov rdx, r12
mov rcx, r13
call fcn.140067794
test eax, eax
je 0x140067662
mov rcx, qword [str.___t_]
lea rdx, str.___t_
cmp rcx, rdx
je 0x140067662
test byte [rcx + 0x1c], 4
je 0x140067662
cmp byte [rcx + 0x19], 2
jb 0x140067662
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x10]
lea r8, [0x140004c30]
mov r9d, eax
call fcn.14000e63c
mov rax, qword [rsp + 0x90]
mov r9d, 0x80007d42
mov qword [rsp + 0x20], rax
mov eax, 1
lea edx, [rax + 1]
mov r8d, eax
mov ecx, eax
call fcn.1400728a0
mov rcx, r14
call fcn.140072328
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rax
mov rax, qword [rax]
cmp dword [rcx + 0x18], edx
je 0x1400676bb
cmp rax, r8
jne 0x1400676a9
xor ecx, ecx
test rcx, rcx
je 0x14006760b
mov rcx, r13
call fcn.140067aec
mov ebx, eax
test eax, eax
jne 0x1400676de
lea r8, [0x14009a3f0]
jmp 0x14006760e
mov rcx, qword [str.___t_]
lea rdx, str.___t_
cmp rcx, rdx
je 0x140067687
test byte [rcx + 0x1c], 4
je 0x140067687
cmp byte [rcx + 0x19], 2
jb 0x140067687
mov edx, 0xf
lea r8, [0x140004c30]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
call fcn.14000e63c
jmp 0x140067687